饭后甜品21个

冷冷

[oo]
t0=20080201
e0=hxxp://1.111281.com/1.exe
t1=20080201
e1=hxxp://1.111281.com/2.exe
t2=20080201
e2=hxxp://1.111281.com/3.exe
t3=20080201
e3=hxxp://1.111281.com/4.exe
t4=20080201
e4=hxxp://1.111281.com/5.exe
t5=20080201
e5=hxxp://1.111281.com/6.exe
t6=20080201
e6=hxxp://1.111281.com/7.exe
t7=20080201
e7=hxxp://1.111281.com/8.exe
t8=20080201
e8=hxxp://1.111281.com/9.exe
t9=20080201
e9=hxxp://1.111281.com/10.exe
t10=20080201
e10=hxxp://1.111281.com/11.exe
t11=20080201
e11=hxxp://1.111281.com/12.exe
t12=20080201
e12=hxxp://1.111281.com/13.exe
t13=20080201
e13=hxxp://1.111281.com/14.exe
t14=20080201
e14=hxxp://1.111281.com/15.exe
t15=20080201
e15=hxxp://1.111281.com/16.exe
t16=20080201
e16=hxxp://1.111281.com/17.exe
t17=20080201
e17=hxxp://1.111281.com/18.exe
t18=20080201
e18=hxxp://1.111281.com/19.exe
t19=20080201
e19=hxxp://1.111281.com/20.exe
t20=20080201

[MD5: A31B73 E096EA 0950B3 D5952C 6A6FE1 752CE2 783E11 67E8EB 5ED6A3 F1263F 1CCA7D BA6FA8 65AC83 9B2ECE 35A7F6 176C42 E8C361 880DA7 B6AD33 CA33DA 49B1ED]

FBAV

MicroVita AntiSpyware  
_____________________________________________
                                          
             风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]                  
                   http://221.10.254.214/
----------------------------------------------
开始扫描……

正在检查启动……
[C:\Documents and Settings\Administrator\桌面\Virus\SAMPLE-24\1.exe]
                    …………发现Spy！报告:[2] [1] Win32.F/S.ByDwing
文件信息:  大小:17820  MD5:a31b73157d4c8b1966673f5e7b1c7bc4

[C:\Documents and Settings\Administrator\桌面\Virus\SAMPLE-24\10.exe]
                    …………发现Spy！报告:[2] [1] Win32.F/S.ByDwing
文件信息:  大小:17812  MD5:e096ea6339f9a3a597ed86ca93052cc1

[C:\Documents and Settings\Administrator\桌面\Virus\SAMPLE-24\11.exe]
                    …………发现Spy！报告:[2] [1] Win32.F/S.ByDwing[5] 下载者
文件信息:  大小:18506  MD5:0950b3c984834095e50fd9741596ba09

[C:\Documents and Settings\Administrator\桌面\Virus\SAMPLE-24\12.exe]
                    …………发现Spy！报告:[2] [1] Win32.F/S.ByDwing
文件信息:  大小:19605  MD5:d5952cab80a1d19737241871d6badf26

[C:\Documents and Settings\Administrator\桌面\Virus\SAMPLE-24\13.exe]
                    …………发现Spy！报告:[2] [1] Win32.F/S.ByDwing
文件信息:  大小:17852  MD5:6a6fe1797f0183557bf602ba93c04ff1

[C:\Documents and Settings\Administrator\桌面\Virus\SAMPLE-24\14.exe]
                    …………发现Spy！报告:[2] [1] Win32.Unknow
文件信息:  大小:17300  MD5:752ce2e83104d8eed0dc4e38d29b3696

[C:\Documents and Settings\Administrator\桌面\Virus\SAMPLE-24\15.exe]
                    …………发现Spy！报告:[2] [1] Win32.F/S.ByDwing
文件信息:  大小:19299  MD5:783e116e590e1111586b78cd10004317

[C:\Documents and Settings\Administrator\桌面\Virus\SAMPLE-24\16.exe]
                    …………发现Spy！报告:[2] [1] Win32.F/S.ByDwing
文件信息:  大小:18016  MD5:67e8ebc266a449d140ae2a16d51263e2

[C:\Documents and Settings\Administrator\桌面\Virus\SAMPLE-24\17.exe]
                    …………发现Spy！报告:[2] [1] Win32.F/S.ByDwing
文件信息:  大小:31744  MD5:5ed6a3c7e4e807382d106b0d3c2584a4

[C:\Documents and Settings\Administrator\桌面\Virus\SAMPLE-24\18.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:18240  MD5:f1263f476ac2fa03aa49d176ff35f6a9

