[病毒样本] 23x

显示全部楼层 · 发表于 2008-4-25 04:20:47

F-PROT中启发5个，高启发多8个

[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\Admin\Desktop\1\14.exe->(UPack)
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\Admin\Desktop\1\18.exe
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\Admin\Desktop\1\5.exe
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\Admin\Desktop\1\7.exe
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\Admin\Desktop\1\8.exe->(UPack)

显示全部楼层 · 发表于 2008-4-25 04:22:41

C:\Documents and Settings\Don johnson\桌面\1.zip » ZIP » 1.exe - Win32/PSW.OnLineGames.NOE trojan
C:\Documents and Settings\Don johnson\桌面\1.zip » ZIP » 10.exe - a variant of Win32/PSW.OnLineGames.NML trojan
C:\Documents and Settings\Don johnson\桌面\1.zip » ZIP » 11.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\Don johnson\桌面\1.zip » ZIP » 12.exe - a variant of Win32/PSW.OnLineGames.NML trojan
C:\Documents and Settings\Don johnson\桌面\1.zip » ZIP » 13.exe - a variant of Win32/PSW.OnLineGames.NML trojan
C:\Documents and Settings\Don johnson\桌面\1.zip » ZIP » 14.exe - Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\Don johnson\桌面\1.zip » ZIP » 15.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\Don johnson\桌面\1.zip » ZIP » 16.exe - a variant of Win32/PSW.OnLineGames.NML trojan
C:\Documents and Settings\Don johnson\桌面\1.zip » ZIP » 17.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\Don johnson\桌面\1.zip » ZIP » 18.exe - Win32/PSW.WOW.WU trojan
C:\Documents and Settings\Don johnson\桌面\1.zip » ZIP » 3.exe - a variant of Win32/PSW.OnLineGames.NML trojan
C:\Documents and Settings\Don johnson\桌面\1.zip » ZIP » 4.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\Don johnson\桌面\1.zip » ZIP » 5.exe - a variant of Win32/PSW.OnLineGames.ZJK trojan
C:\Documents and Settings\Don johnson\桌面\1.zip » ZIP » 6.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\Don johnson\桌面\1.zip » ZIP » 7.exe - a variant of Win32/PSW.OnLineGames.ZJK trojan
C:\Documents and Settings\Don johnson\桌面\1.zip » ZIP » 8.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\Don johnson\桌面\1.zip » ZIP » 9.exe - a variant of Win32/PSW.OnLineGames.NML trojan
C:\Documents and Settings\Don johnson\桌面\1.zip » ZIP » 19.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\Don johnson\桌面\1.zip » ZIP » 20.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\Don johnson\桌面\1.zip » ZIP » 21.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\Don johnson\桌面\1.zip » ZIP » 22.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\Don johnson\桌面\1.zip » ZIP » 23.exe - a variant of Win32/PSW.OnLineGames.MUG trojan

btw:solcroft介绍一个空间让我测试eset的网络启发。。。。我找到的空间都测试不了。。。

显示全部楼层 · 发表于 2008-4-25 04:24:21

www.sendspace.com

显示全部楼层 · 发表于 2008-4-25 04:27:08

国内IP打不开

显示全部楼层 · 发表于 2008-4-25 04:36:58

你要国内网盘，我就帮不上忙了

显示全部楼层 · 发表于 2008-4-25 04:46:27

谢谢了。。。。我还是自己慢慢找吧。。。

显示全部楼层 · 发表于 2008-4-25 05:18:31

22

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\1'
C:\Documents and Settings\Administrator\My Documents\1\
  1.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
      [2] Archive type: Runtime Packed
      --> Object
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
  10.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  11.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
      [2] Archive type: RSRC
      --> Object
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
  12.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  13.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  14.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
      [2] Archive type: Runtime Packed
      --> Object
         [3] Archive type: RSRC
         --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aajr
            [WARNING] Infected files in archives cannot be repaired!
   [NOTE]    The file was deleted!
  15.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
      [2] Archive type: RSRC
      --> Object
      --> Object
   [DETECTION] Is the Trojan horse TR/Rootkit.Gen
   [NOTE]    The file was deleted!
  16.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  17.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
      [2] Archive type: RSRC
      --> Object
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
  18.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
   [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
   [NOTE]    The file was deleted!
  19.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
      [2] Archive type: RSRC
      --> Object
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
  2.exe
  20.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
      [2] Archive type: RSRC
      --> Object
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
  21.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
      [2] Archive type: RSRC
      --> Object
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
  22.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
      [2] Archive type: RSRC
      --> Object
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
  23.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
      [2] Archive type: RSRC
      --> Object
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
  3.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  4.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
      [2] Archive type: RSRC
      --> Object
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
  5.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
      [2] Archive type: Runtime Packed
      --> Object
      --> Object
   [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
   [NOTE]    The file was deleted!
  6.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
      [2] Archive type: RSRC
      --> Object
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
  7.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
      [2] Archive type: Runtime Packed
      --> Object
      --> Object
   [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
   [NOTE]    The file was deleted!
  8.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
      [2] Archive type: Runtime Packed
      --> Object
         [3] Archive type: RSRC
         --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aayo
            [WARNING] Infected files in archives cannot be repaired!
   [NOTE]    The file was deleted!
  9.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!

End of the scan: 2008年4月24日  14:18
Used time: 00:06 min

The scan has been done completely.

   1 Scanning directories
   23 Files were scanned
   22 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   22 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   0 Archives were scanned
   2 Warnings
   22 Notes

显示全部楼层 · 发表于 2008-4-25 07:59:19

信息 2008-04-25  07:59:04 您此次查毒清除了21个病毒
信息 2008-04-25  07:59:04 您此次查毒共查出21个病毒以及危险代码
信息 2008-04-25  07:59:04 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件43个
信息 2008-04-25  07:59:04 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒

显示全部楼层 · 发表于 2008-4-25 10:14:28

to kl

Hello.
New malicious software was found in the attached file.
Its detection will be included in the next update. Thank you for your help.
-----------------
Regards, Vladimir Lebedev
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com http://www.viruslist.com

[:1:]

[ 本帖最后由 wangjay1980 于 2008-4-25 16:32 编辑 ]

显示全部楼层 · 发表于 2008-4-25 11:59:57

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1\3.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\TDFFDL.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1\5.EXE
是可疑程序!
试图修改关键系统文件!
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1\7.EXE
是可疑程序!
试图修改关键系统文件!
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1\23.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\JWLAH.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1\21.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\NJRITC.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1\20.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\FJYJY.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1\19.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\XGNFN.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1\18.EXE
木马程序生成以下文件:
1) C:\WINDOWS\391231M.EXE
2) C:\WINDOWS\391231MM.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1\17.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\KDUY.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1\16.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\JFRWDH.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1\13.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\HHRDXD.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1\12.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\HFRDZX.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1\11.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\GJJTE.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1\9.EXE
可疑程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\ZGXFDX.DLL
是否阻止该进程继续运行?

[病毒样本] 23x

本帖子中包含更多资源

22

回复 2楼 EQ2 的帖子

回复 3楼 solcroft 的帖子

回复 4楼 EQ2 的帖子

本帖子中包含更多资源

本帖子中包含更多资源