s168下的8个，加密真恶心

promised

跟到到这一步
http://w18.vg/oK.txt
[code]鰏犳#蟻鑛C砑b膧鮩G?g阽?贬|膧??c艡馺E頍Y莿?え|跍鱜]澹}菤體@嘟樝? 麪}愔?A洧d脳馺~蕖y澸?I?a艞閔B鸂g羳鬽\?2捤磛@?+悇鮥C悝g脴蔛G?'佫齰\姊j蹮鰓A唳}茪?吊6唩體?y菫鱪G啶e?騭犳#蟻鑛C砑b膧鮩G?g阽?贬|笩? 备a艦餸G猡^

库洛洛

Starting the file scan:

Begin scan in 'E:\8.rar'
E:\8.rar
  [0] Archive type: RAR
  --> oKoK.exe
      [DETECTION] Is the Trojan horse TR/Spy.Agent.avz
  --> svchost.exe
      [DETECTION] Is the Trojan horse TR/Spy.Agent.avz.1
  --> 1.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 2.exe
      [DETECTION] Is the Trojan horse TR/PSW.22016.7
  --> 3.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 4.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> M1.exe
      [DETECTION] Is the Trojan horse TR/Autorun.BK
      [WARNING]   The file was ignored!


End of the scan: 2007年12月31日  17:50
Used time: 00:14 min

The scan has been done completely.

      0 Scanning directories
      9 Files were scanned
      5 viruses and/or unwanted programs were found
      2 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      4 Files not concerned
      1 Archives were scanned
      1 Warnings
      0 Notes

The EQs

引用某人的口头禅：很好，很强大
C:\Documents and Settings\Don johnson\桌面\8.rar » RAR » 1.exe - a variant of Win32/PSW.OnLineGames.NFN trojan
C:\Documents and Settings\Don johnson\桌面\8.rar » RAR » 2.exe - a variant of Win32/PSW.OnLineGames.NFN trojan
C:\Documents and Settings\Don johnson\桌面\8.rar » RAR » 3.exe - a variant of Win32/PSW.OnLineGames.NFN trojan
C:\Documents and Settings\Don johnson\桌面\8.rar » RAR » 4.exe - probably unknown NewHeur_PE virus
C:\Documents and Settings\Don johnson\桌面\8.rar » RAR » M1.exe - probably a variant of Win32/PSW.OnLineGames.NBR trojan

jimmyleo

那个就是传说中的自加密了
没有原算法……
基本是不可能了

这几天世界疯了……
enet pchome pcgame 太平洋
能挂的都挂了~

库洛洛

The file 'Setup.exe' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.

promised

木马集团化的必然结果。。。。。。。

dikex

阿米你OD一下，应该能找到解密算法的

The EQs

刺猬有OD教程？？网上找了半天都没有找到好的教程。。。

kkgh

木马名称:Trojan-Spy.Win32.Agent.cfq

程序:
C:\DOCUMENTS AND SETTINGS\ZH\桌面\OKOK.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Spy.Win32.Agent.cfl

程序:
C:\DOCUMENTS AND SETTINGS\ZH\桌面\SVCHOST.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OLGames.erm

程序:
C:\DOCUMENTS AND SETTINGS\ZH\桌面\1.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OLGames.eqs

程序:
C:\DOCUMENTS AND SETTINGS\ZH\桌面\2.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OLGames.emc

程序:
C:\DOCUMENTS AND SETTINGS\ZH\桌面\3.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.Delf.gin

程序:
C:\DOCUMENTS AND SETTINGS\ZH\桌面\M1.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

dikex

原帖由 EQ2 于 2007-12-31 17:56 发表
刺猬有OD教程？？网上找了半天都没有找到好的教程。。。

没有……
搞好汇编应该没有什么问题吧……
但我的汇编太烂