挂华军上的那个下载者下来的

显示全部楼层 · 发表于 2008-2-14 00:59:04

成活率蛮高，就一个死链

怀疑23.exe不是病毒，费尔除了23都杀了

1=http://xxx.xia000.com/1.exe
2=http://xxx.xia000.com/2.exe
3=http://xxx.xia000.com/3.exe
4=http://xxx.xia000.com/4.exe
5=http://xxx.xia000.com/5.exe
6=http://xxx.xia000.com/6.exe
7=http://xxx.xia000.com/7.exe
8=http://xxx.xia000.com/8.exe
9=http://xxx.xia000.com/9.exe
10=http://xxx.xia000.com/10.exe
11=http://xxx.xia000.com/11.exe
12=http://xxx.xia000.com/12.exe
13=http://xxx.xia000.com/13.exe
14=http://xxx.xia000.com/14.exe
15=http://xxx.xia000.com/15.exe
16=http://xxx.xia000.com/16.exe
17=http://xxx.xia000.com/17.exe
18=http://xxx.xia000.com/18.exe
19=http://xxx.xia000.com/19.exe
20=http://xxx.xia000.com/20.exe
21=http://xxx.xia000.com/21.exe
22=http://xxx.xia000.com/22.exe
23=http://xxx.xia000.com/23.exe

样本：

显示全部楼层 · 发表于 2008-2-14 01:04:41

20个，剩下的22和23上报

F:\virus\xiaofei.rar » RAR » xiaofei\1.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
F:\virus\xiaofei.rar » RAR » xiaofei\10.exe - Win32/PSW.OnLineGames.MUG trojan
F:\virus\xiaofei.rar » RAR » xiaofei\11.exe - a variant of Win32/PSW.OnLineGames.YA trojan
F:\virus\xiaofei.rar » RAR » xiaofei\12.exe - Win32/PSW.OnLineGames.NFL trojan
F:\virus\xiaofei.rar » RAR » xiaofei\13.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
F:\virus\xiaofei.rar » RAR » xiaofei\14.exe - Win32/PSW.OnLineGames.MUG trojan
F:\virus\xiaofei.rar » RAR » xiaofei\15.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
F:\virus\xiaofei.rar » RAR » xiaofei\16.exe - Win32/PSW.OnLineGames.MUG trojan
F:\virus\xiaofei.rar » RAR » xiaofei\17.exe - a variant of Win32/PSW.OnLineGames.GJV trojan
F:\virus\xiaofei.rar » RAR » xiaofei\18.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
F:\virus\xiaofei.rar » RAR » xiaofei\19.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
F:\virus\xiaofei.rar » RAR » xiaofei\2.exe - a variant of Win32/PSW.OnLineGames.NLY trojan
F:\virus\xiaofei.rar » RAR » xiaofei\20.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
F:\virus\xiaofei.rar » RAR » xiaofei\21.exe - a variant of Win32/PSW.OnLineGames.GJV trojan
F:\virus\xiaofei.rar » RAR » xiaofei\3.exe - a variant of Win32/PSW.OnLineGames.NLY trojan
F:\virus\xiaofei.rar » RAR » xiaofei\4.exe - a variant of Win32/PSW.OnLineGames.GJV trojan
F:\virus\xiaofei.rar » RAR » xiaofei\5.exe - Win32/PSW.OnLineGames.MUG trojan
F:\virus\xiaofei.rar » RAR » xiaofei\6.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
F:\virus\xiaofei.rar » RAR » xiaofei\7.exe - Win32/PSW.OnLineGames.MUG trojan
F:\virus\xiaofei.rar » RAR » xiaofei\9.exe - probably a variant of Win32/AutoRun.Q worm

2008-2-14 1:18:01 Kernel File 'F:\virus\xiaofei\xiaofei\23.exe' was sent to ESET for analysis.
2008-2-14 1:17:58 Kernel File 'F:\virus\xiaofei\xiaofei\22.exe' was sent to ESET for analysis.

