剑盟看到的一个下载者

zzh161

样本：

链接地址：hxxp://the.microgood.net/ad.txt

[oo]
e0=http://60.190.118.112/soft00.exe
e1=http://60.190.118.112/soft01.exe
e2=http://60.190.118.112/soft02.exe
e3=http://60.190.118.112/soft03.exe
e4=http://60.190.118.112/soft04.exe
e5=http://60.190.118.112/soft05.exe
e6=http://60.190.118.112/soft06.exe
e7=http://60.190.118.112/soft07.exe
e8=http://60.190.118.112/soft08.exe
e9=http://60.190.118.112/soft09.exe
e10=http://60.190.118.112/soft10.exe
e11=http://60.190.118.112/soft11.exe
e12=http://60.190.118.112/soft12.exe
e13=http://60.190.118.112/soft13.exe
e14=http://60.190.118.112/soft14.exe
e15=http://60.190.118.112/soft15.exe
e16=http://60.190.118.112/soft16.exe
e17=http://60.190.118.112/soft17.exe
e18=http://60.190.118.112/soft18.exe
e19=http://60.190.118.112/soft19.exe

下载样本：

红心王子

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.GamesOnline.iy
病毒： Trojan.PSW.Win32.Agent.vrw
病毒： Trojan.PSW.Win32.QQHX.tvu
病毒： Trojan.PSW.Win32.GameOL.lms
病毒： Trojan.PSW.Win32.GameOL.lmr
病毒： Trojan.PSW.Win32.GameOL.llb
病毒： Trojan.PSW.Win32.GameOL.lje
病毒： Trojan.PSW.Win32.GamesOnline.ky
病毒： Trojan.PSW.Win32.GameOnline.zzy
病毒： Trojan.Win32.Wisin.b     
病毒： Trojan.PSW.Win32.GameOL.lmi
病毒： Trojan.PSW.Win32.GameOL.lpk
病毒： Trojan.PSW.Win32.SunOnline.lx

MAC 地址：00:1E:4F:91:F4:F0

用户来源：局域网

IllusionWing

咱压缩包到我这儿就是坏的？

[ 本帖最后由 gankeyu 于 2008-1-28 15:49 编辑 ]

jimmyleo

D:\Download\S\soft01.exe        infected: Trojan.PWS.OnLineGames.NSR
D:\Download\S\soft02.exe        infected: Trojan.PWS.Onlinegames.NYS
D:\Download\S\ntuser.com        infected: Trojan.Downloader.Small.AAKF
D:\Download\S\soft04.exe        infected: Trojan.PWS.OnlineGames.NZG
D:\Download\S\soft05.exe        infected: Dropped:Generic.Malware.gPWS.70BE6218
D:\Download\S\soft06.exe        infected: Trojan.PWS.OnLineGames.NSR
D:\Download\S\soft07.exe        suspected: Trojan.PWS.OnlineGames.NZG
D:\Download\S\soft08.exe        infected: Trojan.PWS.OnLineGames.NSR
D:\Download\S\soft09.exe        infected: Trojan.PWS.OnLineGames.NSR
D:\Download\S\soft10.exe        infected: Generic.PWS.Games.2.29DEC3F5
D:\Download\S\soft11.exe        infected: Trojan.PWS.OnlineGames.NZG
D:\Download\S\soft13.exe        infected: Trojan.PWS.Lmir.AII
D:\Download\S\soft14.exe        infected: Trojan.PWS.OnLineGames.NSR
D:\Download\S\soft15.exe        infected: Trojan.PWS.OnlineGames.NZG
D:\Download\S\soft16.exe        infected: Trojan.PWS.OnLineGames.NSR
D:\Download\S\soft17.exe        infected: Trojan.PWS.Onlinegames.NTA
D:\Download\S\soft19.exe        infected: Generic.PWStealer.E73D37A9

