[病毒样本] 24

显示全部楼层 · 发表于 2008-4-28 17:09:19

Scanned file: 1..rar - Infected
1..rar/np29.tmp - OK
1..rar/tem14.tmp - OK
1..rar/tmp2B.tmp - infected by Trojan-Downloader.Win32.Small.hzk
1..rar/tmp2C.tmp - infected by Trojan-Downloader.Win32.Small.hzk
1..rar/tmp2D.tmp - infected by Trojan-Downloader.Win32.Small.hzk
1..rar/tmp2E.tmp - infected by Trojan-Downloader.Win32.Small.hzk
1..rar/tmp3F.tmp - OK
1..rar/tmp4D.tmp - infected by Trojan-PSW.Win32.QQPass.bsi
1..rar/tmp5A.tmp - infected by Trojan-PSW.Win32.OnLineGames.ppu
1..rar/tmp5B.tmp - infected by Trojan-Downloader.Win32.Small.hzk
1..rar/tmp5C.tmp - infected by Trojan-Downloader.Win32.Small.hzk
1..rar/tmp5D.tmp - infected by Trojan-PSW.Win32.OnLineGames.ppu
1..rar/tmp31.tmp - infected by Trojan-PSW.Win32.OnLineGames.ppu
1..rar/tmp37.tmp - OK
1..rar/tmp52.tmp - OK
1..rar/tmp53.tmp - OK
1..rar/tmp54.tmp - OK
1..rar/tmp56.tmp - infected by Trojan.Win32.Qhost.ajz
1..rar/tmp58.tmp - infected by Trojan-Downloader.Win32.Small.hzk
1..rar/tmp59.tmp - infected by Trojan-Downloader.Win32.Small.hzk
1..rar/upload.dll - OK

Scanned file: 2..rar
2..rar/np27.tmp - OK
2..rar/np28.tmp - OK

不报的己上报卡巴

Hello,

AutoRun.inf, DeepFrz.sys, np27.tmp_, np28.tmp_, np29.tmp_, tem14.tmp_, tmp37.tmp_, tmp3F.tmp_, tmp52.tmp_, tmp53.tmp_, tmp54.tmp_, upload.dll, Ying-UnInstall.exe_

No malicious code were found in these files.

Please quote all when answering.

--
Best regards, Yury Nesmachny
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

[ 本帖最后由 kato9096 于 2008-4-29 15:11 编辑 ]

显示全部楼层 · 发表于 2008-4-28 17:11:33

Starting the file scan:

Begin scan in 'E:\AV\新建文件夹\2'
E:\AV\新建文件夹\2\tmp2B.tmp
   [DETECTION] Is the Trojan horse TR/Agent.8192.224
   [NOTE]    The file was deleted!
E:\AV\新建文件夹\2\tmp2C.tmp
   [DETECTION] Is the Trojan horse TR/Agent.8192.224
   [NOTE]    The file was deleted!
E:\AV\新建文件夹\2\tmp2D.tmp
   [DETECTION] Is the Trojan horse TR/Agent.8192.224
   [NOTE]    The file was deleted!
E:\AV\新建文件夹\2\tmp2E.tmp
   [DETECTION] Is the Trojan horse TR/Agent.8192.224
   [NOTE]    The file was deleted!
E:\AV\新建文件夹\2\tmp31.tmp
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppu.1
   [NOTE]    The file was deleted!
E:\AV\新建文件夹\2\tmp33.tmp
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.abtn
   [NOTE]    The file was deleted!
E:\AV\新建文件夹\2\tmp4D.tmp
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/PSW.Steal.44658
   [NOTE]    The file was deleted!
E:\AV\新建文件夹\2\tmp56.tmp
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [NOTE]    The file was deleted!
E:\AV\新建文件夹\2\tmp58.tmp
   [DETECTION] Is the Trojan horse TR/Agent.8192.224
   [NOTE]    The file was deleted!
E:\AV\新建文件夹\2\tmp59.tmp
   [DETECTION] Is the Trojan horse TR/Agent.8192.224
   [NOTE]    The file was deleted!
E:\AV\新建文件夹\2\tmp5A.tmp
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppu.1
   [NOTE]    The file was deleted!
E:\AV\新建文件夹\2\tmp5B.tmp
   [DETECTION] Is the Trojan horse TR/Agent.8192.224
   [NOTE]    The file was deleted!
E:\AV\新建文件夹\2\tmp5C.tmp
   [DETECTION] Is the Trojan horse TR/Agent.8192.224
   [NOTE]    The file was deleted!
E:\AV\新建文件夹\2\tmp5D.tmp
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppu.1
   [NOTE]    The file was deleted!

