昨天发给eset的样本

显示全部楼层 · 发表于 2008-1-29 10:02:38

费尔6个全报

显示全部楼层 · 发表于 2008-1-29 10:05:36

AVAST 5个
大蜘蛛 4个

显示全部楼层 · 发表于 2008-1-29 10:15:12

D:\download\RemoteAbc.zip>>RemoteAbc\1\gdisvc.exe TrojanClicker.VB.zk.okso 木马还未处理
D:\download\RemoteAbc.zip>>RemoteAbc\1\IOLVNN.DLL Backdoor.Agent.asjj.kmkl.dll 后门还未处理
D:\download\RemoteAbc.zip>>RemoteAbc\1\ruixing.exe Packed.Klone.af.liub 可疑程序还未处理
D:\download\RemoteAbc.zip>>RemoteAbc\1\sxs\sxs.exe Backdoor.BlackHole.j.pmzg 后门还未处理
D:\download\RemoteAbc.zip>>RemoteAbc\1\top.exe TrojanDownloader.Mnless.tk.nxww 木马还未处理
D:\download\RemoteAbc.zip>>RemoteAbc\RemoteAbc\RemoteAbc.exe Backdoor.Agent.yrh.hoek 后门还未处理

显示全部楼层 · 发表于 2008-1-29 10:18:54

恶意程序名称:Packed.Win32.Klone.agt
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\REMOTEABC\REMOTEABC\1\RUIXING.EXE
是恶意程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Backdoor.Win32.BlackHole.hn
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\REMOTEABC\REMOTEABC\1\SXS\SXS.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-Downloader.Win32.Delf.ijr
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\REMOTEABC\REMOTEABC\REMOTEABC\REMOTEABC.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\REMOTEABC\REMOTEABC\1\TOP.EXE
蠕虫程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\HONEY\HONEYMAIN.EXE
是否删除蠕虫程序及其衍生物?

显示全部楼层 · 发表于 2008-1-29 10:22:40

Backdoor.Win32.PcClient.bmw
RUIXING.EXE恶意程序名称:Packed.Win32.Klone.agt
Backdoor.Win32.BlackHole.hn

显示全部楼层 · 发表于 2008-1-29 11:16:49

Scanning Report
29 January 2008 11:16:34 - 11:16:34
Computer name: PUMA-PC
Scanning type: Scan target
Target: C:\Users\Administrator\Desktop\RemoteAbc.zip

--------------------------------------------------------------------------------

Result: 6 malware found
Trojan-Clicker.Win32.VB.zk (virus)
C:\Users\Administrator\Desktop\RemoteAbc.zip\RemoteAbc\1\gdisvc.exe
Backdoor.Win32.PcClient.awe (virus)
C:\Users\Administrator\Desktop\RemoteAbc.zip\RemoteAbc\1\IOLVNN.DLL
Packed.Win32.Klone.af (virus)
C:\Users\Administrator\Desktop\RemoteAbc.zip\RemoteAbc\1\ruixing.exe
Backdoor.Win32.BlackHole.j (virus)
C:\Users\Administrator\Desktop\RemoteAbc.zip\RemoteAbc\1\sxs\sxs.exe
Trojan-Downloader.Win32.Agent.hra (virus)
C:\Users\Administrator\Desktop\RemoteAbc.zip\RemoteAbc\1\top.exe
Trojan-Downloader.Win32.Delf.dnr (virus)
C:\Users\Administrator\Desktop\RemoteAbc.zip\RemoteAbc\RemoteAbc\RemoteAbc.exe

--------------------------------------------------------------------------------

Statistics
Scanned:
Files: 7
Not scanned: 0
Result:
Viruses: 6
Spyware: 0
Suspicious items: 0
Riskware: 0
Actions:
Disinfected: 0
Renamed: 0
Deleted: 0
Quarantined: 0
Failed: 0
Boot Sectors:
Scanned: 0
Infected: 0
Suspicious items: 0
Disinfected: 0