bd=16+1

wangjay1980

18

deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ode        File: C:\Documents and Settings\Owner\×ÀÃæ\ntuser.rar/ntuser.com//NSPack
detected: virus Heur.Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\soft01.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.otj        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\soft02.exe//PE_Patch//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.poc        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\soft03.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.pbp        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\soft04.exe//PE_Patch//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.pgc        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\soft05.exe//UPack
deleted: Trojan program Trojan.Win32.Vaklik.fb        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\soft06.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ozk        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\soft07.exe//PE_Patch//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.oly        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\soft08.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.poz        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\soft09.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.jnb        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\soft10.exe//UPX
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.pbp        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\soft11.exe//PE_Patch//UPack
detected: Trojan program Rootkit.Win32.Agent.wg        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\soft13.exe//NSPack//#
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ozu        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\soft14.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.pbp        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\soft15.exe//PE_Patch//UPack
deleted: Trojan program Trojan.Win32.Vaklik.gg        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\soft16.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.pen        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\soft17.exe//UPack
detected: Trojan program Trojan-PSW.Win32.QQPass.ass        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\soft19.exe//#

tonylee

Avast:

* VPS: 080127-1, 2008-01-27

soft01.exe\[Upack]\[Embedded#4060] [L] Win32:OnLineGames-BTY [Trj] (0)
soft02.exe\[Upack]\[Embedded#6060]\[Upack]\[Embedded#0a090] [L] Win32:OnLineGames-BYO [Trj] (0)
soft04.exe\[Upack]\[Embedded#6060]\[Upack] [L] Win32:OnLineGames-BSC [Trj] (0)
soft06.exe\[Upack]\[Embedded#4060] [L] Win32:OnLineGames-BUK [Trj] (0)
soft07.exe\[Upack]\[Embedded#5060]\[Upack]\[Embedded#08090] [L] Win32:OnLineGames-BYO [Trj] (0)
soft08.exe\[Upack]\[Embedded#4060] [L] Win32:OnLineGames-BYS [Trj] (0)
soft10.exe\[UPX]\[Embedded#1470] [L] Win32:OnLineGames-BEY [Trj] (0)
soft13.exe [L] Win32:Crypt-VA (0)
soft14.exe\[Upack]\[Embedded#4060] [L] Win32:Agent-CNF [Trj] (0)
soft15.exe\[Upack]\[Embedded#6060]\[Upack] [L] Win32:OnLineGames-BSI [Trj] (0)
soft17.exe\[Upack]\[Embedded#4060] [L] Win32:OnLineGames-BUK [Trj] (0)
soft19.exe\[UPX]\[Embedded#50f8] [L] Win32:OnLineGames-BSI [Trj] (0)
Infected files: 12
Total files: 73
Total folders: 2
Total size: 2.1 MB

Nod32:

Scanning Log
NOD32 version 2826 (20080127) NT
ntuser.ex - Win32/TrojanDownloader.Small.NZL trojan
soft01.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
soft02.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
soft03.exe - probably unknown NewHeur_PE virus [7]
soft04.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
soft05.exe - probably unknown NewHeur_PE virus [7]
soft06.exe - a variant of Win32/PSW.OnLineGames.YA trojan
soft07.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
soft08.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
soft09.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
soft10.exe - a variant of Win32/PSW.OnLineGames.NFN trojan
soft11.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
soft13.exe - probably unknown NewHeur_PE virus [7]
soft14.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
soft15.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
soft16.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
soft17.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
soft19.exe - probably a variant of Win32/Genetik trojan
Number of scanned files: 18
Number of threats found: 18
Time of completion: 15:44:48 Total scanning time: 4 sec (00:00:04)
Notes:
[7] File is probably infected with an unknown virus.

