毒22个

Graybird

The file '05.exe' has been determined to be 'MALWARE'. Our analysts named the threat BDS/Agent.aoc. The term "BDS/" denotes a Backdoor-Server program. Backdoor-Server programs are used to spy out, modify or delete data.Detection will be added to our virus definition file (VDF) with one of the next updates. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: PCK/Obsidium.

The file '17.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/Dldr.Small.RV. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Malware.

醉一生爱妍

哇塞，10.exe估计是个偷QQ的木马，一开始就直接KILLQQ的进程

不用说了

10.exe和20.exe是共同的~！！

首先10.EXE结束掉QQ的进程

然后运行20.exe

然后20.EXE会释放一个QQ.EXE覆盖原来的QQ.EXE

用户重新启动QQ的时候，其实她运行的已经是一个被修改过的偷QQ的登陆木马

然后。。。。。。。。嘿嘿

[ 本帖最后由 garyyan456 于 2008-2-4 22:35 编辑 ]

冷冷

我也试试看
-------------------------------

在沙盘里QQ没有被杀。因为在沙盘里是默认为初始状态，应该说是什么用户软件都没有启动！



[ 本帖最后由 冷_冷 于 2008-2-4 22:54 编辑 ]

Joker

唉。红伞和卡巴又不一样了。，。
17.exe

This file is corrupted.

yitp

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\11.rar'
C:\Documents and Settings\Administrator\桌面\11.rar
  [0] Archive type: RAR
  --> 02.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pmi.28
  --> 01.exe
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
  --> 03.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agent.11828
  --> 04.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.Qha.1
  --> 06.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.Qha.3
  --> 07.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.QIV.9
  --> 08.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> 09.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.qiv
  --> 10.exe
      [DETECTION] Is the Trojan horse TR/Agent.31744.B.1
  --> 11.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.ink
  --> 12.exe
      [DETECTION] Is the Trojan horse TR/PSW.Delf.aob
  --> 13.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.prw.5
  --> 14.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.Qha.8
  --> 15.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agent.12210
  --> 16.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.11776.12
  --> 17.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 18.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.prj.4
  --> 19.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.prw.3
  --> 20.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 21.dll
      [DETECTION] Is the Trojan horse TR/PSW.Delf.aoa
  --> 22.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.ink
      [INFO]      The file was deleted!

xxwpk007

MicroVita AntiSpyware 100 C
_____________________________________________
                                          
             风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]                  
                   http://221.10.254.214/
----------------------------------------------
开始扫描……


正在检查启动……
[F:\11\02.exe]
                    …………发现Spy！报告:[2] [1] Win32.F/S.ByDwing
文件信息:  大小:17920  MD5:756ee8c2062e61c24def9561e5044e78


[F:\11\03.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:11828  MD5:e3a80f17c8ae37e5aec4322c6e03c587


[F:\11\04.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:23232  MD5:4ff6666f6be3ec234d700162054c1368


[F:\11\06.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:24348  MD5:baaab16757e735b5a92e48c8dd79d697


[F:\11\07.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:18252  MD5:0321cba19b70fda98b7ffb56d6cb390b


[F:\11\08.exe]
                    …………发现Spy！报告:[1] Win32.NkHack.jectd3
文件信息:  大小:44032  MD5:d2e940f046ed5538f200bd6209b9e2a5


[F:\11\09.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:18280  MD5:32d7d6ad524894755e5a3feca843c428


[F:\11\11.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing[5] 下载者
文件信息:  大小:16437  MD5:0c76ac504d77b96a1aed6cab08cf0be0


[F:\11\12.exe]
                    …………发现Spy！报告:[2] [1] Win32.F/S.ByDwing
文件信息:  大小:17914  MD5:86992d76622e451d721c5167acceeb54


[F:\11\13.exe]
                    …………发现Spy！报告:[2] [1] Win32.F/S.ByDwing
文件信息:  大小:17812  MD5:4af9507b67b29506c563f5c91b0eb088


[F:\11\14.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:18408  MD5:8c3bd36bd186c7c814e1d1d28cd43338


[F:\11\15.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:12210  MD5:9b2b065630ff2391856f4f17e3465b51


[F:\11\16.exe]
                    …………发现Spy！报告:[1] Win32.Unknow
文件信息:  大小:12316  MD5:35b88eb2f7c285d06df4abcf7881ec49


[F:\11\17.exe]
                    …………发现Spy！报告:[1] Win32.Unknow
文件信息:  大小:12316  MD5:33a5ff0de087b75daedb2aad1e60b354


[F:\11\18.exe]
                    …………发现Spy！报告:[2] [1] Win32.F/S.ByDwing
文件信息:  大小:21797  MD5:3a2b6bbd33d326c3d16dacd6768cac89


[F:\11\19.exe]
                    …………发现Spy！报告:[2] [1] Win32.F/S.ByDwing
文件信息:  大小:18684  MD5:90a6f57c2b1bc7b80eb2dd01d82ff4a0


[F:\11\21.dll]
                    …………发现Spy！报告:[6] 注入者[8] HOOK者
文件信息:  大小:28384  MD5:953068b22c95450db949f71ff27492eb


文件数:22   病毒数:17  比重:0.7727272727273
OK  扫描完毕！

  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎   
[2] 文件特征码引擎
[1] 文件启发式引擎

sam.to

Hello,

05.exe_ - Backdoor.Win32.Ceckno.qd,

20.exe_ - Worm.Win32.AutoRun.ciz

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

17.exe_

This file is corrupted.

Please quote all when answering.

--
Best regards, Dmitry Shvetsov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.