一包

zzh161

感谢我的智能SandBox提供网址

样本：

无尽藏海

Begin scan in 'E:\VIRUS\11(1).rar'
E:\VIRUS\11(1).rar
  [0] Archive type: RAR
  --> 11\10.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 11\11.exe
      [DETECTION] Contains detection pattern of the worm WORM/Autorun.FF.30
  --> 11\12.exe
      [DETECTION] Is the Trojan horse TR/CrashSystem.C
  --> 11\13.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 11\14.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 11\15.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 11\16.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.rjh.8
  --> 11\17.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> 11\18.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 11\19.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agent.yub
  --> 11\2.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 11\20.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 11\21.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> 11\22.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 11\23.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agent.12313
  --> 11\24.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 11\3.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 11\4.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 11\5.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 11\6.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agent.12250
  --> 11\7.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> 11\8.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!


End of the scan: 2008年2月26日  22:36
Used time: 00:36 min

The scan has been done completely.

      0 Scanning directories
     24 Files were scanned
     15 viruses and/or unwanted programs were found
      7 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      9 Files not concerned
      1 Archives were scanned
      1 Warnings
      0 Notes

无尽藏海

Scan Log
Version of virus signature database: 2901 (20080225)
Date: 2008-2-26  Time: 22:38:41
Scanned disks, folders and files: E:\VIRUS\11(1).rar
E:\VIRUS\11(1).rar » RAR » 11\1.exe - probably a variant of Win32/Genetik trojan
E:\VIRUS\11(1).rar » RAR » 11\10.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
E:\VIRUS\11(1).rar » RAR » 11\11.exe - probably a variant of Win32/AutoRun.Q worm
E:\VIRUS\11(1).rar » RAR » 11\12.exe - probably a variant of Win32/PSW.OnLineGames.MUG trojan
E:\VIRUS\11(1).rar » RAR » 11\13.exe - a variant of Win32/PSW.OnLineGames.PBQ trojan
E:\VIRUS\11(1).rar » RAR » 11\14.exe - a variant of Win32/PSW.OnLineGames.GJV trojan
E:\VIRUS\11(1).rar » RAR » 11\15.exe - a variant of Win32/PSW.OnLineGames.PBQ trojan
E:\VIRUS\11(1).rar » RAR » 11\16.exe - Win32/PSW.OnLineGames.MUG trojan
E:\VIRUS\11(1).rar » RAR » 11\17.exe - a variant of Win32/PSW.OnLineGames.NML trojan
E:\VIRUS\11(1).rar » RAR » 11\18.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
E:\VIRUS\11(1).rar » RAR » 11\19.exe - a variant of Win32/PSW.OnLineGames.PBQ trojan
E:\VIRUS\11(1).rar » RAR » 11\2.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
E:\VIRUS\11(1).rar » RAR » 11\20.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
E:\VIRUS\11(1).rar » RAR » 11\21.exe - a variant of Win32/PSW.OnLineGames.NML trojan
E:\VIRUS\11(1).rar » RAR » 11\22.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
E:\VIRUS\11(1).rar » RAR » 11\23.exe - a variant of Win32/PSW.OnLineGames.PBQ trojan
E:\VIRUS\11(1).rar » RAR » 11\24.exe - a variant of Win32/PSW.OnLineGames.PBQ trojan
E:\VIRUS\11(1).rar » RAR » 11\3.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
E:\VIRUS\11(1).rar » RAR » 11\4.exe - Win32/PSW.OnLineGames.MUG trojan
E:\VIRUS\11(1).rar » RAR » 11\5.exe - a variant of Win32/PSW.OnLineGames.PBQ trojan
E:\VIRUS\11(1).rar » RAR » 11\6.exe - a variant of Win32/PSW.OnLineGames.PBQ trojan
E:\VIRUS\11(1).rar » RAR » 11\7.exe - probably a variant of Win32/PSW.WOW.WU trojan
E:\VIRUS\11(1).rar » RAR » 11\8.exe - a variant of Win32/PSW.OnLineGames.PBQ trojan
Number of scanned objects: 23
Number of threats found: 23
Time of completion: 22:38:44  Total scanning time: 3 sec (00:00:03)

wangjay1980

19   TO KL
detected: Trojan program Rootkit.Win32.Agent.abq        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\1.exe//PE_Patch//UPack//#
detected: virus Heur.Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\10.exe//UPack
detected: Trojan program Trojan-PSW.Win32.QQPass.avs        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\11.exe//UPX
detected: Trojan program Trojan-PSW.Win32.OnLineGames.pll        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\12.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.rgf        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\14.exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.rtg        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\16.exe//PE_Patch//UPack
detected: Trojan program Trojan.Win32.BHO.ayz        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\17.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.rwl        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\18.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.rpd        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\19.exe//PE_Patch//UPack
detected: virus Heur.Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\2.exe//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.rwl        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\20.exe//PE_Patch//UPack
detected: Trojan program Trojan.Win32.BHO.ayz        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\21.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.rwl        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\22.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.rru        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\23.exe//PE_Patch//UPack//data0000.bin//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.rpd        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\24.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.rwl        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\3.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.rhu        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\4.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.Lmir.bpv        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\7.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.rwu        File: C:\Documents and Settings\Owner\×ÀÃæ\11.rar/11\8.exe//PE_Patch//UPack



Hello,

1.exe_ - Trojan-PSW.Win32.OnLineGames.ryh,
10.exe_ - Trojan-PSW.Win32.OnLineGames.ryl,
13.exe_, 6.exe_ - Trojan-PSW.Win32.OnLineGames.ryp,
15.exe_ - Trojan-PSW.Win32.OnLineGames.ryq,
2.exe_ - Trojan-PSW.Win32.OnLineGames.rxs,
5.exe_ - Trojan-PSW.Win32.OnLineGames.ryr

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vladimir Lebedev
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: 11.rar

[ 本帖最后由 wangjay1980 于 2008-2-27 00:31 编辑 ]

allinwonderi

F-PROT Antivirus for Windows

Antivirus Scanning Engine version number: 4.4.2
Virus signature file from: 2008-2-26, 4:15

Scan name: Virus tester
Path to scan: C:\Test\|

Normal scan
Also scan: Inside subfolders, Compressed files, Streams

Scan started: 2008-2-26, 22:45:37
---------------------------------------------------------------------

[Error]        <Scanning error>        F:
[Error]        <Scanning error>        E:
[Found possible security risk]         <W32/Heuristic-114!Eldorado (damaged, not disinfectable)>        C:\Test\11.rar->11\1.exe->(embedded)->(UPack)

---------------------------------------------------------------------
Scan ended:        2008-2-26, 22:45:39
Duration:        0:00:01

Scan result:

Scanned files:                 6
Infected objects:         1
Disinfected objects:         0
Quarantined files:         0

allinwonderi

[Scanning : C:\Test]


C:\Test\11.rar<RAR>:1.exe <- Heur.Win32.I : No action
C:\Test\11.rar<RAR>:11.exe <- Trojan.Psw.Qqpass.Avs : No action
C:\Test\11.rar<RAR>:12.exe <- Heur.Win32.I : No action
C:\Test\11.rar<RAR>:12.exe<UPack>:12.exe<DLLRES>:res0.exe<UPack>:res0.exe<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Inr : No action
C:\Test\11.rar<RAR>:13.exe <- Heur.Win32.I : No action
C:\Test\11.rar<RAR>:15.exe <- Heur.Win32.I : No action
C:\Test\11.rar<RAR>:16.exe <- Heur.Win32.I : No action
C:\Test\11.rar<RAR>:17.exe <- Heur.Win32.I : No action
C:\Test\11.rar<RAR>:18.exe <- Heur.Win32.I : No action
C:\Test\11.rar<RAR>:19.exe <- Trojan.Psw.Onlinegames.Rpd : No action
C:\Test\11.rar<RAR>:20.exe <- Heur.Win32.I : No action
C:\Test\11.rar<RAR>:21.exe <- Heur.Win32.I : No action
C:\Test\11.rar<RAR>:22.exe <- Heur.Win32.I : No action
C:\Test\11.rar<RAR>:23.exe <- Heur.Win32.I : No action
C:\Test\11.rar<RAR>:24.exe <- Heur.Win32.I : No action
C:\Test\11.rar<RAR>:3.exe <- Heur.Win32.I : No action
C:\Test\11.rar<RAR>:4.exe <- Heur.Win32.I : No action
C:\Test\11.rar<RAR>:5.exe <- Heur.Win32.I : No action
C:\Test\11.rar<RAR>:6.exe <- Heur.Win32.I : No action
C:\Test\11.rar<RAR>:7.exe <- Heur.Win32.I : No action
C:\Test\11.rar<RAR>:7.exe<UPack>:7.exe<DLLRES>:J9996660.exe <- Trojan.Psw.Onlinegames.Rnh : No action
C:\Test\11.rar<RAR>:8.exe <- Heur.Win32.I : No action