[C:\Documents and Settings\Administrator\桌面\Virus\SAMPLE-24\19.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:22664  MD5:1cca7d145966f81fd975e02a67725a09

[C:\Documents and Settings\Administrator\桌面\Virus\SAMPLE-24\2.exe]
                    …………发现Spy！报告:[2] [1] Win32.F/S.ByDwing
文件信息:  大小:10161  MD5:ba6fa8b44e7efa8337b91576f77cce1e

[C:\Documents and Settings\Administrator\桌面\Virus\SAMPLE-24\20.exe]
                    …………发现Spy！报告:[2] [1] Win32.F/S.ByDwing
文件信息:  大小:18623  MD5:65ac8311ef6028b0e59403274193c400

[C:\Documents and Settings\Administrator\桌面\Virus\SAMPLE-24\21.exe]
                    …………发现Spy！报告:[1] Win32.NkHack.FSG.A
文件信息:  大小:31245  MD5:9b2ecee2763a8c8487698b4ef810238d

[C:\Documents and Settings\Administrator\桌面\Virus\SAMPLE-24\3.exe]
                    …………发现Spy！报告:[2] [1] Win32.F/S.ByDwing
文件信息:  大小:9736  MD5:35a7f60fa45f539e9ca685c2424b1051

[C:\Documents and Settings\Administrator\桌面\Virus\SAMPLE-24\4.exe]
                    …………发现Spy！报告:[2] [1] Win32.F/S.ByDwing
文件信息:  大小:34304  MD5:176c4286e9ecf5c8f29b550edf805551

[C:\Documents and Settings\Administrator\桌面\Virus\SAMPLE-24\5.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:18780  MD5:e8c3618c5f6b59c9d886f649bcf29f36

[C:\Documents and Settings\Administrator\桌面\Virus\SAMPLE-24\6.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:18856  MD5:880da77cd5ad4fe37cea70a7e96cba18

[C:\Documents and Settings\Administrator\桌面\Virus\SAMPLE-24\7.exe]
                    …………发现Spy！报告:[2] [1] Win32.F/S.ByDwing
文件信息:  大小:23104  MD5:b6ad334fb2a86ad001d5436392c9e38f

[C:\Documents and Settings\Administrator\桌面\Virus\SAMPLE-24\8.exe]
                    …………发现Spy！报告:[2] [1] Win32.F/S.ByDwing
文件信息:  大小:18684  MD5:ca33dabb2e4d37959095585e2e17624c

[C:\Documents and Settings\Administrator\桌面\Virus\SAMPLE-24\9.exe]
                    …………发现Spy！报告:[2]
文件信息:  大小:34428  MD5:49b1ed2592265e3da2e8adbb9b95ec88

文件数:21   病毒数:21  比重:1
OK  扫描完毕！
  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎   
[2] 文件特征码引擎
[1] 文件启发式引擎

[ 本帖最后由 FBAV 于 2008-2-1 18:50 编辑 ]

Graybird

Starting the file scan:

Begin scan in 'E:\SAMPLE-24.rar'
E:\SAMPLE-24.rar
  [0] Archive type: RAR
  --> 1.exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.aav.1
  --> 10.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.prw.5
  --> 11.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pne
  --> 12.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.oiv.2
  --> 13.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pmi.30
  --> 14.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.oku.8
  --> 15.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.286
  --> 16.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pmi.33
  --> 17.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 18.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.261
  --> 19.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 2.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pgp.2
  --> 20.exe
      [DETECTION] Is the Trojan horse TR/PSW.Nilage.bxx.3
  --> 21.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 3.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pim
  --> 4.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 5.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 6.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pmi.27
  --> 7.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.prw.12
  --> 8.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.prw.3
  --> 9.exe
      [DETECTION] Contains detection pattern of the worm WORM/Autorun.FF.27
      [INFO]      The file was deleted!


End of the scan: 2008年2月1日  18:50
Used time: 00:28 min

The scan has been done completely.

