某贴挖 55个

显示全部楼层 · 发表于 2008-5-1 14:41:17

http://bbs.kafan.cn/viewthread.php?tid=244907&extra=page%3D1
xx.exe
沙盘里跑不起来,只替换了驱动beep.sys恢复SSDT，使kav等主防失效
temp文件夹下释放所需的dll的temp文件
察看得

1000103E PUSH datA.10008020 ASCII "data"
10001208 PUSH datA.10008028 ASCII "DLL"
1000134E PUSH datA.10008050 ASCII "\system32\drivers\beep.sys"
10001384 PUSH datA.10008034 ASCII "\system32\dllcache\beep.sys"
100013A9 MOV EDI,datA.1000802C ASCII "beep"
1000148C MOV DWORD PTR DS:[ESI],datA.100052A8 ASCII "f7"
100014FE PUSH datA.10008080 ASCII "SeDebugPrivilege"
1000150B PUSH datA.10008074 ASCII "drvAnti.exe"
100015B4 PUSH datA.100080A4 ASCII "winlogon.exe"
100015D1 PUSH datA.10008094 ASCII "explorer.exe"
10001633 MOV EDI,datA.10008630 ASCII "http://ccc.52gol.com/tk.txt"
10001692 MOV ESI,datA.100080C0 ASCII "atapi.sys"
10001701 PUSH datA.100080B4 ASCII "\drivers"
100017C1 MOV ESI,datA.100080CC ASCII "classpnp.sys"
10001831 PUSH datA.100080B4 ASCII "\drivers"
10001974 MOV ESI,datA.100080DC ASCII "stpdrive.sys"
100019DE PUSH datA.100080B4 ASCII "\drivers"
10001A93 MOV ESI,datA.100080EC ASCII "ntfs.sys"
10001B02 PUSH datA.100080B4 ASCII "\drivers"
10001BC2 MOV ESI,datA.100080F8 ASCII "fastfat.sys"
10001C2E PUSH datA.100080B4 ASCII "\drivers"
10001D07 MOV EDI,datA.10008138 ASCII "ntoskrnl.exe"
10001D1A MOV EDI,datA.10008128 ASCII "NTKRNLPA.exe"
10001D2D MOV EDI,datA.10008118 ASCII "ntkrnlmp.exe"
10001DC8 MOV EDI,datA.10008104 ASCII "ntkrpamp.exe"
10001EF3 PUSH datA.10008148 ASCII "SOFTWARE\Microsoft\IE4"
10002001 PUSH datA.10008020 ASCII "data"
1000205A PUSH datA.100081B0 ASCII "

复制代码

病毒dll文件调用驱动下载木马
"http://ccc.52gol.com/tk.txt"
列表明文

ver=1
Url1=http://ccc.52gol.com/xx/soc01.exe
Url2=http://ccc.52gol.com/xx/soc02.exe
Url3=http://ccc.52gol.com/xx/soc03.exe
Url4=http://ccc.52gol.com/xx/soc04.exe
Url5=http://ccc.52gol.com/xx/soc05.exe
Url6=http://ccc.52gol.com/xx/soc06.exe
Url7=http://ccc.52gol.com/xx/soc07.exe
Url8=http://ccc.52gol.com/xx/soc08.exe
Url9=http://ccc.52gol.com/xx/soc09.exe
Url10=http://ccc.52gol.com/xx/soc10.exe
Url11=http://ccc.52gol.com/xx/soc11.exe
Url12=http://ccc.52gol.com/xx/soc12.exe
Url13=http://ccc.52gol.com/xx/soc13.exe
Url14=http://ccc.52gol.com/xx/soc14.exe
Url15=http://ccc.52gol.com/xx/soc15.exe
Url16=http://ccc.52gol.com/xx/soc16.exe
Url17=http://ccc.52gol.com/xx/soc17.exe
Url18=http://ccc.52gol.com/xx/soc18.exe
Url19=http://ccc.52gol.com/xx/soc19.exe
Url20=http://ccc.52gol.com/xx/soc20.exe
Url21=http://ccc.52gol.com/xx/soc21.exe
Url22=http://ccc.52gol.com/xx/soc22.exe
Url23=http://ccc.52gol.com/xx/soc23.exe
Url24=http://ccc.52gol.com/xx/soc24.exe
Url25=http://ccc.52gol.com/xx/soc25.exe
Url26=http://ccc.52gol.com/xx/soc26.exe
Url27=http://ccc.52gol.com/xx/soc27.exe
Url28=http://ccc.52gol.com/xx/soc28.exe

