收藏本站 |切换到宽版 | 更换论坛皮肤
 找回密码  忘记邮箱  QQ快速登录  快速登录  快速注册

卡饭»论坛 › 安全区 › 病毒样本 分享&分析区 › 9
12
返回列表 发新帖
楼主: sam.to
 收起左侧

[病毒样本] 9

[复制链接]
无尽藏海
发表于 2008-5-3 23:14:36 | 显示全部楼层
Begin scan in 'E:\VIRUS\xia-9.rar'
E:\VIRUS\xia-9.rar
  [0] Archive type: RAR
    --> msnlive.exe2
          [DETECTION] Contains suspicious code HEUR/Malware
    --> kavsvchost.exe2
          [DETECTION] Contains suspicious code HEUR/Malware
  --> xia4.exe2
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen


25009160         xia25.exe2         6.07 KB         UNDER ANALYSIS
25009161         xia27.exe2         3.33 KB         UNDER ANALYSIS
25009162         kavsvchost.exe2         13.5 KB         UNDER ANALYSIS
25009163         xia4.exe2         17.5 KB         MALWARE
25009164         xia7.exe2         3.94 KB         UNDER ANALYSIS
25009165         xia16.exe2         4.9 KB         UNDER ANALYSIS
25009166         xia23.exe2         1.6 KB         UNDER ANALYSIS
25009167         xia24.exe2         1.49 KB         UNDER ANALYSIS
回复

举报

平淡
发表于 2008-5-3 23:16:24 | 显示全部楼层
F:\病毒\xia-9.rar>>kavsvchost.exe2        TrojanDownloader.Losabel.io.eojg        木马        还未处理
F:\病毒\xia-9.rar>>msnlive.exe2        TrojanDownloader.Losabel.io.eojg        木马        还未处理
F:\病毒\xia-9.rar>>xia27.exe2        Trojan.Cap842314.vkep        木马        还未处理
回复

举报

sam.to
 楼主| 发表于 2008-5-3 23:41:58 | 显示全部楼层

回复 5楼 kato9096 的帖子

Hello,

js3.exe_ - Trojan-PSW.Win32.OnLineGames.acyo

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Kirill Erakhtin
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.
回复

举报

mofunzone
发表于 2008-5-4 02:45:06 | 显示全部楼层
Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\84223'
C:\Documents and Settings\Administrator\My Documents\84223\
  kavsvchost.exe2
    [0] Archive type: Runtime Packed
    --> Object
      [NOTE]      The file was deleted!
  msnlive.exe2
    [0] Archive type: Runtime Packed
    --> Object
      [NOTE]      The file was deleted!
  xia16.exe2
  xia23.exe2
  xia24.exe2
  xia25.exe2
  xia27.exe2
  xia4.exe2
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
  xia7.exe2
C:\Documents and Settings\Administrator\My Documents\84223\84223\
  js0.exe2
      [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
      [NOTE]      The file was deleted!
  js1.exe2
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
  js10.exe2
    [0] Archive type: OVL
      --> Object
        [1] Archive type: Runtime Packed
        --> Object
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.acqi.1
            [WARNING]   Infected files in archives cannot be repaired!
      [DETECTION] Is the Trojan horse TR/Hijacker.Gen
      [NOTE]      The file was deleted!
  js11.exe2
    [0] Archive type: OVL
      --> Object
        [1] Archive type: Runtime Packed
        --> Object
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.acqi.1
            [WARNING]   Infected files in archives cannot be repaired!
      [DETECTION] Is the Trojan horse TR/Hijacker.Gen
      [NOTE]      The file was deleted!
  js12.exe2
    [0] Archive type: OVL
      --> Object
        [1] Archive type: Runtime Packed
        --> Object
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.acqi.1
            [WARNING]   Infected files in archives cannot be repaired!
      [DETECTION] Is the Trojan horse TR/Hijacker.Gen
      [NOTE]      The file was deleted!
  js13.exe2
    [0] Archive type: OVL
      --> Object
        [1] Archive type: Runtime Packed
        --> Object
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.acqi.1
            [WARNING]   Infected files in archives cannot be repaired!
      [DETECTION] Is the Trojan horse TR/Hijacker.Gen
      [NOTE]      The file was deleted!
  js14.exe2
    [0] Archive type: OVL
    --> Object
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.achy
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.akc
            [WARNING]   Infected files in archives cannot be repaired!
      [NOTE]      The file was deleted!
  js16.exe2
    [0] Archive type: OVL
    --> Object
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.acmf
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.akc
            [WARNING]   Infected files in archives cannot be repaired!
      [NOTE]      The file was deleted!
  js17.exe2
    [0] Archive type: OVL
      --> Object
        [1] Archive type: Runtime Packed
        --> Object
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.acqi.1
            [WARNING]   Infected files in archives cannot be repaired!
      [DETECTION] Is the Trojan horse TR/Hijacker.Gen
      [NOTE]      The file was deleted!
  js18.exe2
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.abzd.33
              [WARNING]   Infected files in archives cannot be repaired!
      [NOTE]      The file was deleted!
  js2.exe2
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.QQpass.btc
            [WARNING]   Infected files in archives cannot be repaired!
      [NOTE]      The file was deleted!
  js21.exe2
    [0] Archive type: Runtime Packed
    --> Object
      [NOTE]      The file was deleted!
  js22.exe3
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.abzd.17
              [WARNING]   Infected files in archives cannot be repaired!
      [NOTE]      The file was deleted!
  js23.exe3
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.abzd.8
              [WARNING]   Infected files in archives cannot be repaired!
      [NOTE]      The file was deleted!
  js24.exe3
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
          [2] Archive type: RSRC
          --> Object
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
  js25.exe3
    [0] Archive type: OVL
      --> Object
        [1] Archive type: Runtime Packed
        --> Object
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.acqi.1
            [WARNING]   Infected files in archives cannot be repaired!
      [DETECTION] Is the Trojan horse TR/Hijacker.Gen
      [NOTE]      The file was deleted!
  js26.exe3
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.abur.22
              [WARNING]   Infected files in archives cannot be repaired!
      [NOTE]      The file was deleted!
  js27.exe3
    [0] Archive type: OVL
    --> Object
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.acrj
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.acqi.1
            [WARNING]   Infected files in archives cannot be repaired!
      [NOTE]      The file was deleted!
  js28.exe3
    [0] Archive type: OVL
      --> Object
        [1] Archive type: Runtime Packed
        --> Object
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.acqi.1
            [WARNING]   Infected files in archives cannot be repaired!
      [DETECTION] Is the Trojan horse TR/Hijacker.Gen
      [NOTE]      The file was deleted!
  js3.exe3
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
  js30.exe2
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
          [2] Archive type: RSRC
          --> Object
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
  js4.exe2
    [0] Archive type: OVL
      --> Object
        [1] Archive type: Runtime Packed
        --> Object
      --> Object
        [1] Archive type: RSRC
        --> Object
      [DETECTION] Is the Trojan horse TR/Hijacker.Gen
      [NOTE]      The file was deleted!
  js5.exe2
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
  js6.exe3
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
  js7.exe3
    [0] Archive type: OVL
      --> Object
        [1] Archive type: Runtime Packed
        --> Object
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.acqi.1
            [WARNING]   Infected files in archives cannot be repaired!
      [DETECTION] Is the Trojan horse TR/Hijacker.Gen
      [NOTE]      The file was deleted!
  js8.exe2
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!