      0 Scanning directories
     22 Files were scanned
     21 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

leonfg

ESET   21全
C:\Documents and Settings\GUNDAM\桌面\SAMPLE-24.rar » RAR » 1.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\GUNDAM\桌面\SAMPLE-24.rar » RAR » 10.exe - Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\GUNDAM\桌面\SAMPLE-24.rar » RAR » 11.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\GUNDAM\桌面\SAMPLE-24.rar » RAR » 12.exe - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\GUNDAM\桌面\SAMPLE-24.rar » RAR » 13.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\GUNDAM\桌面\SAMPLE-24.rar » RAR » 14.exe - Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\GUNDAM\桌面\SAMPLE-24.rar » RAR » 15.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\GUNDAM\桌面\SAMPLE-24.rar » RAR » 16.exe - Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\GUNDAM\桌面\SAMPLE-24.rar » RAR » 17.exe - a variant of Win32/PSW.OnLineGames.GJV trojan
C:\Documents and Settings\GUNDAM\桌面\SAMPLE-24.rar » RAR » 18.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\GUNDAM\桌面\SAMPLE-24.rar » RAR » 19.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\GUNDAM\桌面\SAMPLE-24.rar » RAR » 2.exe - a variant of Win32/PSW.OnLineGames.NLY trojan
C:\Documents and Settings\GUNDAM\桌面\SAMPLE-24.rar » RAR » 20.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\GUNDAM\桌面\SAMPLE-24.rar » RAR » 21.exe - a variant of Win32/PSW.OnLineGames.GJV trojan
C:\Documents and Settings\GUNDAM\桌面\SAMPLE-24.rar » RAR » 3.exe - a variant of Win32/PSW.OnLineGames.NLY trojan
C:\Documents and Settings\GUNDAM\桌面\SAMPLE-24.rar » RAR » 4.exe - a variant of Win32/PSW.OnLineGames.GJV trojan
C:\Documents and Settings\GUNDAM\桌面\SAMPLE-24.rar » RAR » 5.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\GUNDAM\桌面\SAMPLE-24.rar » RAR » 6.exe - Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\GUNDAM\桌面\SAMPLE-24.rar » RAR » 7.exe - Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\GUNDAM\桌面\SAMPLE-24.rar » RAR » 8.exe - Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\GUNDAM\桌面\SAMPLE-24.rar » RAR » 9.exe - probably a variant of Win32/AutoRun.Q worm

gho

扫描报告
2008年2月1日 18:49:59 - 18:50:02
计算机名称: CN-89FF4B9EA4D6
扫描类型: 扫描目标
目标: I:\hanxiaojun\SAMPLE-24.rar


--------------------------------------------------------------------------------

结果: 找到 20 恶意软件
Trojan.Win32.Vaklik.fe (病毒)
I:\hanxiaojun\SAMPLE-24.rar\1.exe
Trojan-PSW.Win32.OnLineGames.pry (病毒)
I:\hanxiaojun\SAMPLE-24.rar\10.exe
I:\hanxiaojun\SAMPLE-24.rar\7.exe
I:\hanxiaojun\SAMPLE-24.rar\8.exe
Trojan-PSW.Win32.OnLineGames.pnd (病毒)
I:\hanxiaojun\SAMPLE-24.rar\11.exe
Trojan-PSW.Win32.OnLineGames.okn (病毒)
I:\hanxiaojun\SAMPLE-24.rar\12.exe
Trojan-PSW.Win32.OnLineGames.pbp (病毒)
I:\hanxiaojun\SAMPLE-24.rar\13.exe
I:\hanxiaojun\SAMPLE-24.rar\16.exe
Trojan-PSW.Win32.OnLineGames.olj (病毒)
I:\hanxiaojun\SAMPLE-24.rar\14.exe
Trojan.Win32.Vaklik.gx (病毒)
I:\hanxiaojun\SAMPLE-24.rar\15.exe
Trojan-PSW.Win32.OnLineGames.pvq (病毒)
I:\hanxiaojun\SAMPLE-24.rar\18.exe
Trojan-PSW.Win32.OnLineGames.pzl (病毒)
I:\hanxiaojun\SAMPLE-24.rar\19.exe
I:\hanxiaojun\SAMPLE-24.rar\5.exe
Trojan-PSW.Win32.OnLineGames.pgp (病毒)
I:\hanxiaojun\SAMPLE-24.rar\2.exe
Trojan-PSW.Win32.Nilage.bxx (病毒)
I:\hanxiaojun\SAMPLE-24.rar\20.exe
Trojan.Win32.Pakes.bzp (病毒)
I:\hanxiaojun\SAMPLE-24.rar\21.exe
Trojan-PSW.Win32.OnLineGames.pil (病毒)
I:\hanxiaojun\SAMPLE-24.rar\3.exe
Trojan-PSW.Win32.Nilage.bya (病毒)
I:\hanxiaojun\SAMPLE-24.rar\4.exe
Trojan-PSW.Win32.OnLineGames.pvn (病毒)
I:\hanxiaojun\SAMPLE-24.rar\6.exe
Trojan-PSW.Win32.QQPass.ati (病毒)
I:\hanxiaojun\SAMPLE-24.rar\9.exe