复制代码

[ 本帖最后由 promised 于 2008-5-1 15:02 编辑 ]

显示全部楼层 · 发表于 2008-5-1 14:43:29

pro啊早上那包里包括了。。

显示全部楼层 · 发表于 2008-5-1 14:44:30

那包里木dll的

显示全部楼层 · 发表于 2008-5-1 14:44:43

时间处理结果木马名称木马进程名木马文件创建者
2008-05-01 14:44:05 处理成功 Trojan-PSW.Win32.OL-Game.idb C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\SOC21.EXE C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2008-05-01 14:44:05 处理成功 Trojan-PSW.Win32.OL-Game.lpe C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\SOC09.EXE C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2008-05-01 14:44:05 处理成功 Trojan-PSW.Win32.OL-Game.lmu C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\SOC08.EXE C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2008-05-01 14:44:05 处理成功 Trojan-PSW.Win32.OL-Game.idj C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\SOC07.EXE C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2008-05-01 14:44:05 处理成功 Trojan-PSW.Win32.OL-Game.ida C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\SOC02.EXE C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2008-05-01 14:44:04 处理成功 Trojan-PSW.Win32.OL-Game.lpb C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\SOC01.EXE C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2008-05-01 14:44:04 处理成功 Trojan.Win32.Genetik.hmv C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\MSOSPING00.DLL C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2008-05-01 14:44:04 处理成功 Trojan.Win32.Genetik.hmu C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\MSOSMHFP00.DLL C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2008-05-01 14:44:04 处理成功 Trojan-PSW.Win32.OL-Game.juo C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\MSOSFMSQ00.DLL C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2008-05-01 14:44:04 处理成功 Trojan-PSW.Win32.OL-Game.jtj C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\FMSJHIF.DLL C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2008-05-01 14:44:04 处理成功 Trojan-PSW.Win32.OL-Game.izi C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\FMSIOCPS.DLL C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2008-05-01 14:44:03 处理成功 Trojan-PSW.Win32.OL-Game.jqu C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\BINCDWSA.DLL C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2008-05-01 14:44:03 处理成功 Trojan-PSW.Win32.OL-Game.hsg C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\608769WL.DLL C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2008-05-01 14:44:03 处理成功 Trojan-PSW.Win32.OL-Game.huk C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\MSOSDOHS00.DLL C:\PROGRAM FILES\WINRAR\WINRAR.EXE

显示全部楼层 · 发表于 2008-5-1 14:47:48

C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » yuiabct.dll - a variant of Win32/PSW.OnLineGames.NVW trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » MsIMMs32.dll - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » msosdohs00.dll - a variant of Win32/PSW.OnLineGames.NMQ trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » tciocp32.dll - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » 608769WL.DLL - a variant of Win32/PSW.Legendmir.NFQ trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » bincdwsa.dll - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » dbhlp32.dlL - a variant of Win32/PSW.OnLineGames.NVW trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » dionpis.dll - a variant of Win32/PSW.OnLineGames.NVW trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » dndsioc.dll - a variant of Win32/PSW.OnLineGames.NVW trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » fiosectc.dll - a variant of Win32/PSW.OnLineGames.NVW trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » fmbiost.dll - a variant of Win32/PSW.OnLineGames.NVW trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » fmsbbqi.dll - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » fmsiocps.dll - Win32/PSW.OnLineGames.NVW trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » fmsjhif.dll - a variant of Win32/PSW.OnLineGames.NVW trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » huifitc.dll - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » issms32.dll - a variant of Win32/PSW.OnLineGames.NVW trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » mfchlp64.dll - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » msosfmsq00.dll - a variant of Win32/PSW.OnLineGames.NMQ trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » msosmhfp00.dll - a variant of Win32/PSW.OnLineGames.NMQ trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » msosmnsf00.dll - a variant of Win32/PSW.OnLineGames.NMQ trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » msosping00.dll - a variant of Win32/PSW.OnLineGames.NMQ trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » msosptfs00.dll - a variant of Win32/PSW.OnLineGames.NMQ trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » Nt_Sys32.Sys - a variant of Win32/PSW.QQPass.NCZ trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » ptshell.dll - a variant of Win32/PSW.OnLineGames.NVW trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » sfnqpewv.dll - a variant of Win32/PSW.OnLineGames.NVW trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc01.exe - probably a variant of Win32/PSW.OnLineGames.NMQ trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc02.exe - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc03.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc04.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc05.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc06.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc07.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc08.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc09.exe - a variant of Win32/PSW.OnLineGames.NMQ trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc10.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc11.exe - probably a variant of Win32/PSW.OnLineGames.NMQ trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc12.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc13.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc14.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc15.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc16.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc17.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc18.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc19.exe - probably a variant of Win32/PSW.OnLineGames.NMQ trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc20.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc21.exe - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc22.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc23.exe - probably a variant of Win32/PSW.OnLineGames.NMQ trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc24.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc25.exe - probably a variant of Win32/PSW.OnLineGames.NMQ trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc26.exe - probably a variant of Win32/PSW.Legendmir.NFR trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc27.exe - probably a variant of Win32/PSW.WOW.WU trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » soc28.exe - a variant of Win32/PSW.QQPass.NCZ trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » ticisms.dll - a variant of Win32/PSW.OnLineGames.NVW trojan
C:\Documents and Settings\Don Johnson\桌面\样本.rar » RAR » WINSvr64.dll - a variant of Win32/PSW.OnLineGames.NVW trojan

