16pcs

显示全部楼层 · 发表于 2007-12-30 20:23:40

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.312\1.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\D6DE9E8C.EXE
2) C:\WINDOWS\SYSTEM32\E07E3C24.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX08.859\10.EXE
是否删除病毒程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX10.000\11.EXE
是否删除病毒程序及其衍生物?

显示全部楼层 · 发表于 2007-12-30 20:28:56

BD
C:\a\15.rar=]16.exe DeepScan:Generic.Dld.Agent.702DE388 Disinfect Failed
C:\a\15.rar=]15.exe DeepScan:Generic.Dld.Agent.DAFBCD65
C:\a\15.rar=]3.exe DeepScan:Generic.PWS.Online.1.AF4EF153
C:\a\15.rar=]12.exe DeepScan:Generic.PWS.Online.1.BE3C000D
C:\a\15.rar=]2.exe Dropped:Generic.Malware.Fdld.6A27DFA0
C:\a\15.rar=]8.exe Generic.Malware.SFdldg.2EDDC1B4
C:\a\15.rar=]14.exe Trojan.Dropper.Agent.TKK
C:\a\15.rar=]4.exe Trojan.Dropper.Agent.TKK
C:\a\15.rar=]1.EXE Win32.Worm.Winko.I
C:\a\15.rar=]10.exe Win32.Worm.Winko.I
C:\a\15.rar=]11.exe Win32.Worm.Winko.I

显示全部楼层 · 发表于 2007-12-30 20:33:10

* avast! 报告
* 这个文件自动被产生
*
* 任务 '简易用户界面' 被使用
* 开始于 2007年12月30日 20:32:26
* VPS: 071229-0, 2007-12-29
*

C:\Documents and Settings\David\桌面\新建文件夹\1.rar\1.exe\[PECompact]\[Embedded#1] [L] Win32:Baidubar-B [Trj] (0)
C:\Documents and Settings\David\桌面\新建文件夹\15.rar\14.exe\[Embedded#0c80]\[Upack]\[Embedded#5158]\[Upack] [L] Win32:OnLineGames-ST [Trj] (0)
C:\Documents and Settings\David\桌面\新建文件夹\15.rar\14.exe [L] Win32:OnLineGames-SR [Trj] (0)
C:\Documents and Settings\David\桌面\新建文件夹\15.rar\1.EXE\[Upack]\[Embedded#05010] [L] Win32:AutoRun-IC (0)
C:\Documents and Settings\David\桌面\新建文件夹\15.rar\4.exe\[Embedded#0c80]\[Upack]\[Embedded#5158]\[Upack] [L] Win32:OnLineGames-ST [Trj] (0)
C:\Documents and Settings\David\桌面\新建文件夹\15.rar\4.exe [L] Win32:OnLineGames-SR [Trj] (0)
C:\Documents and Settings\David\桌面\新建文件夹\15.rar\10.exe\[Upack]\[Embedded#05010] [L] Win32:AutoRun-IC (0)
C:\Documents and Settings\David\桌面\新建文件夹\15.rar\15.exe\[Upack]\[Embedded#MUSIC] [L] Win32:OnLineGames-BOA [Trj] (0)
C:\Documents and Settings\David\桌面\新建文件夹\15.rar\5.exe\[Upack]\[Embedded#6090] [L] Win32:Agent-LSI [Trj] (0)
C:\Documents and Settings\David\桌面\新建文件夹\15.rar\11.exe\[Upack]\[Embedded#05010] [L] Win32:AutoRun-IC (0)
C:\Documents and Settings\David\桌面\新建文件夹\15.rar\16.exe\[Upack]\[Embedded#MUSIC] [L] Win32:OnLineGames-BGD [Trj] (0)
C:\Documents and Settings\David\桌面\新建文件夹\15.rar\3.exe\[Upack]\[Embedded#7060]\[Upack] [L] Win32:OnLineGames-BKU [Trj] (0)
C:\Documents and Settings\David\桌面\新建文件夹\15.rar\12.exe\[Upack]\[Embedded#6060]\[Upack] [L] Win32:OnLineGames-BKU [Trj] (0)
已感染文件: 13
总共文件: 70
总共文件夹: 1
总共大小: 6.9 MB
* 任务被停止: 2007年12月30日 20:32:40
* 运作时间是 14 秒

显示全部楼层 · 发表于 2007-12-30 21:20:39

15.rar
13个

C:\Users\Wesley\Downloads\15.rar » RAR » 14.exe - a variant of Win32/PSW.Agent.NEC trojan
C:\Users\Wesley\Downloads\15.rar » RAR » 1.EXE - a variant of Win32/TrojanDownloader.Flux trojan
C:\Users\Wesley\Downloads\15.rar » RAR » 4.exe - a variant of Win32/PSW.Agent.NEC trojan
C:\Users\Wesley\Downloads\15.rar » RAR » 6.exe - probably unknown NewHeur_PE virus
C:\Users\Wesley\Downloads\15.rar » RAR » 10.exe - a variant of Win32/TrojanDownloader.Flux trojan
C:\Users\Wesley\Downloads\15.rar » RAR » 15.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Users\Wesley\Downloads\15.rar » RAR » 2.exe - a variant of Win32/PSW.OnLineGames.GJV trojan
C:\Users\Wesley\Downloads\15.rar » RAR » 5.exe - probably unknown NewHeur_PE virus
C:\Users\Wesley\Downloads\15.rar » RAR » 11.exe - a variant of Win32/TrojanDownloader.Flux trojan
C:\Users\Wesley\Downloads\15.rar » RAR » 16.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Users\Wesley\Downloads\15.rar » RAR » 3.exe - a variant of Win32/PSW.OnLineGames.JOJ trojan
C:\Users\Wesley\Downloads\15.rar » RAR » 8.exe - probably a variant of Win32/Genetik trojan
C:\Users\Wesley\Downloads\15.rar » RAR » 12.exe - a variant of Win32/PSW.OnLineGames.JOJ trojan

