下载者的下载清单

zzh161

好大啊，看来要分卷，好多下不了

1
http://www.10wip.com/sohu/1.exe
1.exe
http://www.10wip.com/sohu/2.exe
2.exe
http://door.196462035.cn/down/1.exe
zs.exe
http://door.196462035.cn/down/2.exe
pv.exe
http://door.196462035.cn/down/3.exe
dodo.exe
http://door.196462035.cn/down/4.exe
cc.exe
http://door.196462035.cn/down/5.exe
xfy.exe
http://door.196462035.cn/down/6.exe
ns.exe
http://www.10wip.com/sohu/3.exe
3.exe
http://www.10wip.com/sohu/4.exe
4.exe
http://www.10wip.com/sohu/5.exe
5.exe
http://www.10wip.com/sohu/6.exe
6.exe
http://www.10wip.com/sohu/7.exe
7.exe
http://www.10wip.com/sohu/8.exe
8.exe
http://www.10wip.com/sohu/9.exe
9.exe
http://www.10wip.com/sohu/10.exe
10.exe
http://www.10wip.com/sohu/11.exe
11.exe
http://www.10wip.com/sohu/12.exe
12.exe
http://www.10wip.com/sohu/13.exe
13.exe
http://www.10wip.com/sohu/14.exe
14.exe
http://www.10wip.com/sohu/15.exe
15.exe
http://www.10wip.com/sohu/16.exe
16.exe
http://www.10wip.com/sohu/17.exe
17.exe
http://www.10wip.com/sohu/18.exe
18.exe
http://www.10wip.com/sohu/19.exe
19.exe
http://www.10wip.com/sohu/20.exe
20.exe
http://www.maoxiantc.cn/weed/judy.exe
mw.exe
http://www.10wip.com/sohu/21.exe
21.exe
http://www.10wip.com/sohu/22.exe
22.exe
http://www.10wip.com/sohu/23.exe
23.exe
http://www.10wip.com/sohu/24.exe
24.exe
http://www.10wip.com/sohu/25.exe
25.exe
http://www.10wip.com/sohu/26.exe
26.exe
http://www.10wip.com/sohu/27.exe
27.exe
http://www.10wip.com/sohu/28.exe
28.exe
http://www.10wip.com/sohu/29.exe
29.exe
http://www.10wip.com/sohu/30.exe
30.exe
http://www.10wip.com/sohu/31.exe
31.exe
http://www.10wip.com/sohu/32.exe
32.exe
http://www.10wip.com/sohu/33.exe
33.exe
http://www.10wip.com/sohu/34.exe
34.exe
http://www.10wip.com/sohu/35.exe
35.exe
http://www.10wip.com/sohu/36.exe
36.exe
http://www.10wip.com/sohu/37.exe
37.exe
http://www.10wip.com/sohu/38.exe
38.exe
http://www.10wip.com/sohu/39.exe
39.exe
http://www.10wip.com/sohu/40.exe
40.exe

样本：

[ 本帖最后由 zzh161 于 2008-2-17 22:09 编辑 ]

wangjay1980

貌似很熟，怎么不下载回来

zzh161

那么大。。。算了，还是下载下好了，提高大家的积极性

wolffshen

FS结果: 找到 17 恶意软件，漏了1个，上报
Trojan-Dropper.Win32.Agent.dtc (病毒)
D:\Virus\Test\1.exe 操作: 删除
Worm:W32/AutoRun.CL (病毒)
D:\Virus\Test\10.exe 操作: 删除
Backdoor.Win32.Rbot.gqd (病毒)
D:\Virus\Test\11.exe 操作: 删除
IRC-Worm.Win32.Delf.am (病毒)
D:\Virus\Test\12.exe 操作: 删除
Trojan-Downloader.Win32.Agent.jec (病毒)
D:\Virus\Test\15.exe 操作: 删除
Trojan-Downloader.Win32.Hmir.ut (病毒)
D:\Virus\Test\2(1).exe 操作: 删除
Backdoor.Win32.Small.cur (病毒)
D:\Virus\Test\2.exe 操作: 删除
Backdoor.Win32.Rbot.haa (病毒)
D:\Virus\Test\3.exe 操作: 删除
Trojan-Downloader.Win32.Agent.ikn (病毒)
D:\Virus\Test\4.exe 操作: 删除
Trojan-Downloader.Win32.Delf.emu (病毒)
D:\Virus\Test\5(1).exe 操作: 删除
Trojan.Win32.Agent.fct (病毒)
D:\Virus\Test\5.exe 操作: 删除
Worm.Win32.AutoRun.cof (病毒)
D:\Virus\Test\6(1).exe 操作: 删除
Trojan.Win32.Dialer.adp (病毒)
D:\Virus\Test\6.exe 操作: 删除
Trojan-Downloader.Win32.Small.iio (病毒)
D:\Virus\Test\7.exe 操作: 删除
Trojan-Dropper.Win32.Agent.dwb (病毒)
D:\Virus\Test\8.exe 操作: 删除
Trojan-Downloader.Win32.Delf.esh (病毒)
D:\Virus\Test\9.exe 操作: 删除
Worm.Win32.Agent.y (病毒)
D:\Virus\Test\judy.exe 操作: 删除