显示全部楼层 · 发表于 2008-5-1 14:54:52

BEEP是系统的驱动，不是卡巴的驱动

替换是为了UNHOOK

不过此招对卡巴8没用了

[ 本帖最后由 wangjay1980 于 2008-5-1 15:00 编辑 ]

显示全部楼层 · 发表于 2008-5-1 14:59:46

T O KL

[ 本帖最后由 wangjay1980 于 2008-5-1 15:03 编辑 ]

显示全部楼层 · 发表于 2008-5-1 15:01:04

抱歉，抽了一下，笔误了

显示全部楼层 · 发表于 2008-5-1 15:03:36

信息 2008-05-01  15:03:32 您此次查毒共查出16个病毒以及危险代码
信息 2008-05-01  15:03:32 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件108个
信息 2008-05-01  15:03:32 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
病毒 2008-05-01  15:03:32 C:\Documents and Settings\Administrator\桌面\样本.rar\soc27.exe Win32.PSWTroj.OnLineGames.196608 跳过，未处理
病毒 2008-05-01  15:03:32 C:\Documents and Settings\Administrator\桌面\样本.rar\soc23.exe Win32.Troj.OnlineGames.aw.49152 跳过，未处理
病毒 2008-05-01  15:03:32 C:\Documents and Settings\Administrator\桌面\样本.rar\soc21.exe Win32.PSWTroj.OnLineGames.61712 跳过，未处理
病毒 2008-05-01  15:03:32 C:\Documents and Settings\Administrator\桌面\样本.rar\soc14.exe Win32.PSWTroj.OnLineGames.69813 跳过，未处理
病毒 2008-05-01  15:03:32 C:\Documents and Settings\Administrator\桌面\样本.rar\soc11.exe Win32.Troj.OnlineGames.aw.49152 跳过，未处理
病毒 2008-05-01  15:03:32 C:\Documents and Settings\Administrator\桌面\样本.rar\soc07.exe Win32.PSWTroj.OnlineGames.v.57628 跳过，未处理
病毒 2008-05-01  15:03:32 C:\Documents and Settings\Administrator\桌面\样本.rar\soc06.exe Win32.Troj.OnlineGames.fl.61440 跳过，未处理
病毒 2008-05-01  15:03:32 C:\Documents and Settings\Administrator\桌面\样本.rar\soc01.exe Win32.Troj.OnlineGames.aw.49249 跳过，未处理
病毒 2008-05-01  15:03:32 C:\Documents and Settings\Administrator\桌面\样本.rar\Nt_Sys32.Sys Win32.Troj.QQPassT.a.44660 跳过，未处理
病毒 2008-05-01  15:03:32 C:\Documents and Settings\Administrator\桌面\样本.rar\msosping00.dll Win32.PSWTroj.OnLineGames.151552 跳过，未处理
病毒 2008-05-01  15:03:32 C:\Documents and Settings\Administrator\桌面\样本.rar\msosmhfp00.dll Win32.Troj.OnlineGames.ha.155648 跳过，未处理
病毒 2008-05-01  15:03:32 C:\Documents and Settings\Administrator\桌面\样本.rar\msosfmsq00.dll Win32.PSWTroj.OnLineGames.163840 跳过，未处理
病毒 2008-05-01  15:03:32 C:\Documents and Settings\Administrator\桌面\样本.rar\fmsjhif.dll Win32.PSWTroj.OnLineGames.29976 跳过，未处理
病毒 2008-05-01  15:03:32 C:\Documents and Settings\Administrator\桌面\样本.rar\fmbiost.dll Win32.PSWTroj.OnLineGames.29464 跳过，未处理
病毒 2008-05-01  15:03:32 C:\Documents and Settings\Administrator\桌面\样本.rar\bincdwsa.dll Win32.Troj.OnlineGames.fl.25872 跳过，未处理
病毒 2008-05-01  15:03:32 C:\Documents and Settings\Administrator\桌面\样本.rar\608769WL.DLL Win32.PSWTroj.OnLineGames.46483 跳过，未处理