End of the scan: 2008年4月28日  17:13
Used time: 00:26 min

The scan has been done completely.

   1 Scanning directories
   24 Files were scanned
   14 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   14 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   10 Files not concerned
   0 Archives were scanned
   0 Warnings
   14 Notes

显示全部楼层 · 发表于 2008-4-28 17:13:50

时间处理结果木马名称木马进程名木马文件创建者
2008-04-28 17:13:24 处理成功 Trojan-PSW.Win32.OLGames.kcz C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\2\TMP5D.TMP C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2008-04-28 17:13:24 处理成功 Trojan-PSW.Win32.OLGames.kcz C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\2\TMP5A.TMP C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2008-04-28 17:13:24 处理成功 Trojan-Downloader.Win32.Small.nsz C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\2\TMP59.TMP C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2008-04-28 17:13:24 处理成功 Trojan-Downloader.Win32.Small.nsz C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\2\TMP58.TMP C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2008-04-28 17:13:24 处理成功 Trojan.Win32.Qhost.ly C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\2\TMP56.TMP C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2008-04-28 17:13:24 处理成功 Trojan.Win32.Genetik.hmu C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\2\TMP33.TMP C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2008-04-28 17:13:23 处理成功 Trojan-PSW.Win32.OLGames.kcz C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\2\TMP31.TMP C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2008-04-28 17:13:23 处理成功 Trojan-Downloader.Win32.Small.nsz C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\2\TMP2E.TMP C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2008-04-28 17:13:23 处理成功 Trojan-Downloader.Win32.Small.nsz C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\2\TMP2D.TMP C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2008-04-28 17:13:23 处理成功 Trojan-Downloader.Win32.Small.nsz C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\2\TMP2C.TMP C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2008-04-28 17:13:23 处理成功 Trojan-Downloader.Win32.Small.nsz C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\2\TMP2B.TMP C:\PROGRAM FILES\WINRAR\WINRAR.EXE

显示全部楼层 · 发表于 2008-4-28 17:50:37

update McAfee

显示全部楼层 · 发表于 2008-4-28 20:05:36

好多都没问题

[ 本帖最后由 wangjay1980 于 2008-4-28 20:20 编辑 ]

显示全部楼层 · 发表于 2008-4-28 20:33:47

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.DL.Win32.Small.tpj
病毒： Worm.Win32.PaBug.gfg
病毒： Trojan.Win32.VB.zsu

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.42.01

显示全部楼层 · 发表于 2008-4-28 21:58:33

[Scanning : C:\Documents and Settings\All Users\Documents\Test]

