[病毒样本] 26

显示全部楼层 · 发表于 2008-4-13 21:37:59

抢个沙发
-----------------------------SCAN REPORT-----------------------------
F-PROT Antivirus for Windows

Antivirus Scanning Engine version number: 4.4.2
Virus signature file from: 2008-4-13, 8:21

Scan name: Virus Tester
Path to scan: C:\Documents and Settings\All Users\Documents\Test\|

Normal scan
Also scan: Inside subfolders, Compressed files, Streams

Scan started: 2008-4-13, 21:38:50
---------------------------------------------------------------------
[Found Trojan]    <W32/Srizbi.A (exact, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar->my_fotos.exe
[Found downloader]    <W32/Downloader.I.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar->s.exe->(UPack)
[Found security risk]    <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar->server1.exe->(embedded)->(UPack)
[Found security risk]    <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar->server.exe
[Found virus]    <W32/AutoRun.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar->ss.exe
[Found backdoor]    <W32/Rbot.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar->w3.exe
[Found Trojan]    <W32/Trojan2.AHSM (exact, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar->yeSetup.exe
[Found possible virus]    <W32/Downloader-WebExe-based!Maximus (not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar->photos.pif
[Found possible virus]    <W32/NewUnknownMalware-P149!Maximus (not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar->4.exe->(UPack)
[Found possible security risk]    <W32/Heuristic-224!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar->0014.exe->(UPack)
[Found backdoor]    <W32/Backdoor2.FOX (exact, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar->0276.exe
[Found virus]    <W32/Downloader.gen10 (not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar->1221.exe->(UPack)->(PE_Patch.MaskPE)
[Found possible virus]    <W32/SecRisk-ProcessPatcher-Sml-based!Maximus (not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar->20080119.exe->(XComp)
[Found possible virus]    <W32/NewMalware-LSU-based!Maximus (not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar->alexa240.exe

---------------------------------------------------------------------
Scan ended: 2008-4-13, 21:39:04
Duration: 0:00:14

Scan result:

Scanned files:       7
Infected objects:    14
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

[ 本帖最后由 allinwonderi 于 2008-4-13 21:39 编辑 ]

显示全部楼层 · 发表于 2008-4-13 21:39:41

信息 2008-04-13  21:39:35 您此次查毒隔离了12个文件
信息 2008-04-13  21:39:35 您此次查毒共查出12个病毒以及危险代码
信息 2008-04-13  21:39:35 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件44个
信息 2008-04-13  21:39:35 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒

显示全部楼层 · 发表于 2008-4-13 21:39:44

[Scanning : C:\Documents and Settings\All Users\Documents\Test]

C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar<RAR>:my_fotos.exe <- Trojan.Srizbi.S : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar<RAR>:s09.exe<NSIS>:pciloader.exe <- Adware.Bho.Ms : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar<RAR>:s09.exe<NSIS>:pciloader.exe<DLLRES>:Q7550.exe <- Downloader.Qqhelper.Bbl : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar<RAR>:s09.exe<NSIS>:d03.exe<NSIS>:cpush.dll <- Adware.Bho.Agy : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar<RAR>:server.exe <- Trojan.Downloader.Small.Uig : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar<RAR>:server.exe<UPack>:server.exe<DLLRES>:res1.exe<UPack>:res1.exe <- Variant:Trojan.Psw.Gamec.J : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar<RAR>:ss.exe<UPX>:ss.exe <- Trojan.Psw.Onlinegames.Lpg : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar<RAR>:ss.exe<UPX>:ss.exe<DLLRES>:DATAINFO0.exe <- Variant:Trojan.Psw.Onlinegames.Lpg : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar<RAR>:w3.exe<UPack>:w3.exe <- Variant:Trojan.Agent.Fb : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar<RAR>:yeSetup.exe<ASPack>:yeSetup.exe <- Trojan.Delf.Bgw : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar<RAR>:photos.pif <- Trojan.Spy.Bancos.Ar : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar<RAR>:4.exe <- Worm.Autorun.Dgj : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar<RAR>:4.exe<UPack>:4.exe <- Heur.RoundKick : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar<RAR>:0014.exe <- Trojan.Downloader.Agent.Mtz : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar<RAR>:0276.exe<PECompact2>:0276.exe <- Downloader.Delf.Djy : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar<RAR>:286.exe<NSIS>:301.exe<NSIS>:nop.exe <- Trojan.Agent.Ilk : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar<RAR>:614.exe <- Trojan.Psw.Onlinegames.Ppu : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar<RAR>:614.exe<UPack>:614.exe <- Trojan.Psw.Onlinegames.Ppu : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar<RAR>:614.exe<UPack>:614.exe<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Ppu : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar<RAR>:614.exe<UPack>:614.exe<DLLRES>:res1.exe <- Downloader.Small.Hzk : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar<RAR>:33554389.exe <- Variant:Trojan.Dropper.Agent.Dtc : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar<RAR>:ad4254.exe<NSIS>:cpush.dll <- Adware.Bho.Anv : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar<RAR>:ad4255.exe<NSIS>:cpush.dll <- Adware.Bho.Anv : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar<RAR>:admin6_ver0111.exe <- Trojan.Psw.Wow.Aso : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part1.rar<RAR>:alexa240.exe<UPX>:alexa240.exe <- Trojan.Psw.Lmir.Qu : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part2.rar<RAR>:dodolook133.exe<NSIS>:170.exe<NSIS>:acpidisk.sys <- Adware.Cinmus.Cpo : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part2.rar<RAR>:dodolook591.exe<NSIS>:90.exe<NSIS>:DoSSSetup.dll <- Adware.Cinmus.Eex : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part2.rar<RAR>:dodolook591.exe<NSIS>:90.exe<NSIS>:acpidisk.sys <- Adware.Cinmus.Eew : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part2.rar<RAR>:lese.exe <- Trojan.Downloader.Banload.Khq : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part2.rar<RAR>:lese.exe<FSG>:lese.exe<DLLRES>:MYDLL0.exe <- Trojan.Ceckno.Aee : No action
C:\Documents and Settings\All Users\Documents\Test\MD_4_13_B.part2.rar<RAR>:lese.exe<FSG>:lese.exe<DLLRES>:KEY1.exe <- Trojan.Ceckno.Ael : No action

