下载者10个

显示全部楼层 · 发表于 2008-2-21 02:34:54

此下载者产自【某东西变种】这贴

htp://1.ads555.com:99/rj/3.exe
htp://1.ads555.com:99/071217/1023.exe
htp://1.ads555.com:99/yyy/ad_2516.exe
htp://1.ads555.com:99/yyy/223.exe
htp://1.ads555.com:99/yyy/1001.exe
htp://1.ads555.com:99/rj/2008020113TestHttp.exe
htp://1.ads555.com:99/yyy/52vip_yoyo1012.exe
htp://1.ads555.com:99/yyy/666888.exe
htp://1.ads555.com:99/rj/cc1.exe
htp://1.ads555.com:99/rj/5.exe

[MD5: 7988A9 424439 F30637 FBE01F 0149E0 817614 3195F6 55B305 2A8C2C B3FF8A]

IK
I:\virus\后期处理\SAMPLE-30.rar:\1023.exe - Signature 'Trojan-Spy.Win32.Agent.pn' found
I:\virus\后期处理\SAMPLE-30.rar:\2008020113TestHttp.exe - Suspect code-parts found (Level: 170)
I:\virus\后期处理\SAMPLE-30.rar:\223.exe
I:\virus\后期处理\SAMPLE-30.rar:\3.exe
I:\virus\后期处理\SAMPLE-30.rar:\5.exe - Signature 'Virus.Win32.Agent.BPB' found
I:\virus\后期处理\SAMPLE-30.rar:\52vip_yoyo1012.exe
I:\virus\后期处理\SAMPLE-30.rar:\666888.exe - Signature 'Trojan-PWS.Win32.Agent.BU' found
I:\virus\后期处理\SAMPLE-30.rar:\ad_2516.exe
I:\virus\后期处理\SAMPLE-30.rar:\cc1.exe - Signature 'Trojan-Spy.Win32.Delf.PD' found
I:\virus\后期处理\SAMPLE-30.rar:\1001.exe - Signature 'Trojan-Spy.Win32.Delf.GI' found
I:\virus\后期处理\SAMPLE-30.rar
11 Files scanned
(1 Archiv with 10 files)
5 Signatures found
1 Suspect code-part found
Used time: 0:00.234

[ 本帖最后由冷_冷于 2008-2-21 02:37 编辑 ]

显示全部楼层 · 发表于 2008-2-21 02:41:18

卡巴查出６个。。
deleted: Trojan program Trojan-Spy.Win32.Pophot.ads File: C:\Virus\SAMPLE-30.rar/1023.exe//PE_Patch//UPack
deleted: Trojan program Trojan-Clicker.Win32.Agent.ry File: C:\Virus\SAMPLE-30.rar/223.exe
deleted: Trojan program Trojan-Downloader.Win32.Flux.cn File: C:\Virus\SAMPLE-30.rar/666888.exe
deleted: adware not-a-virus:AdWare.Win32.Boran.dj File: C:\Virus\SAMPLE-30.rar/ad_2516.exe//stream//data0001
deleted: Trojan program Trojan-Spy.Win32.Pophot.ade File: C:\Virus\SAMPLE-30.rar/cc1.exe//PE_Patch//UPack
deleted: virus Worm.Win32.Delf.el File: C:\Virus\SAMPLE-30.rar/1001.exe
其余上报。

[ 本帖最后由 hlx98007 于 2008-2-21 02:43 编辑 ]

显示全部楼层 · 发表于 2008-2-21 02:44:20

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\SAMPLE-30.rar'
C:\Documents and Settings\Administrator\桌面\SAMPLE-30.rar
  [0] Archive type: RAR
  --> 1023.exe
   [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
  --> 2008020113TestHttp.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Agen.113152
  --> 223.exe
   [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
  --> 3.exe
   [DETECTION] Is the Trojan horse TR/Downloader.Gen
  --> 5.exe
   [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
  --> 666888.exe
   [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
  --> ad_2516.exe
   [DETECTION] Contains detection pattern of the dropper DR/Boran.DJ.4
  --> cc1.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 1001.exe
   [DETECTION] Is the Trojan horse TR/Hijacker.Gen
   [INFO]    The file was deleted!

End of the scan: 星期四 2008年2月21日  02:44
Used time: 00:11 min

The scan has been done completely.