Dr.Web

Engine version: 4.44.0.09170
Engine API version: 2.02
Total virus records: 295991
ntuser.ex infected with Trojan.DownLoader.43172
soft01.exe infected with Trojan.PWS.Wsgame.origin
soft02.exe infected with Trojan.PWS.Wsgame.3015
soft03.exe probably infected with BACKDOOR.Trojan
soft04.exe infected with Trojan.PWS.Wsgame.3104
soft05.exe probably infected with BACKDOOR.Trojan
soft06.exe infected with Trojan.PWS.Wsgame.3141
soft07.exe infected with Trojan.PWS.Wsgame.3013
soft08.exe infected with Trojan.PWS.Wsgame.2970
soft09.exe infected with Trojan.PWS.Wsgame.origin
soft10.exe infected with Trojan.DownLoader.origin
soft11.exe infected with Trojan.PWS.Wsgame.3104
soft13.exe infected with Trojan.DownLoader.origin
soft14.exe infected with Trojan.PWS.Wsgame.3144
soft15.exe infected with Trojan.PWS.Wsgame.3104
soft16.exe infected with Trojan.PWS.Wsgame.origin
soft17.exe infected with Trojan.PWS.Wsgame.3148
soft19.exe infected with Trojan.MulDrop.origin
        Scanned: 18                  Cured: 0
Infected found: 16                Deleted: 0
  Modifications: 0                 Renamed: 0
     Suspicious: 2                   Moved: 0
         Adware: 0                 Ignored: 0
        Dialers: 0         
          Jokes: 0               Scan time: 0:00:01
       Riskware: 0              Scan speed: 335 Kb/s
      Hacktools: 0              Scan ended: 15:50:44

[ 本帖最后由 tonylee 于 2008-1-28 15:53 编辑 ]

leonfg

ESET  全杀
C:\Documents and Settings\GUNDAM\桌面\ntuser.rar » RAR » ntuser.com - Win32/TrojanDownloader.Small.NZL trojan
***********************************************
17
C:\Documents and Settings\GUNDAM\桌面\11.rar » RAR » 11\soft01.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\GUNDAM\桌面\11.rar » RAR » 11\soft02.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\GUNDAM\桌面\11.rar » RAR » 11\soft03.exe - probably unknown NewHeur_PE virus
C:\Documents and Settings\GUNDAM\桌面\11.rar » RAR » 11\soft04.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\GUNDAM\桌面\11.rar » RAR » 11\soft05.exe - probably unknown NewHeur_PE virus
C:\Documents and Settings\GUNDAM\桌面\11.rar » RAR » 11\soft06.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\GUNDAM\桌面\11.rar » RAR » 11\soft07.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\GUNDAM\桌面\11.rar » RAR » 11\soft08.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\GUNDAM\桌面\11.rar » RAR » 11\soft09.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\GUNDAM\桌面\11.rar » RAR » 11\soft10.exe - a variant of Win32/PSW.OnLineGames.NFN trojan
C:\Documents and Settings\GUNDAM\桌面\11.rar » RAR » 11\soft11.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\GUNDAM\桌面\11.rar » RAR » 11\soft13.exe - probably unknown NewHeur_PE virus
C:\Documents and Settings\GUNDAM\桌面\11.rar » RAR » 11\soft14.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\GUNDAM\桌面\11.rar » RAR » 11\soft15.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\GUNDAM\桌面\11.rar » RAR » 11\soft16.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\GUNDAM\桌面\11.rar » RAR » 11\soft17.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\GUNDAM\桌面\11.rar » RAR » 11\soft19.exe - probably a variant of Win32/Genetik trojan

yitp

红伞

gho

soft01.exe和soft19.exe没有报

capsshift

红伞
Start of the scan: 2008年1月28日  16:38

Starting the file scan:

Begin scan in 'D:\downloads\11.rar'
D:\downloads\11.rar
  [0] Archive type: RAR
  --> 11\soft01.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 11\soft02.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.oqs.1
  --> 11\soft03.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 11\soft04.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 11\soft05.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pgc
  --> 11\soft06.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.219
  --> 11\soft07.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.oxf.3
  --> 11\soft08.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.olz.3
  --> 11\soft09.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 11\soft10.exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.ddm.1
  --> 11\soft11.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pmi
  --> 11\soft13.exe
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
  --> 11\soft14.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ozu.5
  --> 11\soft15.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 11\soft16.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pmg
  --> 11\soft17.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.obo.2
  --> 11\soft19.exe
      [DETECTION] Is the Trojan horse TR/PSW.QQpass.ass
      [INFO]      A backup was created as '47cb94b1.qua'  ( QUARANTINE )
      [INFO]      The file was successfully wiped!
      [INFO]      The file was deleted!


End of the scan: 2008年1月28日  16:38
Used time: 00:07 min

The scan has been done completely.

      0 Scanning directories
     18 Files were scanned
     16 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes