老病毒，更新了吗？

allinwonderi

[Scanning : C:\Documents and Settings\All Users\Documents\Test]


C:\Documents and Settings\All Users\Documents\Test\virus.rar<RAR>:new.cab<CAB>:new.exe <- Trojan.Psw.Onlinegames.Rxpi : No action
C:\Documents and Settings\All Users\Documents\Test\virus.rar<RAR>:014s.exe <- Trojan.Psw.Onlinegames.Rxpi : No action
C:\Documents and Settings\All Users\Documents\Test\virus.rar<RAR>:rll.exe <- Trojan.Psw.Onlinegames.Rxpi : No action
C:\Documents and Settings\All Users\Documents\Test\virus.rar<RAR>:ogame.exe <- Trojan.Psw.Onlinegames.Rxpi : No action
C:\Documents and Settings\All Users\Documents\Test\virus.rar<RAR>:ad.cab<CAB>:bd.exe <- Downloader.Delf.Epw : No action
C:\Documents and Settings\All Users\Documents\Test\virus.rar<RAR>:014.exe <- Downloader.Delf.Epw : No action
C:\Documents and Settings\All Users\Documents\Test\virus.rar<RAR>:bf.exe <- Downloader.Delf.Epw : No action
C:\Documents and Settings\All Users\Documents\Test\virus.rar<RAR>:pps.exe <- Downloader.Delf.Epw : No action
C:\Documents and Settings\All Users\Documents\Test\virus.rar<RAR>:lz.exe <- Downloader.Delf.Epw : No action
C:\Documents and Settings\All Users\Documents\Test\virus.rar<RAR>:j.exe<PECompact2>:j.exe <- Trojan.Agent.Ffb : No action
C:\Documents and Settings\All Users\Documents\Test\virus.rar<RAR>:j.exe<PECompact2>:j.exe<DLLRES>:res1.exe <- Trojan.Agent.Fpz : No action
C:\Documents and Settings\All Users\Documents\Test\virus.rar<RAR>:j.exe<PECompact2>:j.exe<DLLRES>:res2.exe <- Trojan.Agent.Fez : No action



Scanned objects : 25

Infected objects : 12

allinwonderi

Scan started: 2008-3-18, 21:03:11
---------------------------------------------------------------------

[Found possible security risk]         <W32/Heuristic-114!Eldorado (damaged, not disinfectable)>        C:\Documents and Settings\All Users\Documents\Test\virus.rar->new.cab->new.exe->(NSPack)->(PE_Patch)
[Found possible security risk]         <W32/Heuristic-114!Eldorado (damaged, not disinfectable)>        C:\Documents and Settings\All Users\Documents\Test\virus.rar->014s.exe->(NSPack)->(PE_Patch)
[Found possible security risk]         <W32/Heuristic-114!Eldorado (damaged, not disinfectable)>        C:\Documents and Settings\All Users\Documents\Test\virus.rar->rll.exe->(NSPack)->(PE_Patch)
[Found possible security risk]         <W32/Heuristic-114!Eldorado (damaged, not disinfectable)>        C:\Documents and Settings\All Users\Documents\Test\virus.rar->ogame.exe->(NSPack)->(PE_Patch)
[Found downloader]         <W32/Banload.B.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\virus.rar->ad.cab->bd.exe->(NSPack)->(PE_Patch)
[Found downloader]         <W32/Banload.B.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\virus.rar->014.exe->(NSPack)->(PE_Patch)
[Found downloader]         <W32/Banload.B.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\virus.rar->bf.exe->(NSPack)->(PE_Patch)
[Found downloader]         <W32/Banload.B.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\virus.rar->pps.exe->(NSPack)->(PE_Patch)
[Found downloader]         <W32/Banload.B.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\virus.rar->lz.exe->(NSPack)->(PE_Patch)
[Found virus]         <W32/Downloader.gen10 (not disinfectable)>        C:\Documents and Settings\All Users\Documents\Test\virus.rar->xy.exe->(UPack)->(PE_Patch.MaskPE)
[Found Trojan]         <W32/Trojan2.WWT (exact, not disinfectable)>        C:\Documents and Settings\All Users\Documents\Test\virus.rar->j.exe
[Found virus]         <W32/Downloader.gen10 (not disinfectable)>        C:\Documents and Settings\All Users\Documents\Test\virus.rar->cmd.exe->(UPack)->(PE_Patch.MaskPE)

---------------------------------------------------------------------
Scan ended:        2008-3-18, 21:03:26
Duration:        0:00:15

Scan result:

Scanned files:                 6
Infected objects:         12
Disinfected objects:         0
Quarantined files:         0
---------------------------------------------------------------------

wangjay1980

cmd.exed - Trojan-Downloader.Win32.Agent.llu

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

qigang

新病毒，嘿嘿！

moonsilver

第一次见你发样本

mofunzone

清空文件夹

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\virus'
C:\Documents and Settings\Administrator\My Documents\virus\
  014.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/Dldr.Delf.epw.1
            [WARNING]   Infected files in archives cannot be repaired!
      [NOTE]      The file was deleted!
  014s.exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.rxpi
      [NOTE]      The file was deleted!
  ad.cab
    [0] Archive type: CAB (Microsoft)
      --> bd.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/Dldr.Delf.epw.1
              [WARNING]   Infected files in archives cannot be repaired!
      [NOTE]      The file was deleted!
  bf.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/Dldr.Delf.epw.1
            [WARNING]   Infected files in archives cannot be repaired!
      [NOTE]      The file was deleted!
  cmd.exe
    [0] Archive type: Runtime Packed
    --> Object
        [DETECTION] Is the Trojan horse TR/Spy.Delf.ajo
      [NOTE]      The file was deleted!
  j.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/Agent.142848.C
            [WARNING]   Infected files in archives cannot be repaired!
        --> Object
        --> Object
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
      [NOTE]      The file was deleted!
  lz.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/Dldr.Delf.epw.1
            [WARNING]   Infected files in archives cannot be repaired!
      [NOTE]      The file was deleted!
  new.cab
    [0] Archive type: CAB (Microsoft)
    --> new.exe
        [DETECTION] Is the Trojan horse TR/PSW.Online.rxpi
      [NOTE]      The file was deleted!
  ogame.exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.rxpi
      [NOTE]      The file was deleted!
  pps.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/Dldr.Delf.epw.1
            [WARNING]   Infected files in archives cannot be repaired!
      [NOTE]      The file was deleted!
  rll.exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.rxpi
      [NOTE]      The file was deleted!
  xy.exe
    [0] Archive type: Runtime Packed
    --> Object
        [DETECTION] Is the Trojan horse TR/Spy.Delf.ajo
      [NOTE]      The file was deleted!


End of the scan: 2008年3月18日  10:18
Used time: 00:04 min

The scan has been done completely.

      1 Scanning directories
     14 Files were scanned
     13 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
     12 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      2 Archives were scanned
      6 Warnings
     12 Notes

qigang

原帖由 moonsilver 于 2008-3-18 22:50 发表
第一次见你发样本

响应版主号召，

solcroft

全毙... 少见啊少见

* avast! Report
* This file is generated automatically
*
* Task 'Simple user interface' used
* Started on Thursday, March 20
* VPS: 080320-0, 20/03/2008
*

C:\Documents and Settings\Administrator\Desktop\virus\014.exe\[NsPack]\[Embedded#IFTDLL] [L] Win32:Delf-IOR [Trj] (0)
File was successfully deleted...
C:\Documents and Settings\Administrator\Desktop\virus\014s.exe\[NsPack]\[Embedded#05228] [L] Win32:Delf-IOR [Trj] (0)
File was successfully deleted...
C:\Documents and Settings\Administrator\Desktop\virus\ad.cab\bd.exe\[NsPack]\[Embedded#IFTDLL] [L] Win32:Delf-IOR [Trj] (0)
File was successfully deleted...
C:\Documents and Settings\Administrator\Desktop\virus\bf.exe\[NsPack]\[Embedded#IFTDLL] [L] Win32:Delf-IOR [Trj] (0)
File was successfully deleted...
C:\Documents and Settings\Administrator\Desktop\virus\cmd.exe\[Upack]\[MaskPE]\[Embedded#DLLFILE] [L] Win32:Nilage-AI [Trj] (0)
File was successfully deleted...
C:\Documents and Settings\Administrator\Desktop\virus\j.exe\[PECompact]\[Embedded#05000] [L] Win32:Agent-TAI [Trj] (0)
File was successfully deleted...
C:\Documents and Settings\Administrator\Desktop\virus\lz.exe\[NsPack]\[Embedded#IFTDLL] [L] Win32:Delf-IOR [Trj] (0)
File was successfully deleted...
C:\Documents and Settings\Administrator\Desktop\virus\new.cab\new.exe\[NsPack]\[Embedded#05228] [L] Win32:Delf-IOR [Trj] (0)
File was successfully deleted...
C:\Documents and Settings\Administrator\Desktop\virus\ogame.exe\[NsPack]\[Embedded#05228] [L] Win32:Delf-IOR [Trj] (0)
File was successfully deleted...
C:\Documents and Settings\Administrator\Desktop\virus\pps.exe\[NsPack]\[Embedded#IFTDLL] [L] Win32:Delf-IOR [Trj] (0)
File was successfully deleted...
C:\Documents and Settings\Administrator\Desktop\virus\rll.exe\[NsPack]\[Embedded#05228] [L] Win32:Delf-IOR [Trj] (0)
File was successfully deleted...
C:\Documents and Settings\Administrator\Desktop\virus\xy.exe\[Upack]\[MaskPE]\[Embedded#DLLFILE] [L] Win32:Nilage-AI [Trj] (0)
File was successfully deleted...
Infected files: 12
Total files: 61
Total folders: 1
Total size: 3.2 MB

*
* Task stopped: Thursday, March 20, 2008
* Run-time was 6 second(s)