[ 本帖最后由无尽藏海于 2008-2-14 01:18 编辑 ]

显示全部楼层 · 发表于 2008-2-14 01:05:58

SEP 查了18个

显示全部楼层 · 发表于 2008-2-14 01:16:33

FS 扫描19+沙盘2+系统控制1
沙盘：
在文件 C:\DOCUMENTS AND SETTINGS\GUNDAM\桌面\XIAOFEI\XIAOFEI\19.EXE 中发现恶意代码。
感染: W32/Suspicious_U.gen.dropper
操作: 无.
在文件 C:\DOCUMENTS AND SETTINGS\GUNDAM\桌面\XIAOFEI\XIAOFEI\22.EXE 中发现恶意代码。
感染: W32/Suspicious_U.gen.dropper
操作: 无.

扫描：
结果: 发现19个恶意软件
Trojan-PSW.Win32.OnLineGames.qpw (病毒)

C:\Documents and Settings\GUNDAM\桌面\xiaofei\xiaofei\1.exe 操作: 删除

Trojan-PSW.Win32.OnLineGames.pry (病毒)

C:\Documents and Settings\GUNDAM\桌面\xiaofei\xiaofei\10.exe 操作: 删除
C:\Documents and Settings\GUNDAM\桌面\xiaofei\xiaofei\7.exe 操作: 删除

Trojan-PSW.Win32.OnLineGames.pnd (病毒)

C:\Documents and Settings\GUNDAM\桌面\xiaofei\xiaofei\11.exe 操作: 删除

Trojan-PSW.Win32.OnLineGames.okn (病毒)

C:\Documents and Settings\GUNDAM\桌面\xiaofei\xiaofei\12.exe 操作: 删除

Trojan-PSW.Win32.OnLineGames.pbp (病毒)

C:\Documents and Settings\GUNDAM\桌面\xiaofei\xiaofei\13.exe 操作: 删除
C:\Documents and Settings\GUNDAM\桌面\xiaofei\xiaofei\16.exe 操作: 删除

Trojan-PSW.Win32.OnLineGames.pzl (病毒)

C:\Documents and Settings\GUNDAM\桌面\xiaofei\xiaofei\14.exe 操作: 删除

Trojan.Win32.Vaklik.ik (病毒)

C:\Documents and Settings\GUNDAM\桌面\xiaofei\xiaofei\15.exe 操作: 删除

Trojan-PSW.Win32.Nilage.byx (病毒)

C:\Documents and Settings\GUNDAM\桌面\xiaofei\xiaofei\17.exe 操作: 删除

Trojan-PSW.Win32.OnLineGames.qxz (病毒)

C:\Documents and Settings\GUNDAM\桌面\xiaofei\xiaofei\18.exe 操作: 删除

Trojan-PSW.Win32.OnLineGames.pgp (病毒)

C:\Documents and Settings\GUNDAM\桌面\xiaofei\xiaofei\2.exe 操作: 删除

Trojan-PSW.Win32.OnLineGames.qpa (病毒)

C:\Documents and Settings\GUNDAM\桌面\xiaofei\xiaofei\20.exe 操作: 删除

Trojan.Win32.Pakes.bzp (病毒)

C:\Documents and Settings\GUNDAM\桌面\xiaofei\xiaofei\21.exe 操作: 删除

Trojan-PSW.Win32.OnLineGames.pil (病毒)

C:\Documents and Settings\GUNDAM\桌面\xiaofei\xiaofei\3.exe 操作: 删除

Trojan-PSW.Win32.Nilage.bya (病毒)

C:\Documents and Settings\GUNDAM\桌面\xiaofei\xiaofei\4.exe 操作: 删除

Trojan-PSW.Win32.OnLineGames.pvm (病毒)

C:\Documents and Settings\GUNDAM\桌面\xiaofei\xiaofei\5.exe 操作: 删除

Trojan-PSW.Win32.OnLineGames.qfw (病毒)

C:\Documents and Settings\GUNDAM\桌面\xiaofei\xiaofei\6.exe 操作: 删除

Trojan-PSW.Win32.QQPass.auq (病毒)

C:\Documents and Settings\GUNDAM\桌面\xiaofei\xiaofei\9.exe 操作: 删除

系统控制挡了一下，应该还有其他动作......