Scanned objects : 51

Infected objects : 22

冷冷

IK
I:\virus\February\26\11.rar:\11\1.exe - Signature 'Trojan-Downloader.Win32.Zlob' found
I:\virus\February\26\11.rar:\11\10.exe - Signature 'Trojan-Spy.Win32.Agent.hz' found
I:\virus\February\26\11.rar:\11\11.exe - Signature 'Trojan-Proxy.Win32.Delf.AN' found
I:\virus\February\26\11.rar:\11\12.exe - Signature 'Trojan-Downloader.Win32.Zlob.and' found
I:\virus\February\26\11.rar:\11\13.exe - Suspect code-parts found (Level: 5)
I:\virus\February\26\11.rar:\11\14.exe - Signature 'Trojan-Dropper.Win32.Delf.aho' found
I:\virus\February\26\11.rar:\11\15.exe - Signature 'BehavesLikeTrojan.ShellHook' found
I:\virus\February\26\11.rar:\11\16.exe - Signature 'Trojan-Spy.Win32.Delf.PD' found
I:\virus\February\26\11.rar:\11\17.exe - Suspect code-parts found (Level: 5)
I:\virus\February\26\11.rar:\11\18.exe - Signature 'Trojan-Spy.Win32.Delf.PD' found
I:\virus\February\26\11.rar:\11\19.exe - Signature 'Generic.PWS.Games.1' found
I:\virus\February\26\11.rar:\11\2.exe - Signature 'Trojan-Spy.Win32.Agent.hz' found
I:\virus\February\26\11.rar:\11\20.exe - Signature 'Trojan-Spy.Win32.Delf.PD' found
I:\virus\February\26\11.rar:\11\21.exe - Suspect code-parts found (Level: 5)
I:\virus\February\26\11.rar:\11\22.exe - Signature 'Trojan-Spy.Win32.Delf.PD' found
I:\virus\February\26\11.rar:\11\23.exe - Suspect code-parts found (Level: 25)
I:\virus\February\26\11.rar:\11\24.exe - Signature 'BehavesLikeTrojan.ShellHook' found
I:\virus\February\26\11.rar:\11\3.exe - Signature 'Trojan-Spy.Win32.Delf.PD' found
I:\virus\February\26\11.rar:\11\4.exe - Signature 'Trojan-Spy.Win32.Delf.PD' found
I:\virus\February\26\11.rar:\11\5.exe - Signature 'Generic.PWS.Games.1' found
I:\virus\February\26\11.rar:\11\6.exe - Suspect code-parts found (Level: 25)
I:\virus\February\26\11.rar:\11\7.exe - Signature 'Trojan-PWS.Win32.Lmir.bpv' found
I:\virus\February\26\11.rar:\11\8.exe - Suspect code-parts found (Level: 25)
I:\virus\February\26\11.rar

        24 Files scanned
          (1 Archiv with 23 files)
        17 Signatures found
        6 Suspect code-parts found
        Used time: 0:02.125