[ 本帖最后由 tvuser2007 于 2008-5-1 15:12 编辑 ]

显示全部楼层 · 发表于 2008-5-1 15:08:03

检测到：木马程序 Trojan-PSW.Win32.OnLineGames.acdu 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/MsIMMs32.dll
检测到：木马程序 Trojan-Clicker.Win32.Agent.abv 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/msosdohs00.dll//UPack
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.acdx 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/tciocp32.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.abfd 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/608769WL.DLL
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.xzy 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/bincdwsa.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.acpy 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/dbhlp32.dlL
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.ybi 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/fmbiost.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.ybx 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/fmsjhif.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.acon 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/huifitc.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.acoq 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/mfchlp64.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.xxf 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/msosfmsq00.dll//UPack
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.abtn 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/msosmhfp00.dll//UPack
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.ydw 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/msosping00.dll//UPack
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.acpv 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/ptshell.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.ycl 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/sfnqpewv.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.abtn 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc01.exe//FSG
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.abie 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc02.exe//FSG
检测到：病毒 Heur.Trojan.Generic (修改) 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc03.exe//FSG
检测到：病毒 Heur.Trojan.Generic (修改) 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc04.exe//FSG
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.acpy 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc05.exe//FSG
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.abtp 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc06.exe//FSG
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.abdd 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc07.exe//PE_Patch.UPX//UPX
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.acai 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc08.exe//FSG
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.abwj 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc09.exe//PE_Patch.UPX//UPX
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.acoq 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc10.exe//FSG
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.abxi 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc11.exe//FSG
检测到：病毒 Heur.Trojan.Generic (修改) 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc12.exe//FSG
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.acpv 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc13.exe//FSG
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.abtj 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc14.exe//FSG
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.acod 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc15.exe//FSG
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.acpz 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc16.exe//FSG
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.acor 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc17.exe//FSG
检测到：病毒 Heur.Trojan.Generic (修改) 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc18.exe//FSG
检测到：木马程序 Rootkit.Win32.Agent.aki 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc19.exe//FSG//#
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.abzn 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc20.exe//FSG
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.abcr 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc21.exe//PE_Patch.UPX//UPX
检测到：病毒 Heur.Trojan.Generic (修改) 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc22.exe//FSG
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.abxr 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc23.exe//FSG
检测到：病毒 Heur.Trojan.Generic (修改) 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc24.exe//FSG
检测到：木马程序 Rootkit.Win32.Agent.aki 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc25.exe//FSG//#
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.acoo 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc26.exe//UPX
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.abfh 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/soc27.exe//PE_Patch//UPack
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.acpz 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/ticisms.dll
检测到：木马程序 Trojan-Downloader.Win32.Agent.nwu 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/WINSvr64.dll

[ 本帖最后由 tvuser2007 于 2008-5-1 15:13 编辑 ]

[病毒样本] 某贴挖 55个

本帖子中包含更多资源

回复 2楼 jimmyleo 的帖子

全部卡擦

本帖子中包含更多资源

回复 6楼 wangjay1980 的帖子

金山16 瑞星28

卡巴7 44 江民25

浏览过的版块