病毒

显示全部楼层 · 发表于 2008-4-9 00:16:29

在该网址采集到的，

样本可能不全

www.qzonex.com/html/qqmb/gx/

样本中的好多都无法检测到，可以用样本中的ctfmon.exe测试

显示全部楼层 · 发表于 2008-4-9 00:17:45

灭

E:\病毒\桌面_2.rar » RAR » 8[1].exe - a variant of Win32/PSW.QQPass.NCZ trojan
E:\病毒\桌面_2.rar » RAR » 7[1].exe - a variant of Win32/PSW.OnLineGames.NMQ trojan
E:\病毒\桌面_2.rar » RAR » 5[1].exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
E:\病毒\桌面_2.rar » RAR » 9[1].exe - probably a variant of Win32/PSW.OnLineGames.NMQ trojan
E:\病毒\桌面_2.rar » RAR » 4[1].exe - a variant of Win32/PSW.OnLineGames.NFL trojan
E:\病毒\桌面_2.rar » RAR » 1[1].exe - probably a variant of Win32/PSW.OnLineGames.NMQ trojan
E:\病毒\桌面_2.rar » RAR » ctfmon.exe - Win32/TrojanDownloader.Agent.NWV trojan

显示全部楼层 · 发表于 2008-4-9 00:20:07

木马名称:Trojan-PSW.Win32.QQPass.itr

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIR\8[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.OL-Game.btt

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIR\7[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.OL-Game.aql

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIR\5[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.OL-Game.bsy

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIR\9[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.OL-Game.bta

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIR\1[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-Downloader.Win32.Agent.qox

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIR\CTFMON.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2008-4-9 00:23:08

已删除：木马程序 Trojan-PSW.Win32.QQPass.ayr 文件: C:\Documents and Settings\Gt\桌面\桌面.rar/8[1].exe//UPX
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.zle 文件: C:\Documents and Settings\Gt\桌面\桌面.rar/7[1].exe//PE_Patch//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.yzu 文件: C:\Documents and Settings\Gt\桌面\桌面.rar/5[1].exe//PE_Patch//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.yut 文件: C:\Documents and Settings\Gt\桌面\桌面.rar/9[1].exe//PE_Patch//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.zqs 文件: C:\Documents and Settings\Gt\桌面\桌面.rar/4[1].exe//PE_Patch//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.zkz 文件: C:\Documents and Settings\Gt\桌面\桌面.rar/1[1].exe//PE_Patch//UPack
已删除：木马程序 Trojan-Downloader.Win32.Agent.mmr 文件: C:\Documents and Settings\Gt\桌面\桌面.rar/ctfmon.exe//PE_Patch//UPack

显示全部楼层 · 发表于 2008-4-9 00:43:59

2008-4-9,0:42:53 [WARNING] Is the Trojan horse TR/PSW.QQpass.boc!
  C:\Documents and Settings\Administrator\Application Data\Orca Browser\Profiles\Cache\E848CBCCd01
  Archive: RAR : 8[1].exe
2008-4-9,0:42:53 [WARNING] Is the Trojan horse TR/PSW.QQpass.boc!
  C:\Documents and Settings\Administrator\Local Settings\Temp\ija7r6ft.rar
  Archive: RAR : 8[1].exe
   [INFO] The file will be moved to quarantine.

显示全部楼层 · 发表于 2008-4-9 01:18:41

Start of the scan: 2008年4月9日  01:18

Starting the file scan:

Begin scan in 'E:\病毒\桌面_2.rar'
E:\病毒\桌面_2.rar
  [0] Archive type: RAR
  --> 8[1].exe
   [DETECTION] Is the Trojan horse TR/PSW.QQpass.boc
  --> 7[1].exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.zle
  --> 5[1].exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.zdl
  --> 9[1].exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.yrq
  --> 4[1].exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 1[1].exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.zkf
  --> ctfmon.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.mmr
   [WARNING] The file was ignored!

End of the scan: 2008年4月9日  01:18
Used time: 00:08 min

The scan has been done completely.

   0 Scanning directories
   8 Files were scanned
   7 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   1 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-4-9 02:29:23

Virus: Trojan-PSW.Win32.QQPass.ayr, Trojan-PSW.Win32.OnLineGames.zle

显示全部楼层 · 发表于 2008-4-9 13:00:51

[发现安全风险? <W32/AutoRun.D.gen!Eldorado (not disinfectable, 普通)> C:\Documents and Settings\Administrator\My Documents\桌面.rar->8[1].exe->(UPX)
[发现安全风险? <W32/Agent.L.gen!Eldorado (not disinfectable, 普通)> C:\Documents and Settings\Administrator\My Documents\桌面.rar->7[1].exe->(embedded)
[发现安全风险? <W32/Agent.L.gen!Eldorado (not disinfectable, 普通)> C:\Documents and Settings\Administrator\My Documents\桌面.rar->5[1].exe->(UPack)
[发现安全风险? <W32/Agent.L.gen!Eldorado (not disinfectable, 普通)> C:\Documents and Settings\Administrator\My Documents\桌面.rar->9[1].exe->(embedded)
[发现安全风险? <W32/Agent.L.gen!Eldorado (not disinfectable, 普通)> C:\Documents and Settings\Administrator\My Documents\桌面.rar->4[1].exe
[发现安全风险? <W32/Agent.L.gen!Eldorado (not disinfectable, 普通)> C:\Documents and Settings\Administrator\My Documents\桌面.rar->1[1].exe->(embedded)
[发现可能为病禲: <W32/Downloader-Sml-based!Maximus (not disinfectable)> C:\Documents and Settings\Administrator\My Documents\桌面.rar->ctfmon.exe->(UPack)
[包含被传染的对象] C:\Documents and Settings\Administrator\My Documents\桌面.rar
[已隔离] C:\Documents and Settings\Administrator\My Documents\桌面.rar->ctfmon.exe->(UPack)

显示全部楼层 · 发表于 2008-4-9 13:02:18

E:\VIRUS\桌面4.9.rar: PUA.Packed.UPack-3 FOUND

显示全部楼层 · 发表于 2008-4-9 13:12:36

C:\Documents and Settings\Administrator\桌面\桌面.rar>>1[1].exe Trojan.Cap8466.oclb 木马还未处理
C:\Documents and Settings\Administrator\桌面\桌面.rar>>4[1].exe TrojanPSW.OnLineGames.aaxx.hpyx 木马还未处理
C:\Documents and Settings\Administrator\桌面\桌面.rar>>5[1].exe TrojanPSW.OnLineGames.rri.fccq 木马还未处理
C:\Documents and Settings\Administrator\桌面\桌面.rar>>7[1].exe Trojan.Cap8466.lixl 木马还未处理
C:\Documents and Settings\Administrator\桌面\桌面.rar>>8[1].exe Trojan.Gampass.idny 木马还未处理
C:\Documents and Settings\Administrator\桌面\桌面.rar>>9[1].exe TrojanPSW.OnLineGames.rri.fccq 木马还未处理
C:\Documents and Settings\Administrator\桌面\桌面.rar>>ctfmon.exe TrojanDownloader.Agent.mmr.ebtl 木马还未处理

[病毒样本] 病毒

本帖子中包含更多资源

7