xiaoxmj

信息        2008-02-26  22:58:30        您此次查毒共查出21个病毒以及危险代码                       
信息        2008-02-26  22:58:30        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件44个                       
信息        2008-02-26  22:58:30        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
病毒        2008-02-26  22:58:30        C:\Documents and Settings\Administrator\桌面\11.rar\11\8.exe        Win32.Troj.OnlineGamesT.af.57344        跳过，未处理       
病毒        2008-02-26  22:58:30        C:\Documents and Settings\Administrator\桌面\11.rar\11\7.exe        Win32.Troj.LmirT.by.9900        跳过，未处理       
病毒        2008-02-26  22:58:30        C:\Documents and Settings\Administrator\桌面\11.rar\11\6.exe        Win32.Troj.OnlineGamesT.af.57344        跳过，未处理       
病毒        2008-02-26  22:58:30        C:\Documents and Settings\Administrator\桌面\11.rar\11\5.exe        Win32.Troj.OnlineGamesT.af.57344        跳过，未处理       
病毒        2008-02-26  22:58:30        C:\Documents and Settings\Administrator\桌面\11.rar\11\4.exe        Win32.Troj.GamesHackT.gu.94304        跳过，未处理       
病毒        2008-02-26  22:58:30        C:\Documents and Settings\Administrator\桌面\11.rar\11\3.exe        Win32.Troj.OnlineGameT.am.107664        跳过，未处理       
病毒        2008-02-26  22:58:30        C:\Documents and Settings\Administrator\桌面\11.rar\11\24.exe        Win32.Troj.OnlineGamesT.af.57344        跳过，未处理       
病毒        2008-02-26  22:58:30        C:\Documents and Settings\Administrator\桌面\11.rar\11\23.exe        Win32.Troj.OnlineGamesT.af.57344        跳过，未处理       
病毒        2008-02-26  22:58:30        C:\Documents and Settings\Administrator\桌面\11.rar\11\22.exe        Win32.Troj.OnlineGameT.am.107664        跳过，未处理       
病毒        2008-02-26  22:58:30        C:\Documents and Settings\Administrator\桌面\11.rar\11\21.exe        Win32.Troj.OnlineGamesT.oy.61440        跳过，未处理       
病毒        2008-02-26  22:58:30        C:\Documents and Settings\Administrator\桌面\11.rar\11\20.exe        Win32.Troj.OnlineGameT.am.107664        跳过，未处理       
病毒        2008-02-26  22:58:30        C:\Documents and Settings\Administrator\桌面\11.rar\11\2.exe        Win32.Troj.OnlineGamesT.ty.98304        跳过，未处理       
病毒        2008-02-26  22:58:30        C:\Documents and Settings\Administrator\桌面\11.rar\11\19.exe        Win32.Troj.OnlineGamesT.af.57344        跳过，未处理       
病毒        2008-02-26  22:58:30        C:\Documents and Settings\Administrator\桌面\11.rar\11\18.exe        Win32.Troj.OnlineGameT.am.107664        跳过，未处理       
病毒        2008-02-26  22:58:30        C:\Documents and Settings\Administrator\桌面\11.rar\11\17.exe        Win32.Troj.OnlineGamesT.oy.61440        跳过，未处理       
病毒        2008-02-26  22:58:30        C:\Documents and Settings\Administrator\桌面\11.rar\11\16.exe        Win32.Troj.GamesHackT.gu.94304        跳过，未处理       
病毒        2008-02-26  22:58:30        C:\Documents and Settings\Administrator\桌面\11.rar\11\15.exe        Win32.Troj.OnlineGamesT.af.57344        跳过，未处理       
病毒        2008-02-26  22:58:30        C:\Documents and Settings\Administrator\桌面\11.rar\11\14.exe        Win32.PSWTroj.OnLineGames.77824        跳过，未处理       
病毒        2008-02-26  22:58:30        C:\Documents and Settings\Administrator\桌面\11.rar\11\13.exe        Win32.Troj.OnlineGamesT.af.57344        跳过，未处理       
病毒        2008-02-26  22:58:30        C:\Documents and Settings\Administrator\桌面\11.rar\11\12.exe        Win32.Troj.OnLineGamesT.en.5437        跳过，未处理       
病毒        2008-02-26  22:58:30        C:\Documents and Settings\Administrator\桌面\11.rar\11\10.exe        Win32.Troj.OnlineGamesT.ee.94208        跳过，未处理       
信息        2008-02-26  22:58:14        金山毒霸主程序启动查毒过程，查毒方式：命令行查毒                       
信息        2008-02-26  22:58:12        金山毒霸主程序 启动                       
信息        2008-02-26  22:33:10        金山毒霸主程序 退出

wolffshen

FS结果: 找到 16 恶意软件
Trojan-PSW.Win32.QQPass.avs (病毒)
D:\Virus\Test\11.exe 操作: 删除
Trojan-PSW.Win32.OnLineGames.pll (病毒)
D:\Virus\Test\12.exe 操作: 删除
Trojan-PSW.Win32.OnLineGames.rgf (病毒)
D:\Virus\Test\14.exe 操作: 删除
Trojan-PSW.Win32.OnLineGames.rtg (病毒)
D:\Virus\Test\16.exe 操作: 删除
Trojan.Win32.BHO.ayz (病毒)
D:\Virus\Test\17.exe 操作: 删除
D:\Virus\Test\21.exe 操作: 删除
Trojan-PSW.Win32.OnLineGames.rwl (病毒)
D:\Virus\Test\18.exe 操作: 删除
D:\Virus\Test\20.exe 操作: 删除
D:\Virus\Test\22.exe 操作: 删除
D:\Virus\Test\3.exe 操作: 删除
Trojan-PSW.Win32.OnLineGames.rpd (病毒)
D:\Virus\Test\19.exe 操作: 删除
D:\Virus\Test\24.exe 操作: 删除
Trojan-PSW.Win32.OnLineGames.rru (病毒)
D:\Virus\Test\23.exe 操作: 删除
Trojan-PSW.Win32.OnLineGames.rhu (病毒)
D:\Virus\Test\4.exe 操作: 删除
Trojan-PSW.Win32.Lmir.bpv (病毒)
D:\Virus\Test\7.exe 操作: 删除
Trojan-PSW.Win32.OnLineGames.rwu (病毒)
D:\Virus\Test\8.exe 操作: 删除

wangjay1980

Hello,

1.exe_ - Trojan-PSW.Win32.OnLineGames.ryh,
10.exe_ - Trojan-PSW.Win32.OnLineGames.ryl,
13.exe_, 6.exe_ - Trojan-PSW.Win32.OnLineGames.ryp,
15.exe_ - Trojan-PSW.Win32.OnLineGames.ryq,
2.exe_ - Trojan-PSW.Win32.OnLineGames.rxs,
5.exe_ - Trojan-PSW.Win32.OnLineGames.ryr

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vladimir Lebedev
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: 11.rar