   0 Scanning directories
   12 Files were scanned
   9 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted

显示全部楼层 · 发表于 2008-2-21 04:00:06

FS结果: 找到 6 恶意软件，其余的2008020113TestHttp.exe，好像说是clean的，还有3个上报看看
Worm.Win32.Delf.el (病毒)
D:\Virus\Test\1001.exe 操作: 删除
Trojan-Spy.Win32.Pophot.ads (病毒)
D:\Virus\Test\1023.exe 操作: 删除
Trojan-Clicker.Win32.Agent.ry (病毒)
D:\Virus\Test\223.exe 操作: 删除
Trojan-Downloader.Win32.Flux.cn (病毒)
D:\Virus\Test\666888.exe 操作: 删除
Trojan-Spy.Win32.Pophot.ade (病毒)
D:\Virus\Test\cc1.exe 操作: 删除
AdWare.Win32.Boran (广告软件)
D:\Virus\Test\ad_2516.exe 操作: 删除

显示全部楼层 · 发表于 2008-2-21 04:00:34

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\SAMPLE-30'
C:\Documents and Settings\Administrator\My Documents\SAMPLE-30\
  1001.exe
   [DETECTION] Is the Trojan horse TR/Hijacker.Gen
   [INFO]    The file was deleted!
  1023.exe
   [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
   [INFO]    The file was deleted!
  2008020113TestHttp.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Agen.113152
   [INFO]    The file was deleted!
  223.exe
   [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
   [INFO]    The file was deleted!
  3.exe
   [DETECTION] Is the Trojan horse TR/Downloader.Gen
   [INFO]    The file was deleted!
  5.exe
   [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
   [INFO]    The file was deleted!
  52vip_yoyo1012.exe
  666888.exe
   [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
   [INFO]    The file was deleted!
  ad_2516.exe
   [DETECTION] Contains detection pattern of the dropper DR/Boran.DJ.4
   [INFO]    The file was deleted!
  cc1.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [INFO]    The file was deleted!

End of the scan: 2008年2月20日  12:00
Used time: 00:05 min

The scan has been done completely.

   1 Scanning directories
   10 Files were scanned
   9 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   9 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   0 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-2-21 07:13:02

病毒： Trojan.Clicker.Win32.PopHot.hz
病毒： Trojan.Clicker.Win32.PopHot.ib
病毒： Packer.Win32.VmpPacker.a
病毒： Trojan.Clicker.Win32.PopHot.hu
病毒： Trojan.Clicker.Win32.PopHot.hu
病毒： Trojan.DL.Win32.Mnless.zw

显示全部楼层 · 发表于 2008-2-21 07:26:33

Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs

显示全部楼层 · 发表于 2008-2-21 08:51:56

to kl.

Hello,

2008020113TestHttp.exek

No malicious code was found in this file.

3.exek - Trojan-Downloader.Win32.Small.imt,
5.exek - Backdoor.Win32.Agent.eqc,
52vip_yoyo1012.exek - Backdoor.Win32.Rbot.htn, [:1:]
an006.exek - Trojan-Downloader.Win32.Agent.jhx,
exe.exek - Trojan-Downloader.Win32.Agent.jhy,
mrofinu565.exek - Trojan-Downloader.Win32.Agent.jhv,
niu.ex4e - Worm.Win32.AutoRun.cpy,
qq.exek - Trojan.Win32.Pakes.cew,
www.hmhk.cn.exek - Backdoor.Win32.Hupigon.axet

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

73e1.exek - not-a-virus:AdWare.Win32.BHO.abi

This file is an Advertizing Tool, it is detected by
extended databases set. See more info about
extended databases here: http://www.kaspersky.com/extraavupdates

Please quote all when answering.

--
Best regards, Vladimir Krylov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

[ 本帖最后由 wangjay1980 于 2008-2-21 11:38 编辑 ]

显示全部楼层 · 发表于 2008-2-21 09:58:10

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.Clicker.Win32.PopHot.hz
病毒： Trojan.Clicker.Win32.PopHot.ib
病毒： Packer.Win32.VmpPacker.a
病毒： Trojan.Clicker.Win32.PopHot.hu
病毒： Trojan.Clicker.Win32.PopHot.hu
病毒： Trojan.DL.Win32.Mnless.zw

用户来源：互联网

软件版本：20.32.22

7个

显示全部楼层 · 发表于 2008-2-21 09:59:41

费尔 8个

[病毒样本] 下载者10个

本帖子中包含更多资源

Avira AntiVir