来2只马

sjducker

Access to the data has been denied!
Warning: A virus or unwanted program has been found in the HTTP Data.

Requested URL:  http://bbs.kafan.cn/attachment.php?aid=222814
Information:  Contains detection pattern of the HTML script virus HTML/Rce.Gen  


--------------------------------------------------------------------------------
Generated by AntiVir WebGuard 8.0.10.0, AVE 8.1.0.19, VDF 7.0.3.59

Starting the file scan:

Begin scan in 'D:\virus.rar'
D:\virus.rar
  [0] Archive type: RAR
  --> mm.exe
      [DETECTION] Contains detection pattern of the rootkit RKIT/HideProcess.B
  --> ntuser.com
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [INFO]      The file was deleted!

小飞侠.net

http://1.9797aiai.com/mm/mm.exe
http://user1.33226.net/bak.css
http://user1.33226.net/Baidu.cab

http://2.9797aiai.com/xiexie.txt
http://3.9797aiai.com/xiexie.txt
http://4.9797aiai.com/xiexie.txt

[CONTROL]
VERSION=2008-2-3

[DOWN]
NEWVERSION=http://cc.fockfock.com/mm/up.exe
1=http://cc.fockfock.com/mm/aa1.exe
2=http://cc.fockfock.com/mm/aa2.exe
3=http://cc.fockfock.com/mm/aa3.exe
4=http://cc.fockfock.com/mm/aa4.exe
5=http://cc.fockfock.com/mm/aa5.exe
6=http://cc.fockfock.com/mm/aa6.exe
7=http://cc.fockfock.com/mm/aa7.exe
8=http://cc.fockfock.com/mm/aa8.exe
9=http://cc.fockfock.com/mm/aa9.exe
10=http://cc.fockfock.com/mm/aa10.exe
11=http://cc.fockfock.com/mm/aa11.exe
12=http://cc.fockfock.com/mm/aa12.exe
13=http://cc.fockfock.com/mm/aa13.exe
14=http://cc.fockfock.com/mm/aa14.exe
15=http://cc.fockfock.com/mm/aa15.exe
16=http://cc.fockfock.com/mm/aa16.exe
17=http://cc.fockfock.com/mm/aa17.exe
18=http://cc.fockfock.com/mm/aa18.exe
19=http://cc.fockfock.com/mm/aa19.exe
20=http://cc.fockfock.com/mm/aa20.exe
21=http://cc.fockfock.com/mm/aa21.exe
22=http://cc.fockfock.com/mm/aa22.exe
23=http://cc.fockfock.com/mm/aa23.exe
24=http://cc.fockfock.com/mm/aa24.exe
25=http://cc.fockfock.com/mm/aa25.exe
26=http://cc.fockfock.com/mm/aa26.exe
27=http://cc.fockfock.com/mm/aa27.exe 下这么多马儿，兼容么，稳定么？

allinwonderi

ArcaBit ,FP6 miss.

Starting the file scan:

Begin scan in 'D:\新建文件夹'
D:\新建文件夹\aa1.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '4814553d.qua'!
D:\新建文件夹\aa2.exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.ddn.2
      [INFO]      The file was deleted!
D:\新建文件夹\aa3.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [INFO]      The file was deleted!
D:\新建文件夹\aa4.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.urz.1
      [INFO]      The file was deleted!
D:\新建文件夹\aa5.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGame.XO
      [INFO]      The file was deleted!
D:\新建文件夹\aa6.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '4819553e.qua'!
D:\新建文件夹\aa7.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agent.jue.1
      [INFO]      The file was deleted!
D:\新建文件夹\aa8.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '481b553f.qua'!
D:\新建文件夹\aa9.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [INFO]      The file was deleted!
D:\新建文件夹\aa10.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '4814553f.qua'!
D:\新建文件夹\aa11.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '48145540.qua'!
D:\新建文件夹\aa12.exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.ddn.2
      [INFO]      The file was deleted!
D:\新建文件夹\aa13.exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.ddn.2
      [INFO]      The file was deleted!
D:\新建文件夹\aa14.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [INFO]      The file was deleted!
D:\新建文件夹\aa15.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agent.jue.1
      [INFO]      The file was deleted!
D:\新建文件夹\aa16.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [INFO]      The file was deleted!
D:\新建文件夹\aa17.exe
      [DETECTION] Is the Trojan horse TR/PSW.QQpass.bid
      [INFO]      The file was deleted!
D:\新建文件夹\aa18.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '48145542.qua'!
D:\新建文件夹\aa19.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '48145543.qua'!
D:\新建文件夹\aa20.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '48155543.qua'!
D:\新建文件夹\aa21.exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.ddn.2
      [INFO]      The file was deleted!
D:\新建文件夹\aa22.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agent.jue.1
      [INFO]      The file was deleted!
D:\新建文件夹\aa23.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '48155544.qua'!
D:\新建文件夹\aa24.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '48155545.qua'!
D:\新建文件夹\aa25.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGame.XO
      [INFO]      The file was deleted!
D:\新建文件夹\aa26.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ufo
      [INFO]      The file was deleted!
D:\新建文件夹\bak.css
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [INFO]      The file was deleted!
D:\新建文件夹\Baidu.cab
  [0] Archive type: CAB (Microsoft)
  --> Baidu.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [INFO]      The file was deleted!


End of the scan: 2008年3月21日  14:25
Used time: 00:31 min

The scan has been done completely.

      1 Scanning directories
     29 Files were scanned
     18 viruses and/or unwanted programs were found
     10 Files were classified as suspicious:
     18 files were deleted
      0 files were repaired
     10 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     11 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

kkgh

诺顿杀

qigang

原帖由 冷冷 于 2008-3-21 12:31 发表
有重复
只有两个
14[1].htm
htp://1.9797aiai.com/mm/mm.exe

==========
IK
I:\virus\virus.rar:\mm.exe - Signature 'Trojan-Downloader.Win32.Zlob.and' found
I:\virus\virus.rar:\ntuser.com - Signat ...

前三个重复，后三个重复，解出来的也是老东西，不更新。

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.DL.Win32.Mnless.zan
病毒： Trojan.Win32.Undef.eam   

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.36.42

28654621

6个

28654621

在文件
\LOCAL SETTINGS\TEMP\RAR$DI00.359\NTUSER.COM 中发现恶意代码。
感染: W32/Malware
操作: 无.