Scanned objects : 93

Infected objects : 31

显示全部楼层 · 发表于 2008-4-13 22:02:07

K

Hello,

1221.exe_ - Trojan-PSW.Win32.QQPass.bqf,
20080119.exe_ - Backdoor.Win32.Ceckno.aji

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

33554389.exe_ - not-a-virus:AdWare.Win32.Zhongsou.w

This file is an Advertizing Tool, It's detection will be included in the next
update of extended databases set. See more info about
extended databases here: http://www.kaspersky.com/extraavupdates

Please quote all when answering.

--
Best regards, Yury Nesmachny
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

> Attachment: MD_4_13_B.zip

[ 本帖最后由 wangjay1980 于 2008-4-13 23:35 编辑 ]

显示全部楼层 · 发表于 2008-4-13 22:02:07

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Backdoor.Win32.Remote.c
病毒： Backdoor.Win32.Agent.zdr
病毒： Packer.Win32.Xcomp.a
病毒： Win32.Logogo.z
病毒： Trojan.PSW.Win32.OnlineGames.GEN
病毒： Worm.QQDown.a
病毒： Packer.Win32.Upack.a
病毒： Trojan.PSW.Win32.OnlineGames.dfd
病毒： Trojan.DL.Win32.Mnless.zeg

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.39.62

显示全部楼层 · 发表于 2008-4-13 22:11:45

驱逐舰

显示全部楼层 · 发表于 2008-4-13 22:21:56

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\新資料夾 (2)'
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\0014.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [INFO]    A backup was created as '48331722.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\0276.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Delf.djy.1
   [INFO]    A backup was created as '48391724.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\1221.exe
   [DETECTION] Is the Trojan horse TR/Spy.Delf.ajo
   [INFO]    A backup was created as '48341724.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\20080119.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [INFO]    A backup was created as '48321722.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\286.exe
   [DETECTION] Contains detection pattern of the dropper DR/Agent.ilk.10
   [INFO]    A backup was created as '4838172a.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\4.exe
   [DETECTION] Contains detection pattern of the Windows virus W32/Autorun.BK
   [INFO]    A backup was created as '48671720.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\614.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppu
   [INFO]    A backup was created as '48361723.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\ad4254.exe
   [DETECTION] Contains detection pattern of the dropper DR/BHO.anv.1
   [INFO]    A backup was created as '48361756.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\admin6_ver0111.exe
   [DETECTION] Is the Trojan horse TR/PSW.Wow.aso
   [INFO]    A backup was created as '486f1756.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\alexa240.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
   [INFO]    A backup was created as '4867175e.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\dodolook133.exe
   [DETECTION] Contains detection pattern of the dropper DR/Cinmus.cpo
   [INFO]    A backup was created as '48661761.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\dodolook591.exe
   [DETECTION] Contains detection pattern of the dropper DR/Cinmus.eex
   [INFO]    A backup was created as '49c49a8a.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\lese.exe
   [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
   [INFO]    A backup was created as '48751757.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\my_fotos.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [INFO]    A backup was created as '4861176b.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\photos.pif
   [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
   [INFO]    A backup was created as '4871175a.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\s.exe
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    The file was moved to '49c59ac9.qua'!
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\s09.exe
   [DETECTION] Contains detection pattern of the dropper DR/BHO.Aim.10
   [INFO]    A backup was created as '483b1722.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\server.exe
   [DETECTION] Is the Trojan horse TR/Agent.eok
   [INFO]    A backup was created as '48741757.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\server1.exe
   [DETECTION] Is the Trojan horse TR/PSW.Online.ddn.2
   [INFO]    A backup was created as '49d69ab0.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\ss.exe
   [DETECTION] Is the Trojan horse TR/Autorun.BK
   [INFO]    A backup was created as '48301765.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\StormCodec.exe
   [DETECTION] Contains detection pattern of the worm WORM/Zhelatin.AP
   [INFO]    A backup was created as '48711766.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\w3.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [INFO]    A backup was created as '48301725.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\yeSetup.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
   [INFO]    A backup was created as '48551757.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2008-4-13 22:25:41

不错了，比以前好多了

显示全部楼层 · 发表于 2008-4-13 22:30:02

3817506    33554389.exe    369.4 KB    UNDER ANALYSIS
3817657    ad4255.exe    127.13 KB    UNDER ANALYSIS
3817241    ASE_Setup_Free.exe    445 KB    UNDER ANALYSIS
3817263    s.exe    1.44 KB    UNDER ANALYSIS

[病毒样本] 26

本帖子中包含更多资源

本帖子中包含更多资源

82/14

本帖子中包含更多资源

ESET报23

本帖子中包含更多资源