收藏本站 |切换到宽版 | 更换论坛皮肤
 找回密码  忘记邮箱  QQ快速登录  快速登录  快速注册

卡饭»论坛 › 安全区 › 病毒样本 分享&分析区 › 新机器狗病毒的驱动 生成的userinit以及下载的木马
12下一页
返回列表 发新帖
查看: 5578|回复: 18
收起左侧

[病毒样本] 新机器狗病毒的驱动 生成的userinit以及下载的木马

[复制链接]
newcenturysun
发表于 2008-1-14 00:14:35 | 显示全部楼层 |阅读模式
帮人弄电脑来的一堆

新机器狗搞的 一个驱动 以及他生成的userinit 和下载的木马

本帖子中包含更多资源

您需要 登录 才可以下载或查看，没有帐号？快速注册

x
回复

举报

无尽藏海
发表于 2008-1-14 00:15:26 | 显示全部楼层
全灭，启发已上报~

Begin scan in 'D:\Downloads\样本\111.rar'
D:\Downloads\样本\111.rar
  [0] Archive type: RAR
  --> 111\853957m.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> 111\853957mm.dll
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> 111\853957w.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> 111\853957wo.dll
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> 111\cmdbcs.dll
      [DETECTION] Is the Trojan horse TR/PSW.27648.6
  --> 111\cmdbcs.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 111\hookhelp.dll
      [DETECTION] Is the Trojan horse TR/Agent.16904.1
  --> 111\kvsc3.dll
      [DETECTION] Is the Trojan horse TR/PSW.30208.6
  --> 111\kvsc3.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 111\lymangr.dll
      [DETECTION] Is the Trojan horse TR/PSW.Online.agb.2
  --> 111\msacpe.sys
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 111\msprint32d.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mjk.5
  --> 111\ntfs.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 111\phy.sys
      [DETECTION] Is the Trojan horse TR/Dldr.Apher.X
  --> 111\ssldyn.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.lgk.1
  --> 111\ssldyn.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 111\swrcgac.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.B
  --> 111\swrcgzc.dll
      [DETECTION] Is the Trojan horse TR/WuDisable.B
  --> 111\userinit.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
  --> 111\utgnehz.dll
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 111\wn_sys8x.sys
      [DETECTION] Is the Trojan horse TR/PSW.Steal.48254
      [WARNING]   The file was ignored!


End of the scan: 2008年1月14日  00:12
Used time: 00:05 min

The scan has been done completely.

      0 Scanning directories
     22 Files were scanned
     20 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      1 Archives were scanned
      1 Warnings
      0 Notes

[ 本帖最后由 无尽藏海 于 2008-1-14 00:18 编辑 ]
回复

举报

浪滔天
发表于 2008-1-14 00:18:57 | 显示全部楼层
卡巴 7.0.1.321
18个

已删除: 木马程序 Trojan-PSW.Win32.QQPass.ara        文件: F:\病毒样本\111.rar/111\wn_sys8x.sys
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.nzv        文件: F:\病毒样本\111.rar/111\utgnehz.dll//UPack//#
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.nxo        文件: F:\病毒样本\111.rar/111\swrcgzc.dll
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.nxo        文件: F:\病毒样本\111.rar/111\swrcgac.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.nmy        文件: F:\病毒样本\111.rar/111\853957wo.dll
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.nif        文件: F:\病毒样本\111.rar/111\lymangr.dll//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.nbk        文件: F:\病毒样本\111.rar/111\kvsc3.exe//NSPack//PE_Patch
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.nbj        文件: F:\病毒样本\111.rar/111\kvsc3.dll
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.mys        文件: F:\病毒样本\111.rar/111\msprint32d.dll
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.mdd        文件: F:\病毒样本\111.rar/111\853957mm.dll
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.lgk        文件: F:\病毒样本\111.rar/111\ssldyn.dll
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.ksa        文件: F:\病毒样本\111.rar/111\cmdbcs.dll
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.kry        文件: F:\病毒样本\111.rar/111\cmdbcs.exe//NSPack//PE_Patch
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.isb        文件: F:\病毒样本\111.rar/111\ssldyn.exe
已删除: 木马程序 Trojan-PSW.Win32.Lmir.boy        文件: F:\病毒样本\111.rar/111\853957w.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.Lmir.boy        文件: F:\病毒样本\111.rar/111\853957m.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-Downloader.Win32.Small.hpn        文件: F:\病毒样本\111.rar/111\userinit.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-Downloader.Win32.Apher.x        文件: F:\病毒样本\111.rar/111\phy.sys
回复