C:\Documents and Settings\All Users\Documents\Test\2.part2.rar<RAR>:tmp2B.tmp <- Downloader.Small.Hzk : No action
C:\Documents and Settings\All Users\Documents\Test\2.part2.rar<RAR>:tmp2C.tmp <- Downloader.Small.Hzk : No action
C:\Documents and Settings\All Users\Documents\Test\2.part2.rar<RAR>:tmp2D.tmp <- Downloader.Small.Hzk : No action
C:\Documents and Settings\All Users\Documents\Test\2.part2.rar<RAR>:tmp2E.tmp <- Downloader.Small.Hzk : No action
C:\Documents and Settings\All Users\Documents\Test\2.part2.rar<RAR>:tmp31.tmp <- Trojan.Psw.Onlinegames.Ppu : No action
C:\Documents and Settings\All Users\Documents\Test\2.part2.rar<RAR>:tmp56.tmp<UPack>:tmp56.tmp <- Trojan.Qhost.Ajz : No action
C:\Documents and Settings\All Users\Documents\Test\2.part2.rar<RAR>:tmp58.tmp <- Downloader.Small.Hzk : No action
C:\Documents and Settings\All Users\Documents\Test\2.part2.rar<RAR>:tmp59.tmp <- Downloader.Small.Hzk : No action
C:\Documents and Settings\All Users\Documents\Test\2.part2.rar<RAR>:tmp5A.tmp <- Trojan.Psw.Onlinegames.Ppu : No action
C:\Documents and Settings\All Users\Documents\Test\2.part2.rar<RAR>:tmp5B.tmp <- Downloader.Small.Hzk : No action
C:\Documents and Settings\All Users\Documents\Test\2.part2.rar<RAR>:tmp5C.tmp <- Downloader.Small.Hzk : No action
C:\Documents and Settings\All Users\Documents\Test\2.part2.rar<RAR>:tmp5D.tmp <- Trojan.Psw.Onlinegames.Ppu : No action

Scanned objects : 29

Infected objects : 12

显示全部楼层 · 发表于 2008-4-28 21:59:01

[Found possible virus] <W32/Trojan-Sml-OPPW-based!Maximus (not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\2.part2.rar->2\tmp2B.tmp
[Found possible virus] <W32/Trojan-Sml-OPPW-based!Maximus (not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\2.part2.rar->2\tmp2C.tmp
[Found possible virus] <W32/Trojan-Sml-OPPW-based!Maximus (not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\2.part2.rar->2\tmp2D.tmp
[Found possible virus] <W32/Trojan-Sml-OPPW-based!Maximus (not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\2.part2.rar->2\tmp2E.tmp
[Found password stealer] <W32/Pws.AHAV (exact, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\2.part2.rar->2\tmp31.tmp
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\2.part2.rar->2\tmp33.tmp
[Found security risk] <W32/AutoRun.D.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\2.part2.rar->2\tmp4D.tmp->(UPX)
[Found possible security risk] <W32/Heuristic-210!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\2.part2.rar->2\tmp56.tmp->(UPack)
[Found possible virus] <W32/Trojan-Sml-OPPW-based!Maximus (not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\2.part2.rar->2\tmp58.tmp
[Found possible virus] <W32/Trojan-Sml-OPPW-based!Maximus (not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\2.part2.rar->2\tmp59.tmp
[Found password stealer] <W32/Pws.AHAV (exact, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\2.part2.rar->2\tmp5A.tmp
[Found possible virus] <W32/Trojan-Sml-OPPW-based!Maximus (not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\2.part2.rar->2\tmp5B.tmp
[Found possible virus] <W32/Trojan-Sml-OPPW-based!Maximus (not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\2.part2.rar->2\tmp5C.tmp
[Found password stealer] <W32/Pws.AHAV (exact, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\2.part2.rar->2\tmp5D.tmp

---------------------------------------------------------------------
Scan ended: 2008-4-28, 21:58:59
Duration: 0:00:03

Scan result:

Scanned files:    7
Infected objects:    14
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

显示全部楼层 · 发表于 2008-4-29 15:07:03

Hello,

AutoRun.inf, DeepFrz.sys, np27.tmp_, np28.tmp_, np29.tmp_, tem14.tmp_, tmp37.tmp_, tmp3F.tmp_, tmp52.tmp_, tmp53.tmp_, tmp54.tmp_, upload.dll, Ying-UnInstall.exe_

No malicious code were found in these files.

Please quote all when answering.

--
Best regards, Yury Nesmachny
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

[ 本帖最后由 kato9096 于 2008-4-29 15:11 编辑 ]

显示全部楼层 · 发表于 2008-4-29 22:33:11

收了

[病毒样本] 24

本帖子中包含更多资源

14

本帖子中包含更多资源

25/10