spaceplane

大蜘蛛 16
AVAST 12

醉一生爱妍

费尔KILLA LL

IllusionWing

当然全K了

su-tt

Begin scan in 'C:\Documents and Settings\Administrator\桌面\SAMPLE-24.rar'
C:\Documents and Settings\Administrator\桌面\SAMPLE-24.rar
  [0] Archive type: RAR
  --> 1.exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.aav.1
  --> 10.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.prw.5
  --> 11.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pne
  --> 12.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.oiv.2
  --> 13.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pmi.30
  --> 14.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.oku.8
  --> 15.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.286
  --> 16.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pmi.33
  --> 17.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 18.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.261
  --> 19.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 2.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pgp.2
  --> 20.exe
      [DETECTION] Is the Trojan horse TR/PSW.Nilage.bxx.3
  --> 21.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 3.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pim
  --> 4.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 5.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 6.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pmi.27
  --> 7.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.prw.12
  --> 8.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.prw.3
  --> 9.exe
      [DETECTION] Contains detection pattern of the worm WORM/Autorun.FF.27
      [INFO]      The file was deleted!


End of the scan: 2008年2月1日  19:31
Used time: 00:17 min

The scan has been done completely.

      0 Scanning directories
     22 Files were scanned
     21 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

Joker

卡巴都全灭了。。
deleted: Trojan program Trojan.Win32.Vaklik.fe        File: C:\Documents and Settings\Administrator\×ÀÃæ\SAMPLE-24.rar/1.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.pry        File: C:\Documents and Settings\Administrator\×ÀÃæ\SAMPLE-24.rar/10.exe//PE_Patch//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.pnd        File: C:\Documents and Settings\Administrator\×ÀÃæ\SAMPLE-24.rar/11.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.okn        File: C:\Documents and Settings\Administrator\×ÀÃæ\SAMPLE-24.rar/12.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.pbp        File: C:\Documents and Settings\Administrator\×ÀÃæ\SAMPLE-24.rar/13.exe//PE_Patch//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.olj        File: C:\Documents and Settings\Administrator\×ÀÃæ\SAMPLE-24.rar/14.exe//PE_Patch//UPack
detected: virus Heur.Trojan.Generic        File: C:\Documents and Settings\Administrator\×ÀÃæ\SAMPLE-24.rar/15.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.pbp        File: C:\Documents and Settings\Administrator\×ÀÃæ\SAMPLE-24.rar/16.exe//PE_Patch//UPack
deleted: Trojan program Trojan-PSW.Win32.Nilage.byp        File: C:\Documents and Settings\Administrator\×ÀÃæ\SAMPLE-24.rar/17.exe//PE_Patch.UPX//#//UPack//PE_Patch.MaskPE
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.pvq        File: C:\Documents and Settings\Administrator\×ÀÃæ\SAMPLE-24.rar/18.exe
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.pzl        File: C:\Documents and Settings\Administrator\×ÀÃæ\SAMPLE-24.rar/19.exe//PE_Patch//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.pgp        File: C:\Documents and Settings\Administrator\×ÀÃæ\SAMPLE-24.rar/2.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.Nilage.bxx        File: C:\Documents and Settings\Administrator\×ÀÃæ\SAMPLE-24.rar/20.exe//UPack
deleted: Trojan program Trojan.Win32.Pakes.bzp        File: C:\Documents and Settings\Administrator\×ÀÃæ\SAMPLE-24.rar/21.exe
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.pil        File: C:\Documents and Settings\Administrator\×ÀÃæ\SAMPLE-24.rar/3.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.Nilage.bya        File: C:\Documents and Settings\Administrator\×ÀÃæ\SAMPLE-24.rar/4.exe//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.pzl        File: C:\Documents and Settings\Administrator\×ÀÃæ\SAMPLE-24.rar/5.exe//PE_Patch//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.pvn        File: C:\Documents and Settings\Administrator\×ÀÃæ\SAMPLE-24.rar/6.exe//PE_Patch//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.pry        File: C:\Documents and Settings\Administrator\×ÀÃæ\SAMPLE-24.rar/7.exe//PE_Patch//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.pry        File: C:\Documents and Settings\Administrator\×ÀÃæ\SAMPLE-24.rar/8.exe//PE_Patch//UPack
deleted: Trojan program Trojan-PSW.Win32.QQPass.ati        File: C:\Documents and Settings\Administrator\×ÀÃæ\SAMPLE-24.rar/9.exe//UPX