[ 本帖最后由 leonfg 于 2008-2-14 01:24 编辑 ]

显示全部楼层 · 发表于 2008-2-14 01:26:55

www.aihii.com
怪毒

显示全部楼层 · 发表于 2008-2-14 01:44:20

IK
I:\virus\xiaofei.rar:\xiaofei\1.exe - Signature 'Trojan-Spy.Win32.Agent.hz' found
I:\virus\xiaofei.rar:\xiaofei\10.exe - Signature 'Trojan-Spy.Win32.Delf.PD' found
I:\virus\xiaofei.rar:\xiaofei\11.exe - Signature 'Trojan-Spy.Win32.Agent.hz' found
I:\virus\xiaofei.rar:\xiaofei\12.exe - Signature 'Trojan-Spy.Win32.Agent.hz' found
I:\virus\xiaofei.rar:\xiaofei\13.exe - Signature 'Trojan-Spy.Win32.Delf.PD' found
I:\virus\xiaofei.rar:\xiaofei\14.exe - Signature 'Trojan-Spy.Win32.Delf.PD' found
I:\virus\xiaofei.rar:\xiaofei\15.exe - Signature 'Trojan-Spy.Win32.Agent.hz' found
I:\virus\xiaofei.rar:\xiaofei\16.exe - Signature 'Trojan-Spy.Win32.Delf.PD' found
I:\virus\xiaofei.rar:\xiaofei\17.exe - Signature 'Trojan-PWS.Win32.Agent.jp' found
I:\virus\xiaofei.rar:\xiaofei\18.exe - Signature 'Trojan-Spy.Win32.Agent.hz' found
I:\virus\xiaofei.rar:\xiaofei\19.exe - Signature 'Trojan-Spy.Win32.Delf.PD' found
I:\virus\xiaofei.rar:\xiaofei\2.exe - Signature 'Trojan-Spy.Win32.Agent.hz' found
I:\virus\xiaofei.rar:\xiaofei\20.exe - Signature 'Trojan-Spy.Win32.Agent.hz' found
I:\virus\xiaofei.rar:\xiaofei\21.exe - Signature 'not-a-virus:AdWare.Win32.EnergyPlugin.f' found
I:\virus\xiaofei.rar:\xiaofei\22.exe - Signature 'Trojan-Downloader.Win32.Zlob.and' found
I:\virus\xiaofei.rar:\xiaofei\23.exe - Suspect code-parts found (Level: 20)
I:\virus\xiaofei.rar:\xiaofei\3.exe - Signature 'Trojan-Spy.Win32.Agent.hz' found
I:\virus\xiaofei.rar:\xiaofei\4.exe - Signature 'Trojan-PWS.Win32.Agent.jp' found
I:\virus\xiaofei.rar:\xiaofei\5.exe - Signature 'Trojan-Spy.Win32.Delf.PD' found
I:\virus\xiaofei.rar:\xiaofei\6.exe - Signature 'Trojan-Spy.Win32.Agent.hz' found
I:\virus\xiaofei.rar:\xiaofei\7.exe - Signature 'Trojan-Spy.Win32.Delf.PD' found
I:\virus\xiaofei.rar:\xiaofei\9.exe - Signature 'Trojan-Proxy.Win32.Delf.AN' found
I:\virus\xiaofei.rar

