[MD5: 62D75E 19E95E 508B54 9DE5FD 1853B4 2AF0FF]

显示全部楼层 · 发表于 2008-1-13 17:42:54

真不晓得这些毒怎么想的两个毒互相注入玩得一身劲

显示全部楼层 · 发表于 2008-1-13 17:45:47

Start of the scan: 2008年1月13日  17:45

Starting the file scan:

Begin scan in 'K:\011301.rar'
K:\011301.rar
  [0] Archive type: RAR
  --> tsitra0.exe
   [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> game.exe
   [DETECTION] Is the Trojan horse TR/PSW.Onlineg.KC.2
  --> 1.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.efk
  --> loader.exe
   [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
  --> p.exe
   [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.SU
  --> user4.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Small.dxm.4
   [INFO]    A backup was created as '47baddcd.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2008-1-13 17:46:17

Starting the file scan:

Begin scan in 'E:\011301.rar'
E:\011301.rar
  [0] Archive type: RAR
  --> tsitra0.exe
   [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> game.exe
   [DETECTION] Is the Trojan horse TR/PSW.Onlineg.KC.2
  --> 1.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.efk
  --> loader.exe
   [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
  --> p.exe
   [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.SU
  --> user4.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Small.dxm.4
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2008-1-13 17:49:38

R:\011301.rar » RAR » tsitra0.exe - Win32/TrojanDownloader.Agent.BLS trojan
R:\011301.rar » RAR » game.exe - a variant of Win32/PSW.OnLineGames.NGU trojan
R:\011301.rar » RAR » 1.exe - a variant of Win32/PSW.Delf.NIY trojan
R:\011301.rar » RAR » loader.exe - probably a variant of Win32/TrojanDownloader.VB trojan
R:\011301.rar » RAR » p.exe - probably unknown NewHeur_PE virus
R:\011301.rar » RAR » user4.exe - Win32/TrojanDownloader.Small.DXM trojan

显示全部楼层 · 发表于 2008-1-13 17:51:29

D:\下载文件夹\011301.rar ?RAR ?tsitra0.exe - Win32/TrojanDownloader.Agent.BLS 特洛伊木马
D:\下载文件夹\011301.rar ?RAR ?game.exe - Win32/PSW.OnLineGames.NGU 特洛伊木马的变种
D:\下载文件夹\011301.rar ?RAR ?1.exe - Win32/PSW.Delf.NIY 特洛伊木马的变种
D:\下载文件夹\011301.rar ?RAR ?loader.exe - 可能是 Win32/TrojanDownloader.VB 特洛伊木马的变种
D:\下载文件夹\011301.rar ?RAR ?p.exe - 未查明的 NewHeur_PE 病毒
D:\下载文件夹\011301.rar ?RAR ?user4.exe - Win32/TrojanDownloader.Small.DXM 特洛伊木马

显示全部楼层 · 发表于 2008-1-13 17:51:57

大蜘蛛全歼

011301.rar\tsitra0.exe;I:\virus\011301.rar;Trojan.DownLoader.31817;;
011301.rar\game.exe;I:\virus\011301.rar;BackDoor.RShell;;
011301.rar\1.exe;I:\virus\011301.rar;Trojan.PWS.Gamania.5586;;
011301.rar\loader.exe;I:\virus\011301.rar;Trojan.DownLoader.37981;;
p.exe\data003;I:\virus\011301.rar\p.exe;Trojan.DownLoader.origin;;
p.exe;I:\virus\011301.rar;发现档案文件中有受感染的对象;;
011301.rar\user4.exe;I:\virus\011301.rar;Trojan.DownLoader.18400;;
011301.rar;I:\virus;发现档案文件中有受感染的对象;;

显示全部楼层 · 发表于 2008-1-13 17:56:42

江民

显示全部楼层 · 发表于 2008-1-13 17:58:52

nod通杀

显示全部楼层 · 发表于 2008-1-13 18:56:21

木马名称:Trojan-Downloader.Win32.Agent.lpy

程序:
C:\DOCUMENTS AND SETTINGS\ZH\桌面\TSITRA0.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.qbp

程序:
C:\DOCUMENTS AND SETTINGS\ZH\桌面\1.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-Downloader.Win32.Agent.ood

程序:
C:\DOCUMENTS AND SETTINGS\ZH\桌面\P.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Downloader.Win32.Small.fbp

程序:
C:\DOCUMENTS AND SETTINGS\ZH\桌面\USER4.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

C:\Documents and Settings\zh\桌面\011301.rar 确定
C:\Documents and Settings\zh\桌面\011301.rar=>tsitra0.exe 被感染的: Trojan.Agent.AFQR
C:\Documents and Settings\zh\桌面\011301.rar=>tsitra0.exe 移动失败
C:\Documents and Settings\zh\桌面\011301.rar=>tsitra0.exe 移动失败
C:\Documents and Settings\zh\桌面\011301.rar=>game.exe 被感染的: Trojan.PWS.WOW.NCA
C:\Documents and Settings\zh\桌面\011301.rar=>game.exe 移动失败
C:\Documents and Settings\zh\桌面\011301.rar=>game.exe 移动失败
C:\Documents and Settings\zh\桌面\011301.rar=>1.exe 被感染的: Trojan.PWS.Onlinegames.NHN
C:\Documents and Settings\zh\桌面\011301.rar=>1.exe 移动失败
C:\Documents and Settings\zh\桌面\011301.rar=>1.exe 移动失败
C:\Documents and Settings\zh\桌面\011301.rar=>loader.exe 被感染的: DeepScan:Generic.Malware.dld!Z.F8431164
C:\Documents and Settings\zh\桌面\011301.rar=>loader.exe 移动失败
C:\Documents and Settings\zh\桌面\011301.rar=>loader.exe 移动失败
C:\Documents and Settings\zh\桌面\011301.rar=>p.exe 被感染的: Generic.Malware.SP!Yd!dldPk!g.88ABAFDB
C:\Documents and Settings\zh\桌面\011301.rar=>p.exe 移动失败
C:\Documents and Settings\zh\桌面\011301.rar=>p.exe 移动失败
C:\Documents and Settings\zh\桌面\011301.rar=>user4.exe 被感染的: Trojan.Downloader.Small.YM
C:\Documents and Settings\zh\桌面\011301.rar=>user4.exe 移动失败
C:\Documents and Settings\zh\桌面\011301.rar=>user4.exe 移动失败

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.DL.Win32.Agent.zra
病毒： Trojan.PSW.Win32.OnlineGames.GEN
病毒： Trojan.Win32.Delf.yij
病毒： Trojan.DL.Win32.Mnless.qm
病毒： Trojan.DL.Win32.Agent.xes

用户来源：互联网

软件版本：20.26.61

显示全部楼层 · 发表于 2008-1-13 19:02:22

P.EXE
Trojan program(s) generates files as below:
1) C:\WINDOWS\SYSTEM32\RESSDT.SYS
2) C:\WINDOWS\SYSTEM32\RESSDT.EXE
3) C:\WINDOWS\SYSTEM32\SYSAVE.EXE Trojan-Downloader.Win32.Agent.ojm
Delete Trojan program(s) and its remains or not?

[病毒样本] [MD5: 62D75E 19E95E 508B54 9DE5FD 1853B4 2AF0FF]

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源