[ 本帖最后由 wolffshen 于 2008-2-17 22:29 编辑 ]

wangjay1980

18
detected: Trojan program Trojan-Dropper.Win32.Agent.dtc        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\1.exe
detected: Trojan program Backdoor.Win32.Popwin.awy        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\10.exe//PE_Patch//UPack
detected: Trojan program Backdoor.Win32.Rbot.gqd        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\11.exe//data0002
detected: virus IRC-Worm.Win32.Delf.am        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\12.exe
detected: Trojan program Trojan-Downloader.Win32.Agent.jec        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\15.exe//PE_Patch//UPack
detected: Trojan program Trojan-Downloader.Win32.Hmir.ut        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\2(1).exe//PE_Patch//UPack
detected: Trojan program Backdoor.Win32.Small.cur        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\2.exe
detected: Trojan program Backdoor.Win32.Rbot.haa        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\3.exe//data0002//PE_Patch
detected: Trojan program Trojan-Downloader.Win32.Agent.ikn        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\4.exe//PE_Patch//UPack
detected: Trojan program Trojan-Downloader.Win32.Delf.emu        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\5(1).exe//data0003//data0003
detected: Trojan program Trojan-Downloader.Win32.Small.ilo        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\5(1).exe//data0004
detected: Trojan program Trojan.Win32.Agent.fct        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\5.exe
detected: virus Worm.Win32.AutoRun.cof        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\6(1).exe//PE_Patch//UPack
detected: Trojan program Trojan.Win32.Dialer.adp        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\6.exe//FSG
detected: Trojan program Trojan-Downloader.Win32.Small.iio        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\7.exe
detected: Trojan program Trojan-Dropper.Win32.Agent.dwb        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\8.exe
detected: Trojan program Trojan-Downloader.Win32.Delf.esh        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\9.exe//ASPack
detected: virus Worm.Win32.Agent.y        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\judy.exe

无尽藏海

辛苦了~



Scan Log
Version of virus signature database: 2881 (20080217)
Date: 2008-2-17  Time: 22:23:24
Scanned disks, folders and files: F:\virus\11.rar
F:\virus\11.rar » RAR » 11\1.exe - a variant of Win32/TrojanDropper.Small.NGH trojan
F:\virus\11.rar » RAR » 11\10.exe - probably a variant of Win32/Genetik trojan
F:\virus\11.rar » RAR » 11\11.exe » NSIS » 24.exe - a variant of Win32/Ysmarsys.D trojan
F:\virus\11.rar » RAR » 11\12.exe - probably a variant of Win32/Genetik trojan
F:\virus\11.rar » RAR » 11\2.exe - Win32/Small.OO trojan
F:\virus\11.rar » RAR » 11\4.exe - a variant of Win32/TrojanDownloader.Delf.OBQ trojan
F:\virus\11.rar » RAR » 11\5.exe - probably unknown NewHeur_PE virus [7]
F:\virus\11.rar » RAR » 11\6(1).exe - probably a variant of Win32/Genetik trojan
F:\virus\11.rar » RAR » 11\8.exe - a variant of Win32/TrojanDownloader.Agent.INE trojan
F:\virus\11.rar » RAR » 11\9.exe - probably a variant of Win32/Genetik trojan
F:\virus\11.rar » RAR » 11\judy.exe - Win32/Agent.Y worm
Number of scanned objects: 29
Number of threats found: 11
Time of completion: 22:23:48  Total scanning time: 24 sec (00:00:24)

Notes:
[7] Object is probably infected with an unknown virus.






一起扔上去
2008-2-17 22:27:04 Kernel File  'F:\virus\11.rar' was sent to ESET for analysis.

[ 本帖最后由 无尽藏海 于 2008-2-17 22:27 编辑 ]

spatra

Begin scan in 'C:\Documents and Settings\Administrator\桌面\11.rar'
C:\Documents and Settings\Administrator\桌面\11.rar
  [0] Archive type: RAR
  --> 11\1.exe
      [DETECTION] Contains detection pattern of the dropper DR/Agent.TZ
  --> 11\10.exe
      [DETECTION] Contains detection pattern of the worm WORM/Winko.I.62
  --> 11\11.exe
      [DETECTION] Contains detection pattern of the dropper DR/Rbot.180816
  --> 11\12.exe
      [DETECTION] Contains detection pattern of the worm WORM/Delf.AM.8
  --> 11\15.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 11\2(1).exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.KJ.1
  --> 11\2.exe
      [DETECTION] Is the Trojan horse TR/Flooder.D.60
  --> 11\3.exe
      [DETECTION] Contains detection pattern of the dropper DR/Rbot.157803
  --> 11\4.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> 11\5.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 11\6(1).exe
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
  --> 11\6.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 11\7.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Small.IIO.1
  --> 11\8.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agent.DWB.1
  --> 11\9.exe
      [DETECTION] Is the Trojan horse TR/Agent.94720.H
  --> 11\judy.exe
      [DETECTION] Is the Trojan horse TR/Agent.18944.C.2
      [WARNING]   The file was ignored!


