12 个

显示全部楼层 · 发表于 2008-4-2 22:09:52

包包里面xls是exploit 不过class那个不确认

显示全部楼层 · 发表于 2008-4-2 22:14:44

Starting the file scan:

Begin scan in 'E:\pack.rar'
E:\pack.rar
  [0] Archive type: RAR
  --> xloader.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.bfj.7
  --> xls10077.xls
   [DETECTION] Contains detection pattern of the exploits EXP/Excel.CVE-2008-0081
  --> 014s.exe
   [DETECTION] Contains detection pattern of the rootkit RKIT/HideProcess.B
  --> ff11.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.odq
  --> H.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> install
   [DETECTION] Contains detection pattern of the dropper DR/Agent.AGHH
  --> photo.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Small.iwn.5
  --> pps.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Delf.epw.1
  --> QBchongzhi2.5.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> server.exe
   [DETECTION] Contains detection pattern of the dropper DR/Inject.alx
  --> svcoss.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [INFO]    The file was deleted!

End of the scan: 2008年4月2日  22:16
Used time: 00:29 min

The scan has been done completely.

   0 Scanning directories
   13 Files were scanned
   9 viruses and/or unwanted programs were found
   2 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   4 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-4-2 22:16:44

C:\Documents and Settings\Don johnson\桌面\pack.rar » RAR » xloader.exe - Win32/TrojanDownloader.Agent.NTB trojan
C:\Documents and Settings\Don johnson\桌面\pack.rar » RAR » 014s.exe - Win32/TrojanDownloader.Agent.NWE trojan
C:\Documents and Settings\Don johnson\桌面\pack.rar » RAR » animan.class - Java/TrojanDownloader.OpenStream.NAC trojan
C:\Documents and Settings\Don johnson\桌面\pack.rar » RAR » ff11.exe - Win32/PSW.OnLineGames.ODQ trojan
C:\Documents and Settings\Don johnson\桌面\pack.rar » RAR » H.exe - Win32/Pacex.Gen virus
C:\Documents and Settings\Don johnson\桌面\pack.rar » RAR » photo.exe - Win32/Wigon trojan
C:\Documents and Settings\Don johnson\桌面\pack.rar » RAR » pps.exe - Win32/TrojanDownloader.Delf.OBY trojan
C:\Documents and Settings\Don johnson\桌面\pack.rar » RAR » QBchongzhi2.5.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\pack.rar » RAR » server.exe » CAB » f1.exe - Win32/PSW.OnLineGames.WMZ trojan
C:\Documents and Settings\Don johnson\桌面\pack.rar » RAR » svcoss.exe - a variant of Win32/Jalous worm

显示全部楼层 · 发表于 2008-4-2 22:18:14

TO KL

显示全部楼层 · 发表于 2008-4-2 22:19:03

QBchongzhi2.5.exe 25.38 KB UNDER ANALYSIS
animan.class 827 Byte CLEAN

显示全部楼层 · 发表于 2008-4-2 22:20:26

[Found downloader] <W32/Downldr2.AJBE (exact, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\pack.rar->xloader.exe
[Found possible security risk] <W32/Heuristic-114!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\pack.rar->014s.exe->(NSPack)->(PE_Patch)
[Found password stealer] <W32/Pws.AEZU (exact, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\pack.rar->ff11.exe
[Found possible virus] <W32/PWStealer3!Generic (not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\pack.rar->H.exe
[Found downloader] <W32/Banload.B.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\pack.rar->pps.exe->(NSPack)->(PE_Patch)

---------------------------------------------------------------------
Scan ended: 2008-4-2, 22:20:23
Duration: 0:00:08

Scan result:

Scanned files:    6
Infected objects:    5
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

显示全部楼层 · 发表于 2008-4-2 22:20:54

[Scanning : C:\Documents and Settings\All Users\Documents\Test]