--------------------------------------------------------------------------------

Options
Definitions version:
Viruses: 2008-01-28_08
Spyware: 2008-01-28_08
Scanning Engines:
F-Secure AVP: 7.00.171, 2008-01-28
F-Secure Libra: 2.04.01, 2008-01-28
F-Secure Orion: 1.02.37, 2008-01-28
F-Secure Draco: 1.00.35, 2008-01-14
Scanning options:
Scan all files
Scan inside archives
Actions:
Viruses: Delete infected files
Spyware: Delete infected files

显示全部楼层 · 发表于 2008-1-29 11:18:02

对象: RemoteAbc/1 gdisvc.exe
在压缩档案里: D:\Documents\桌面\RemoteAbc.zip
状态: 已发现病毒
病毒: Trojan-Clicker.Win32.VB.zk (KAV 引擎)
对象: RemoteAbc/1 IOLVNN.DLL
在压缩档案里: D:\Documents\桌面\RemoteAbc.zip
状态: 已发现病毒
病毒: Backdoor.Win32.PcClient.awe (KAV 引擎)
对象: RemoteAbc/1 ruixing.exe
在压缩档案里: D:\Documents\桌面\RemoteAbc.zip
状态: 已发现病毒
病毒: Packed.Win32.Klone.af (KAV 引擎)
对象: RemoteAbc/1/sxs sxs.exe
在压缩档案里: D:\Documents\桌面\RemoteAbc.zip
状态: 已发现病毒
病毒: Backdoor.Win32.BlackHole.j (KAV 引擎)
对象: RemoteAbc/1 top.exe
在压缩档案里: D:\Documents\桌面\RemoteAbc.zip
状态: 已发现病毒
病毒: Trojan-Downloader.Win32.Agent.hra (KAV 引擎)
对象: RemoteAbc/RemoteAbc RemoteAbc.exe
在压缩档案里: D:\Documents\桌面\RemoteAbc.zip
状态: 已发现病毒
病毒: Trojan-Downloader.Win32.Delf.dnr (KAV 引擎)
对象: RemoteAbc.zip
路径: D:\Documents\桌面
状态: 已发现病毒
病毒: Trojan-Clicker.Win32.VB.zk, Backdoor.Win32.PcClient.awe, Packed.Win32.Klone.af, Backdoor.Win32.BlackHole.j, Trojan-Downloader.Win32.Agent.hra, Trojan-Downloader.Win32.Delf.dnr (KAV 引擎)
分析完成: 2008-1-29 11:17
已扫描 1 个文件
已发现 1 个染毒文件
发现 0 个可疑文件

显示全部楼层 · 发表于 2008-1-29 11:49:08

2008-1-29 11:47:39 Deleted WHUT-D9193C067E\gho WinRAR.exe C:\Documents and Settings\gho\桌面\RemoteAbc\1\ruixing.exe BackDoor-AWQ (Trojan)
2008-1-29 11:47:40 Deleted WHUT-D9193C067E\gho WinRAR.exe C:\Documents and Settings\gho\桌面\RemoteAbc\1\sxs\sxs.exe Generic.dx (Trojan)

显示全部楼层 · 发表于 2008-1-29 13:44:01

2008-1-29 13:44:04 Real-time file system protection file G:\v\RemoteAbc\RemoteAbc\RemoteAbc.exe probably a variant of Win32/TrojanDownloader.Delf trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-1-29 13:44:03 Real-time file system protection file G:\v\RemoteAbc\1\top.exe Win32/TrojanClicker.Agent.NCP trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-1-29 13:44:02 Real-time file system protection file G:\v\RemoteAbc\1\sxs\sxs.exe Win32/BlackHole.J trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-1-29 13:44:00 Real-time file system protection file G:\v\RemoteAbc\1\ruixing.exe Win32/Hupigon trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-1-29 13:43:59 Real-time file system protection file G:\v\RemoteAbc\1\IOLVNN.DLL Win32/PcClient trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-1-29 13:43:58 Real-time file system protection file G:\v\RemoteAbc\1\gdisvc.exe Win32/TrojanClicker.VB.ZK trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.

显示全部楼层 · 发表于 2008-1-29 14:19:25

微点都全部已知了···

[病毒样本] 昨天发给eset的样本

本帖子中包含更多资源