End of the scan: 2008年2月17日  22:27
Used time: 00:30 min

The scan has been done completely.

      0 Scanning directories
     19 Files were scanned
     14 viruses and/or unwanted programs were found
      2 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      5 Files not concerned
      1 Archives were scanned
      1 Warnings
      0 Notes
红伞14...

微点，特征码9.以下主防拦截：
2.exe
程序:
C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\DRIVE\E\11\2.EXE
蠕虫程序生成以下文件:
1) C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\DRIVE\C\WINDOWS\SYSTEM32\2.EXE
是否删除蠕虫程序及其衍生物?
3.exe（忘了复制）..
4.exe
程序:
C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\DRIVE\E\11\4.EXE
是否删除木马程序及其衍生物?

5.exe（卡住不动...）
6.exe
木马名称:Trojan-Downloader.Win32.Piaoyes.da

程序:
C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\USER\CURRENT\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\QP7HZBEE\MY_70424[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Downloader.Win32.Piaoyes.da

程序:
C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\USER\ALL\APPLICATION DATA\MICROSOFT\DR WATSON\KZDH.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\DRIVE\E\11\11.EXE
木马程序生成以下文件:
1) C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\DRIVE\C\PROGRAM FILES\MICROSOFT OFFICE\SYSTEM\DODOLOOK_7424.EXE
2) C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\USER\CURRENT\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\HCEVF91S\11[1]

[ 本帖最后由 spatra 于 2008-2-17 22:35 编辑 ]

spatra

judy.exe
程序:
C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\DRIVE\E\11\2.EXE
是否删除木马程序及其衍生物?

xiaoxmj

信息        2008-02-17  23:07:04        您此次查毒清除了6个病毒                       
信息        2008-02-17  23:07:04        您此次查毒共查出6个病毒以及危险代码                       
信息        2008-02-17  23:07:04        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件30个                       
信息        2008-02-17  23:07:04        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
病毒        2008-02-17  23:07:04        C:\Documents and Settings\Administrator\桌面\11.rar\11\judy.exe        Worm.Agent.y.16576        清除成功       
病毒        2008-02-17  23:07:04        C:\Documents and Settings\Administrator\桌面\11.rar\11\8.exe        Win32.VirInstaller.Delf.zu.61440        清除成功       
病毒        2008-02-17  23:07:04        C:\Documents and Settings\Administrator\桌面\11.rar\11\5.exe        Win32.Troj.Unknown.a.65553        清除成功       
病毒        2008-02-17  23:07:03        C:\Documents and Settings\Administrator\桌面\11.rar\11\2.exe        Win32.Troj.Agent.610304        清除成功       
病毒        2008-02-17  23:07:03        C:\Documents and Settings\Administrator\桌面\11.rar\11\2(1).exe        Win32.Troj.Clicker.cm.327680        清除成功       
病毒        2008-02-17  23:07:03        C:\Documents and Settings\Administrator\桌面\11.rar\11\15.exe        Win32.Troj.Agent.cn.339968        清除成功

spaceplane

NOD 11

已扫描的磁盘，文件夹及文件：E:\pic\_PICtemp\11.rar
E:\pic\_PICtemp\11.rar >>RAR >>11\1.exe - Win32/TrojanDropper.Small.NGH 木马的变种
E:\pic\_PICtemp\11.rar >>RAR >>11\10.exe - 可能是 Win32/Genetik 木马 的一个变种
E:\pic\_PICtemp\11.rar >>RAR >>11\11.exe >>NSIS >>24.exe - Win32/Ysmarsys.D 木马的变种
E:\pic\_PICtemp\11.rar >>RAR >>11\12.exe - 可能是 Win32/Genetik 木马 的一个变种
E:\pic\_PICtemp\11.rar >>RAR >>11\2.exe - Win32/Small.OO 木马
E:\pic\_PICtemp\11.rar >>RAR >>11\4.exe - Win32/TrojanDownloader.Delf.OBQ 木马的变种
E:\pic\_PICtemp\11.rar >>RAR >>11\5.exe - 未查明的 NewHeur_PE 病毒 [7]
E:\pic\_PICtemp\11.rar >>RAR >>11\6(1).exe - 可能是 Win32/Genetik 木马 的一个变种
E:\pic\_PICtemp\11.rar >>RAR >>11\8.exe - Win32/TrojanDownloader.Agent.INE 木马的变种
E:\pic\_PICtemp\11.rar >>RAR >>11\9.exe - 可能是 Win32/Genetik 木马 的一个变种
E:\pic\_PICtemp\11.rar >>RAR >>11\judy.exe - Win32/Agent.Y 蠕虫
已扫描的文件数目：29
已发现的病毒数目：11
完成时间： 23:17:02 总扫描时间：28 秒 (00:00:28)