给网友杀毒抓到的一个样本—xia2.exe，还有个xia3.exe没抓到

5551551

xia2.exe，昨晚上给网友杀毒的时候抓到的，还有个xia3.exe，360每次都开机都能扫到这个xia3.exe，每次杀了重启后还是有。因为可能给360杀了，所以没抓到xia3.exe，只有QQ。分析看来是个QQ游戏木马，不知大家可否有不同意见？

Graybird

Starting the file scan:

Begin scan in 'E:\virus\xia2.rar'
E:\virus\xia2.rar
  [0] Archive type: RAR
  --> xia2.exe
      [DETECTION] Is the Trojan horse TR/PSW.Steal.33915
      [INFO]      The file was deleted!

wangjay1980

detected: Trojan program Trojan-PSW.Win32.QQPass.atq        URL: http://bbs.kafan.cn/attachment.php?aid=199857//xia2.exe//UPX

挪威的冬天

金山 miss

taiw_1144

发现未知间谍软件，是否删除？
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX01.828\XIA2.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\WN_SYS8X.SYS
是否删除木马程序及其衍生物?

woai_jolin

Hello,

Thanks for taking the time to submit your samples to the Norman
Sandbox Information Center.  Customer delight is our top priority at
Norman.  With that in mind we have developed Sandbox Solutions for
organizations that are committed to speedy analysis and debugging.

Norman Sandbox Solutions give your organization the opportunity to
analyze files immediately in your own environment.

To find out how to bring the power of Norman Sandbox into your test
environments follow the links below.

Norman Sandbox Solutions
http://www.norman.com/Product/Sandbox-products/

Norman Sandbox Analyzer
http://www.norman.com/Product/Sandbox-products/Analyzer/

Norman Sandbox Analyzer Pro
http://www.norman.com/Product/Sandbox-products/Analyzer-pro/

Norman SandBox Reporter
http://www.norman.com/Product/Sandbox-products/Reporter/

xia2.exe : Not detected by Sandbox (Signature: W32/QQPass.HRK)


[ DetectionInfo ]
    * Sandbox name: NO_MALWARE
    * Signature name: W32/QQPass.HRK
    * Compressed: YES
    * TLS hooks: YES
    * Executable type: Application
    * Executable file structure: OK

[ General information ]
    * Decompressing UPX.
    * File length:        33915 bytes.
    * MD5 hash: bb281e86004a50885cf1b8f13c975ef1.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

[ 本帖最后由 woai_jolin 于 2008-2-13 16:06 编辑 ]

chunnian

KV能够杀掉

[ 本帖最后由 chunnian 于 2008-2-13 16:07 编辑 ]

hj5abc

Sign of "Win32:OnLineGames-BSI [Trj]" has been found in "F:\xia2.rar\xia2.exe\[UPX]\[Embedded#056f8]" file.

clovedsm

风险类别: 病毒
整体风险影响: 高
性能:高
隐私:高
删除:高
隐蔽性: 高
单击以了解有关该风险的更多信息: W32.Gammima
采取的操作: 已禁止
影响区域: c:\documents and settings\sim\desktop\xia2\xia2.exe

无尽藏海

F:\virus\xia2.rar » RAR » xia2.exe - probably a variant of Win32/AutoRun.Q worm