[病毒样本] 39

显示全部楼层 · 发表于 2008-4-9 21:43:46

已解毒: 病毒 Virus.Win32.Agent.bd 檔案: C:\Documents and Settings\kato9096\桌面\wrar371sc_-0925\wrar371sc_-0925.exe
已刪除: 病毒 Worm.Win32.Downloader.hp 檔案: C:\Documents and Settings\kato9096\桌面\wrar371sc_-0925\bingdu\explorer.exe
已刪除: 病毒 Worm.Win32.Downloader.hp 檔案: C:\Documents and Settings\kato9096\桌面\wrar371sc_-0925\病毒20080408\explorer.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.zma 檔案: C:\Documents and Settings\kato9096\桌面\wrar371sc_-0925\病毒20080408\ttHADHAD1060.dll//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.zfe 檔案: C:\Documents and Settings\kato9096\桌面\wrar371sc_-0925\病毒20080408\ttHADHAD1060.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.zmb 檔案: C:\Documents and Settings\kato9096\桌面\wrar371sc_-0925\病毒20080408\ttSADSAD1033.dll//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.zfe 檔案: C:\Documents and Settings\kato9096\桌面\wrar371sc_-0925\病毒20080408\ttSADSAD1033.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.zkq 檔案: C:\Documents and Settings\kato9096\桌面\wrar371sc_-0925\病毒20080408\txTQLTQL1037.dll//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.zkr 檔案: C:\Documents and Settings\kato9096\桌面\wrar371sc_-0925\病毒20080408\txTQLTQL1037.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Backdoor.Win32.Small.cla 檔案: C:\Documents and Settings\kato9096\桌面\wrar371sc_-0925\病毒20080408\winxsx0.exe//PE_Patch//PE-Armor

不报上报卡巴

atielf.dat, BalloonTip.exe_, bjrvm.cfg, cdxbfxdb.cfg, crugd.cfg, d2b282ef026d76593.bat_, d2b282ef026d80140.bat_, dnteh.cfg, ektvm.cfg, fehom.cfg, fjnbv.cfg, gjkhj.cfg, gmnait.cfg, hfjg.cfg, hjaiq.cfg, ijatnaw.cfg, jwlah.cfg, jyjlt.cfg, oqrthc.cfg, rdthr.cfg, rhs.cfg, SetInfo.txt, SVCH0ST.exe_, userinit.exe_, wf.dll, wpa.dbl, xgnfn.cfg, ydgn.cfg

No malicious code were found in these files.

[ 本帖最后由 kato9096 于 2008-4-11 19:29 编辑 ]

显示全部楼层 · 发表于 2008-4-9 21:46:16

信息 2008-04-09  21:46:12 您此次查毒清除了11个病毒
信息 2008-04-09  21:46:12 您此次查毒共查出11个病毒以及危险代码
信息 2008-04-09  21:46:12 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件50个
信息 2008-04-09  21:46:12 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
病毒 2008-04-09  21:46:12 D:\Desktop\3\3\wrar371sc_-0925.rar\wrar371sc_-0925.exe Win32.WYCao.a.15652 清除成功
病毒 2008-04-09  21:46:11 D:\Desktop\3\3\bingdu.rar\bingdu\explorer.exe Worm.Downloader.hf.243472 清除成功
病毒 2008-04-09  21:46:11 D:\Desktop\3\3\20080408.rar\病毒20080408\winxsx0.exe Win32.Hack.Small.344064 清除成功
病毒 2008-04-09  21:46:11 D:\Desktop\3\3\20080408.rar\病毒20080408\txTQLTQL1037.exe Win32.Troj.OnlineGameT.zp.57344 清除成功
病毒 2008-04-09  21:46:11 D:\Desktop\3\3\20080408.rar\病毒20080408\txTQLTQL1037.dll Win32.Troj.OnlineGameT.pb.73728 清除成功
病毒 2008-04-09  21:46:11 D:\Desktop\3\3\20080408.rar\病毒20080408\ttSADSAD1033.exe Win32.Troj.OnlineGameT.pq.57344 清除成功
病毒 2008-04-09  21:46:11 D:\Desktop\3\3\20080408.rar\病毒20080408\ttSADSAD1033.dll Win32.Troj.OnlineGameT.pb.73728 清除成功
病毒 2008-04-09  21:46:11 D:\Desktop\3\3\20080408.rar\病毒20080408\ttHADHAD1060.exe Win32.Troj.OnlineGameT.pq.57344 清除成功
病毒 2008-04-09  21:46:11 D:\Desktop\3\3\20080408.rar\病毒20080408\ttHADHAD1060.dll Win32.Troj.OnlineGameT.pb.73728 清除成功
病毒 2008-04-09  21:46:11 D:\Desktop\3\3\20080408.rar\病毒20080408\mseion.sys Win32.Hack.Mnless.jz.8320 清除成功
病毒 2008-04-09  21:46:10 D:\Desktop\3\3\20080408.rar\病毒20080408\explorer.exe Worm.Downloader.hf.243472 清除成功