举报

无尽藏海
发表于 2008-1-14 00:19:18 | 显示全部楼层
EAV  18个

D:\Downloads\样本\1112\111\853957m.exe - Win32/PSW.WOW.WU trojan
D:\Downloads\样本\1112\111\853957mm.dll - Win32/PSW.Legendmir.NFF trojan
D:\Downloads\样本\1112\111\853957w.exe - Win32/PSW.WOW.WU trojan
D:\Downloads\样本\1112\111\853957wo.dll - Win32/PSW.WOW.WU trojan
D:\Downloads\样本\1112\111\cmdbcs.dll - Win32/PSW.OnLineGames.NFL trojan
D:\Downloads\样本\1112\111\cmdbcs.exe - Win32/PSW.OnLineGames.NFL trojan
D:\Downloads\样本\1112\111\hookhelp.dll - probably a variant of Win32/PSW.OnLineGames.FDY trojan
D:\Downloads\样本\1112\111\kvsc3.dll - Win32/PSW.OnLineGames.HCV trojan
D:\Downloads\样本\1112\111\kvsc3.exe - Win32/PSW.OnLineGames.NFL trojan
D:\Downloads\样本\1112\111\lymangr.dll - Win32/PSW.OnLineGames.DTR trojan
D:\Downloads\样本\1112\111\msprint32d.dll - Win32/PSW.OnLineGames.HCV trojan
D:\Downloads\样本\1112\111\ssldyn.dll - Win32/PSW.OnLineGames.HCV trojan
D:\Downloads\样本\1112\111\ssldyn.exe - Win32/PSW.OnLineGames.NFL trojan
D:\Downloads\样本\1112\111\swrcgac.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
D:\Downloads\样本\1112\111\swrcgzc.dll - a variant of Win32/PSW.OnLineGames.FDY trojan
D:\Downloads\样本\1112\111\userinit.exe - a variant of Win32/TrojanDownloader.Small.HLV trojan
D:\Downloads\样本\1112\111\utgnehz.dll - probably a variant of Win32/PSW.OnLineGames.NHF trojan
D:\Downloads\样本\1112\111\wn_sys8x.sys - probably a variant of Win32/AutoRun.Q worm
回复

举报

欠妳緈諨
发表于 2008-1-14 00:52:49 | 显示全部楼层
AVAST16

本帖子中包含更多资源

您需要 登录 才可以下载或查看，没有帐号？快速注册

x
回复

举报

黑暗亚当
发表于 2008-1-14 00:54:52 | 显示全部楼层
红伞全灭
回复

举报

mofunzone
发表于 2008-1-14 01:44:46 | 显示全部楼层
Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\111.rar'
C:\Documents and Settings\Administrator\My Documents\
  111.rar
    [0] Archive type: RAR
      --> 111\853957m.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
              [WARNING]   Infected files in archives cannot be repaired!
    --> 111\853957mm.dll
        [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
        [WARNING]   Infected files in archives cannot be repaired!
      --> 111\853957w.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
              [WARNING]   Infected files in archives cannot be repaired!
    --> 111\853957wo.dll
        [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 111\cmdbcs.dll
        [DETECTION] Is the Trojan horse TR/PSW.27648.6
        [WARNING]   Infected files in archives cannot be repaired!
      --> 111\cmdbcs.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Contains suspicious code HEUR/Malware
              [WARNING]   Infected files in archives cannot be repaired!
    --> 111\hookhelp.dll
        [DETECTION] Is the Trojan horse TR/Agent.16904.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> 111\kvsc3.dll
        [DETECTION] Is the Trojan horse TR/PSW.30208.6
        [WARNING]   Infected files in archives cannot be repaired!
      --> 111\kvsc3.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Contains suspicious code HEUR/Malware
              [WARNING]   Infected files in archives cannot be repaired!
      --> 111\lymangr.dll
        [1] Archive type: Runtime Packed
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.Online.agb.2
            [WARNING]   Infected files in archives cannot be repaired!
    --> 111\msacpe.sys
        [DETECTION] Is the Trojan horse TR/Rootkit.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 111\msprint32d.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mjk.5
        [WARNING]   Infected files in archives cannot be repaired!
    --> 111\ntfs.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> 111\phy.sys
        [DETECTION] Is the Trojan horse TR/Dldr.Apher.X
        [WARNING]   Infected files in archives cannot be repaired!
    --> 111\ssldyn.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.lgk.1
        [WARNING]   Infected files in archives cannot be repaired!
      --> 111\ssldyn.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Contains suspicious code HEUR/Malware
              [WARNING]   Infected files in archives cannot be repaired!
      --> 111\swrcgac.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/WuDisable.B
              [WARNING]   Infected files in archives cannot be repaired!
    --> 111\swrcgzc.dll
        [DETECTION] Is the Trojan horse TR/WuDisable.B
        [WARNING]   Infected files in archives cannot be repaired!
      --> 111\userinit.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Contains suspicious code HEUR/Malware
              [WARNING]   Infected files in archives cannot be repaired!
      --> 111\utgnehz.dll
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
          --> Object
              [DETECTION] Is the Trojan horse TR/Rootkit.Gen
              [WARNING]   Infected files in archives cannot be repaired!
    --> 111\wn_sys8x.sys
        [DETECTION] Is the Trojan horse TR/PSW.Steal.48254
        [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!