1.rar
0个

显示全部楼层 · 发表于 2007-12-30 22:29:19

-----------------------------SCAN REPORT-----------------------------
F-PROT Antivirus for Windows

Antivirus Scanning Engine version number: 4.4.2
Virus signature file from: 30/12/2007, 0:17

Scan name: test
Path to scan: C:\Documents and Settings\Owner\桌面\1.rar|C:\Documents and Settings\Owner\桌面\15.rar|

Thorough scan
Also scan: Inside subfolders, Compressed files, Streams

Scan started: 30/12/2007, 22:27:35
---------------------------------------------------------------------

[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\Owner\桌面\15.rar->14.exe->(embedded)->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\Owner\桌面\15.rar->1.EXE->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\Owner\桌面\15.rar->4.exe->(embedded)->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (not disinfectable)> C:\Documents and Settings\Owner\桌面\15.rar->6.exe->(Klone.AF)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\Owner\桌面\15.rar->10.exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\Owner\桌面\15.rar->15.exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\Owner\桌面\15.rar->5.exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\Owner\桌面\15.rar->11.exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\Owner\桌面\15.rar->16.exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\Owner\桌面\15.rar->3.exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\Owner\桌面\15.rar->8.exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\Owner\桌面\15.rar->12.exe->(UPack)

显示全部楼层 · 发表于 2007-12-30 23:51:08

McAfee两个合起来查完后剩下4个。

显示全部楼层 · 发表于 2007-12-31 00:46:00

正在扫描日志
病毒库版本: 2756 (20071230)
日期: 2007-12-31 时间: 0:45:47
已扫描的磁盘、文件夹和文件: G:\15.rar
G:\15.rar ?RAR ?14.exe - Win32/PSW.Agent.NEC 特洛伊木马的变种 - 是已删除对象的一部分
G:\15.rar ?RAR ?1.EXE - Win32/TrojanDownloader.Flux 特洛伊木马的变种 - 是已删除对象的一部分
G:\15.rar ?RAR ?4.exe - Win32/PSW.Agent.NEC 特洛伊木马的变种 - 是已删除对象的一部分
G:\15.rar ?RAR ?6.exe - 未查明的 NewHeur_PE 病毒 [7] - 是已删除对象的一部分
G:\15.rar ?RAR ?10.exe - Win32/TrojanDownloader.Flux 特洛伊木马的变种 - 是已删除对象的一部分
G:\15.rar ?RAR ?15.exe - Win32/PSW.OnLineGames.FDY 特洛伊木马的变种 - 是已删除对象的一部分
G:\15.rar ?RAR ?2.exe - Win32/PSW.OnLineGames.GJV 特洛伊木马的变种 - 是已删除对象的一部分
G:\15.rar ?RAR ?5.exe - 未查明的 NewHeur_PE 病毒 [7] - 是已删除对象的一部分
G:\15.rar ?RAR ?11.exe - Win32/TrojanDownloader.Flux 特洛伊木马的变种 - 是已删除对象的一部分
G:\15.rar ?RAR ?16.exe - Win32/PSW.OnLineGames.FDY 特洛伊木马的变种 - 是已删除对象的一部分
G:\15.rar ?RAR ?3.exe - Win32/PSW.OnLineGames.JOJ 特洛伊木马的变种 - 是已删除对象的一部分
G:\15.rar ?RAR ?8.exe - 可能是 Win32/Genetik 特洛伊木马的变种 - 是已删除对象的一部分
G:\15.rar ?RAR ?12.exe - Win32/PSW.OnLineGames.JOJ 特洛伊木马的变种 - 是已删除对象的一部分
已扫描的对象数: 16
发现的威胁数: 13
完成时间: 0:45:55 总扫描时间: 8 秒 (00:00:08)

备注:
[7] 对象可能感染了未知病毒。

显示全部楼层 · 发表于 2007-12-31 00:50:59

quarantined: virus Heur.Invader (modification) File: E:\Virus sample\15.rar/14.exe
quarantined: virus Heur.Invader (modification) File: E:\Virus sample\15.rar/4.exe
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.moh File: E:\Virus sample\15.rar/15.exe//UPack//#
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.mnz File: E:\Virus sample\15.rar/2.exe//FSG//#//UPack//PE_Patch.MaskPE
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.mof File: E:\Virus sample\15.rar/16.exe//UPack//#
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.lzp File: E:\Virus sample\15.rar/3.exe//PE_Patch//UPack//#
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.mfl File: E:\Virus sample\15.rar/12.exe//PE_Patch//UPack//#

显示全部楼层 · 发表于 2007-12-31 08:42:21

[病毒样本] 16pcs

ESET Smart Security