显示全部楼层 · 发表于 2008-4-9 21:51:01

内有三包。

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： RootKit.Win32.Mnless.jz
病毒： Trojan.PSW.Win32.GameOL.mfr
病毒： Backdoor.Win32.Jusi.ev
病毒： Win32.WYC.a

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.39.22

显示全部楼层 · 发表于 2008-4-9 21:55:45

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\3'
C:\Documents and Settings\Administrator\桌面\3\3\20080408.rar
  [0] Archive type: RAR
  --> ²¡¶¾20080408\BalloonTip.exe
   [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/FSG). Please verify the origin of the file
  --> ²¡¶¾20080408\explorer.exe
   [DETECTION] Is the Trojan horse TR/Sorri.O
  --> ²¡¶¾20080408\mseion.sys
   [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> ²¡¶¾20080408\ttHADHAD1060.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.zma.1
  --> ²¡¶¾20080408\ttHADHAD1060.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.zma.1
  --> ²¡¶¾20080408\ttSADSAD1033.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.zmb
  --> ²¡¶¾20080408\ttSADSAD1033.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.zmb
  --> ²¡¶¾20080408\txTQLTQL1037.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.zkq
  --> ²¡¶¾20080408\txTQLTQL1037.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.zkr
  --> ²¡¶¾20080408\winxsx0.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\3\3\bingdu.rar
  [0] Archive type: RAR
  --> bingdu\explorer.exe
   [DETECTION] Contains detection pattern of the worm WORM/Downloader.HP.1
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\3\3\wrar371sc_-0925.rar
  [0] Archive type: RAR
  --> wrar371sc_-0925.exe
   [DETECTION] Is the Trojan horse TR/Agent.BD.5
   [INFO]    The file was deleted!

End of the scan: 星期三 2008年4月9日  21:54
Used time: 00:11 min

The scan has been done completely.

   2 Scanning directories
   42 Files were scanned
   12 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   3 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   30 Files not concerned
   3 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-4-9 21:59:44

[Found password stealer] <W32/Pws.ACWR (exact, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\3.part1.rar->3\20080408.rar->病毒20080408\mseion.sys
[Found possible security risk] <W32/Heuristic-114!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\3.part1.rar->3\20080408.rar->病毒20080408\ttHADHAD1060.exe->(UPack)
[Found possible security risk] <W32/Heuristic-114!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\3.part1.rar->3\20080408.rar->病毒20080408\ttSADSAD1033.exe->(UPack)
[Found possible security risk] <W32/Heuristic-114!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\3.part1.rar->3\20080408.rar->病毒20080408\txTQLTQL1037.exe->(UPack)
[Found backdoor] <W32/Backdoor2.AALB (exact, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\3.part1.rar->3\20080408.rar->病毒20080408\winxsx0.exe

---------------------------------------------------------------------
Scan ended: 2008-4-9, 21:59:36
Duration: 0:00:03

Scan result:

Scanned files:    8
Infected objects:    5
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

显示全部楼层 · 发表于 2008-4-9 22:00:22

[Scanning : C:\Documents and Settings\All Users\Documents\Test]