End of the scan: 2008年1月13日  09:44
Used time: 00:04 min

The scan has been done completely.

      0 Scanning directories
     22 Files were scanned
     16 viruses and/or unwanted programs were found
      5 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      6 Files not concerned
      9 Archives were scanned
     21 Warnings
      0 Notes
回复

举报

dericyeoh
发表于 2008-1-14 03:32:37 | 显示全部楼层
信息        2008-01-14  03:34:19        您此次查毒清除了16个病毒                       
信息        2008-01-14  03:34:19        您此次查毒共查出16个病毒以及危险代码                       
信息        2008-01-14  03:34:19        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件27个                       
信息        2008-01-14  03:34:19        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
病毒        2008-01-14  03:34:19        C:\Users\Deric Yeoh\Desktop\111.rar\111\utgnehz.dll        Win32.Troj.OnlineGamesT.xy.118784        清除成功       
病毒        2008-01-14  03:34:19        C:\Users\Deric Yeoh\Desktop\111.rar\111\swrcgzc.dll        Win32.Troj.OnlineGamesT.yy.26978        清除成功       
病毒        2008-01-14  03:34:19        C:\Users\Deric Yeoh\Desktop\111.rar\111\swrcgac.exe        Win32.Troj.AgentT.fm.14452        清除成功       
病毒        2008-01-14  03:34:19        C:\Users\Deric Yeoh\Desktop\111.rar\111\ssldyn.exe        Win32.Troj.OnLineGamesT.gr.2637        清除成功       
病毒        2008-01-14  03:34:19        C:\Users\Deric Yeoh\Desktop\111.rar\111\ssldyn.dll        Win32.Troj.OnlineGamesT.jx.29184        清除成功       
病毒        2008-01-14  03:34:18        C:\Users\Deric Yeoh\Desktop\111.rar\111\ntfs.dll        Win32.Troj.Small.dg.28734        清除成功       
病毒        2008-01-14  03:34:18        C:\Users\Deric Yeoh\Desktop\111.rar\111\msprint32d.dll        Win32.PSWTroj.OnLineGames.26112        清除成功       
病毒        2008-01-14  03:34:17        C:\Users\Deric Yeoh\Desktop\111.rar\111\kvsc3.exe        Win32.Troj.OnlineGames.aw.139264        清除成功       
病毒        2008-01-14  03:34:17        C:\Users\Deric Yeoh\Desktop\111.rar\111\kvsc3.dll        Win32.Troj.OnlineGames.kr.30208        清除成功       
病毒        2008-01-14  03:34:17        C:\Users\Deric Yeoh\Desktop\111.rar\111\hookhelp.dll        Win32.PSWTroj.GamesOnline.cw.16904        清除成功       
病毒        2008-01-14  03:34:17        C:\Users\Deric Yeoh\Desktop\111.rar\111\cmdbcs.exe        Win32.Troj.OnlineGames.dr.139264        清除成功       
病毒        2008-01-14  03:34:17        C:\Users\Deric Yeoh\Desktop\111.rar\111\cmdbcs.dll        Win32.Troj.ONlineGames.iy.27648        清除成功       
病毒        2008-01-14  03:34:17        C:\Users\Deric Yeoh\Desktop\111.rar\111\853957wo.dll        Win32.Troj.OnlineGamesT.xy.49958        清除成功       
病毒        2008-01-14  03:34:17        C:\Users\Deric Yeoh\Desktop\111.rar\111\853957w.exe        Win32.Troj.LmirT.by.9900        清除成功       
病毒        2008-01-14  03:34:17        C:\Users\Deric Yeoh\Desktop\111.rar\111\853957mm.dll        Win32.Troj.MirT.md.48433        清除成功       
病毒        2008-01-14  03:34:17        C:\Users\Deric Yeoh\Desktop\111.rar\111\853957m.exe        Win32.Troj.LmirT.by.9900        清除成功
回复

举报

jeffgree
头像被屏蔽
发表于 2008-1-14 04:37:13 | 显示全部楼层
我的红伞扫出20个
回复

举报

鱼是一只我
发表于 2008-1-14 07:54:08 | 显示全部楼层
kv2008,杀出17个
回复

举报

下一页 »
12下一页
返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2025-7-13 04:20 , Processed in 0.147258 second(s), 18 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究，不得将上述内容用于商业或者其他非法用途，否则产生的一切后果自负，本站信息来自网络，版权争议问题与本站无关，您必须在下载后的24小时之内从您的电脑中彻底删除上述信息，如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表