23 Files scanned
(1 Archiv with 22 files)
21 Signatures found
1 Suspect code-part found
Used time: 0:00.562

显示全部楼层 · 发表于 2008-2-14 01:54:10

原帖由 solcroft 于 2008-2-14 01:26 发表
www.aihii.com
怪毒

晕就开了这么个网站

显示全部楼层 · 发表于 2008-2-14 02:02:22

MS没有威力

显示全部楼层 · 发表于 2008-2-14 02:44:26

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\xiaofei.rar'
C:\Documents and Settings\Administrator\桌面\xiaofei.rar
  [0] Archive type: RAR
  --> xiaofei\1.exe
   [DETECTION] Is the Trojan horse TR/PSW.Online.aav.1
  --> xiaofei\10.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.prw.5
  --> xiaofei\11.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pne
  --> xiaofei\12.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.oiv.2
  --> xiaofei\13.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pmi.30
  --> xiaofei\14.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.Qha.8
  --> xiaofei\15.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.298
  --> xiaofei\16.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pmi.33
  --> xiaofei\17.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> xiaofei\18.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.qya
  --> xiaofei\19.exe
   [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> xiaofei\2.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pgp.2
  --> xiaofei\20.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.qsq
  --> xiaofei\21.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> xiaofei\22.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> xiaofei\3.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pim
  --> xiaofei\4.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> xiaofei\5.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.prw.4
  --> xiaofei\6.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.294
  --> xiaofei\7.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.prw.12
  --> xiaofei\9.exe
   [DETECTION] Is the Trojan horse TR/PSW.QQpass.auq
   [INFO]    The file was deleted!

End of the scan: 星期四 2008年2月14日  02:44
Used time: 00:09 min

The scan has been done completely.

   0 Scanning directories
   24 Files were scanned
   21 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   3 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-2-14 09:26:47

ewido anti-spyware - Scan Report
---------------------------------------------------------

+ 创建时间: 9:30:38 2008-2-14

+ 扫描结果:

C:\Documents and Settings\zh\桌面\新建文件夹\xiaofei\17.exe -> Downloader.Agent.bhc : 已清除.
C:\Documents and Settings\zh\桌面\新建文件夹\xiaofei\21.exe -> Downloader.Agent.bhc : 已清除.
C:\Documents and Settings\zh\桌面\新建文件夹\xiaofei\4.exe -> Downloader.Agent.bhc : 已清除.
C:\Documents and Settings\zh\桌面\新建文件夹\xiaofei\12.exe -> Trojan.OnLineGames.obo : 已清除.
C:\Documents and Settings\zh\桌面\新建文件夹\xiaofei\13.exe -> Trojan.OnLineGames.pbp : 已清除.
C:\Documents and Settings\zh\桌面\新建文件夹\xiaofei\16.exe -> Trojan.OnLineGames.pbp : 已清除.
C:\Documents and Settings\zh\桌面\新建文件夹\xiaofei\2.exe -> Trojan.OnLineGames.pgp : 已清除.
C:\Documents and Settings\zh\桌面\新建文件夹\xiaofei\3.exe -> Trojan.OnLineGames.pil : 已清除.
C:\Documents and Settings\zh\桌面\新建文件夹\xiaofei\11.exe -> Trojan.OnLineGames.pnd : 已清除.
C:\Documents and Settings\zh\桌面\新建文件夹\xiaofei\6.exe -> Trojan.OnLineGames.qfw : 已清除.

::报告结束 10个

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.GameOL.GEN
病毒： Trojan.PSW.Win32.XYOnline.abc
病毒： Trojan.PSW.Win32.GameOL.GEN
病毒： Trojan.PSW.Win32.GameOL.GEN
病毒： Trojan.PSW.Win32.QQHX.tvu
病毒： Trojan.PSW.Win32.GamesOnline.mh
病毒： Trojan.PSW.Win32.SunOnline.md
病毒： Trojan.PSW.Win32.QQGame.GEN
病毒： Trojan.PSW.Win32.XYOnline.aay
病毒： Trojan.PSW.Win32.GameOL.GEN
病毒： Trojan.PSW.Win32.SunOnline.ma
病毒： Trojan.PSW.Win32.GamesOnline.ma

用户来源：互联网

软件版本：20.31.10
18个

[病毒样本] 挂华军上的那个下载者下来的

本帖子中包含更多资源

本帖子中包含更多资源

回复 4楼 leonfg 的帖子

回复 5楼 solcroft 的帖子