C:\Documents and Settings\All Users\Documents\Test\3.part1.rar<RAR>:20080408.rar<RAR>:explorer.exe <- Variant:Trojan.Agent.Fb : No action
C:\Documents and Settings\All Users\Documents\Test\3.part1.rar<RAR>:20080408.rar<RAR>:mseion.sys <- Trojan.Psw.Onlinegames.Yjk : No action
C:\Documents and Settings\All Users\Documents\Test\3.part1.rar<RAR>:20080408.rar<RAR>:ttSADSAD1033.dll <- Trojan.Psw.Onlinegames.Zmb : No action
C:\Documents and Settings\All Users\Documents\Test\3.part1.rar<RAR>:20080408.rar<RAR>:txTQLTQL1037.exe <- Trojan.Psw.Onlinegames.Zkr : No action
C:\Documents and Settings\All Users\Documents\Test\3.part1.rar<RAR>:20080408.rar<RAR>:winxsx0.exe <- Trojan.Small.Cla : No action
C:\Documents and Settings\All Users\Documents\Test\3.part1.rar<RAR>:bingdu.rar<RAR>:explorer.exe <- Variant:Trojan.Agent.Fb : No action

Scanned objects : 49

Infected objects : 6

显示全部楼层 · 发表于 2008-4-9 22:00:24

[Found password stealer] <W32/Pws.ACWR (exact, not disinfectable)> C:\test\3\20080408.rar->病毒20080408\mseion.sys
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\3\20080408.rar->病毒20080408\ttHADHAD1060.dll->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\3\20080408.rar->病毒20080408\ttHADHAD1060.exe->exefile->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\3\20080408.rar->病毒20080408\ttSADSAD1033.dll->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\3\20080408.rar->病毒20080408\ttSADSAD1033.exe->exefile->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\3\20080408.rar->病毒20080408\txTQLTQL1037.dll->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\3\20080408.rar->病毒20080408\txTQLTQL1037.exe->exefile->(UPack)
[Found backdoor] <W32/Backdoor2.AALB (exact, not disinfectable)> C:\test\3\20080408.rar->病毒20080408\winxsx0.exe

显示全部楼层 · 发表于 2008-4-9 22:02:46

刨除垃圾文件，还有两个可疑文件

显示全部楼层 · 发表于 2008-4-9 22:03:43

C:\Documents and Settings\Don johnson\桌面\3\3\20080408.rar » RAR » 病毒20080408\explorer.exe - probably unknown NewHeur_PE virus
C:\Documents and Settings\Don johnson\桌面\3\3\20080408.rar » RAR » 病毒20080408\mseion.sys - Win32/PSW.OnLineGames.NFC trojan
C:\Documents and Settings\Don johnson\桌面\3\3\20080408.rar » RAR » 病毒20080408\ttHADHAD1060.dll - a variant of Win32/PSW.OnLineGames.PBQ trojan
C:\Documents and Settings\Don johnson\桌面\3\3\20080408.rar » RAR » 病毒20080408\ttHADHAD1060.exe - a variant of Win32/PSW.OnLineGames.PBQ trojan
C:\Documents and Settings\Don johnson\桌面\3\3\20080408.rar » RAR » 病毒20080408\ttSADSAD1033.dll - a variant of Win32/PSW.OnLineGames.PBQ trojan
C:\Documents and Settings\Don johnson\桌面\3\3\20080408.rar » RAR » 病毒20080408\ttSADSAD1033.exe - a variant of Win32/PSW.OnLineGames.PBQ trojan
C:\Documents and Settings\Don johnson\桌面\3\3\20080408.rar » RAR » 病毒20080408\txTQLTQL1037.dll - a variant of Win32/PSW.OnLineGames.PBQ trojan
C:\Documents and Settings\Don johnson\桌面\3\3\20080408.rar » RAR » 病毒20080408\txTQLTQL1037.exe - a variant of Win32/PSW.OnLineGames.PBQ trojan
C:\Documents and Settings\Don johnson\桌面\3\3\bingdu.rar » RAR » bingdu\explorer.exe - probably unknown NewHeur_PE virus
C:\Documents and Settings\Don johnson\桌面\3\3\wrar371sc_-0925.rar » RAR » wrar371sc_-0925.exe - probably a variant of Win32/Genetik trojan

显示全部楼层 · 发表于 2008-4-9 22:04:54

http://122.224.5.16/xin/1.exe
.
.
.
.

http://122.224.5.16/xin/25.exe

[病毒样本] 39

本帖子中包含更多资源

50/6

请筛选一下，有些一看就不是病毒。

10