C:\Documents and Settings\All Users\Documents\Test\pack.rar<RAR>:xloader.exe<UPX>:xloader.exe <- Downloader.Agent.Bfj : No action
C:\Documents and Settings\All Users\Documents\Test\pack.rar<RAR>:xloader.exe<UPX>:xloader.exe<DLLRES>:file0.exe <- Variant:Downloader.Agent.Bfj : No action
C:\Documents and Settings\All Users\Documents\Test\pack.rar<RAR>:xloader.exe<UPX>:xloader.exe<DLLRES>:file0.exe<UPX>:file0.exe <- Downloader.Agent.Bfj : No action
C:\Documents and Settings\All Users\Documents\Test\pack.rar<RAR>:014s.exe <- Trojan.Downloader.Small.Suu : No action
C:\Documents and Settings\All Users\Documents\Test\pack.rar<RAR>:install<UPX>:install <- Trojan.Dropper.Small.Bdf : No action
C:\Documents and Settings\All Users\Documents\Test\pack.rar<RAR>:photo.exe <- Trojan.Downloader.Small.Iwn : No action
C:\Documents and Settings\All Users\Documents\Test\pack.rar<RAR>:pps.exe <- Downloader.Delf.Epw : No action
C:\Documents and Settings\All Users\Documents\Test\pack.rar<RAR>:QBchongzhi2.5.exe<UPack>:QBchongzhi2.5.exe<DLLRES>:DLLFILE0.exe <- Trojan.Psw.Qqpass.Bme : No action
C:\Documents and Settings\All Users\Documents\Test\pack.rar<RAR>:server.exe<DLLRES>:CABINET0.cab<CAB>:t1.exe <- Trojan.Inject.Alx : No action
C:\Documents and Settings\All Users\Documents\Test\pack.rar<RAR>:server.exe<DLLRES>:CABINET0.cab<CAB>:f1.exe <- Trojan.Psw.Onlinegames.Wmz : No action
C:\Documents and Settings\All Users\Documents\Test\pack.rar<RAR>:server.exe<DLLRES>:CABINET0.cab<CAB>:f1.exe<UPack>:f1.exe <- Trojan.Psw.Onlinegames.Wmz : No action
C:\Documents and Settings\All Users\Documents\Test\pack.rar<RAR>:server.exe<DLLRES>:CABINET0.cab<CAB>:f1.exe<UPack>:f1.exe<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Wna : No action
C:\Documents and Settings\All Users\Documents\Test\pack.rar<RAR>:svcoss.exe<UPack>:svcoss.exe <- Heur.RoundKick : No action

Scanned objects : 27

Infected objects : 13

显示全部楼层 · 发表于 2008-4-2 22:21:52

信息 2008-04-02  22:16:41 您此次查毒清除了8个病毒
信息 2008-04-02  22:16:41 您此次查毒共查出8个病毒以及危险代码
信息 2008-04-02  22:16:41 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件19个
信息 2008-04-02  22:16:41 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
病毒 2008-04-02  22:16:41 D:\Desktop\pack.rar\svcoss.exe Win32.Troj.DwonLoaderT.xy.133203 清除成功
病毒 2008-04-02  22:16:40 D:\Desktop\pack.rar\QBchongzhi2.5.exe Win32.Troj.QQPassT.ex.73216 清除成功
病毒 2008-04-02  22:16:40 D:\Desktop\pack.rar\pps.exe Win32.TrojDownloader.Delf.43008 清除成功
病毒 2008-04-02  22:16:40 D:\Desktop\pack.rar\photo.exe Win32.Troj.AgentT.eg.37376 清除成功
病毒 2008-04-02  22:16:40 D:\Desktop\pack.rar\H.exe Win32.Hack.NSAnti.ge 清除成功
病毒 2008-04-02  22:16:40 D:\Desktop\pack.rar\ff11.exe Win32.PSWTroj.OnLineGames.69632 清除成功
病毒 2008-04-02  22:16:40 D:\Desktop\pack.rar\014s.exe Win32.Troj.AiT.dg.2564 清除成功
病毒 2008-04-02  22:16:40 D:\Desktop\pack.rar\xloader.exe Win32.TrojDownloader.Agent.98304 清除成功

显示全部楼层 · 发表于 2008-4-2 22:25:02

这次我慢慢细看

最后结论:11个

显示全部楼层 · 发表于 2008-4-2 22:28:29

[Found downloader] <W32/Downldr2.AJBE (exact, not disinfectable)> C:\test\pack.rar->xloader.exe
[Found possible security risk] <W32/Heuristic-114!Eldorado (damaged, not disinfectable)> C:\test\pack.rar->014s.exe->(NSPack)->(PE_Patch)
[Found password stealer] <W32/Pws.AEZU (exact, not disinfectable)> C:\test\pack.rar->ff11.exe
[Found possible virus] <W32/PWStealer3!Generic (not disinfectable)> C:\test\pack.rar->H.exe
[Found downloader] <W32/Banload.B.gen!Eldorado (not disinfectable, generic)> C:\test\pack.rar->pps.exe->(NSPack)->(PE_Patch)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\pack.rar->QBchongzhi2.5.exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\pack.rar->svcoss.exe->(UPack)

[病毒样本] 12 个

本帖子中包含更多资源

11

本帖子中包含更多资源

本帖子中包含更多资源

7