End of the scan: 2008年5月3日  11:44
Used time: 00:07 min

The scan has been done completely.

      2 Scanning directories
     35 Files were scanned
     38 viruses and/or unwanted programs were found
      2 Files were classified as suspicious:
     29 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     -3 Files not concerned
      0 Archives were scanned
     16 Warnings
     29 Notes
回复

举报

挪威的冬天
发表于 2008-5-4 12:04:57 | 显示全部楼层
信息        2008-05-04  12:03:22        您此次查毒清除了2个病毒                       
信息        2008-05-04  12:03:22        您此次查毒共查出2个病毒以及危险代码                       
信息        2008-05-04  12:03:22        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件15个                       
信息        2008-05-04  12:03:22        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
病毒        2008-05-04  12:03:22        D:\Desktop\xia-9.rar\kavsvchost.exe2        Win32.TrojDownloader.Losabel.io.73728        清除成功       
病毒        2008-05-04  12:03:22        D:\Desktop\xia-9.rar\msnlive.exe2        Win32.TrojDownloader.Losabel.io.73728        清除成功
回复

举报

Roboon
发表于 2008-5-4 13:30:14 | 显示全部楼层
Roboon
回复

举报

sam.to
 楼主| 发表于 2008-5-5 11:32:37 | 显示全部楼层
Hello,

CTHELPER.exe_,
MsnPlatform.bin - Trojan-Clicker.Win32.Flyst.ad,

VStart.bin - Trojan-Clicker.Win32.Flyst.ae,

WINSvr64.dll - Trojan-Downloader.Win32.Agent.obt

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

GVOnline32.bin,
krnln.fnr,
NSService.fne,
smss.exe_,
tppoll.exe_

No malicious code were found in these files.

kavsvchost.exe_,
msnlive.exe_ - Trojan-Downloader.Win32.Agent.oad,

xia4.exe_ - Trojan-PSW.Win32.OnLineGames.acyk

These files are already detected. Please update your antivirus bases.

xia16.exe_,
xia23.exe_,
xia24.exe_,
xia25.exe_,
xia27.exe_,
xia7.exe_

These files are corrupted.

Please quote all when answering.

--
Best regards, Mikhail Bulgakov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.
回复

举报

28654621
头像被屏蔽
发表于 2008-5-5 11:51:48 | 显示全部楼层
6

本帖子中包含更多资源

您需要 登录 才可以下载或查看，没有帐号？快速注册

x
回复

举报

挪威的冬天
发表于 2008-5-5 12:31:25 | 显示全部楼层
信息        2008-05-05  12:30:51        您此次查毒清除了23个病毒                       
信息        2008-05-05  12:30:51        您此次查毒共查出23个病毒以及危险代码                       
信息        2008-05-05  12:30:51        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件52个                       
信息        2008-05-05  12:30:51        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
病毒        2008-05-05  12:30:51        D:\Desktop\84223.rar\84223\js8.exe2        Win32.Troj.OnlineGamesT.lg.106684        清除成功       
病毒        2008-05-05  12:30:51        D:\Desktop\84223.rar\84223\js7.exe3        Win32.Troj.OnlineGameT.zp.57344        清除成功       
病毒        2008-05-05  12:30:51        D:\Desktop\84223.rar\84223\js6.exe3        Win32.Troj.OnlineGamesT.ny.102456        清除成功       
病毒        2008-05-05  12:30:51        D:\Desktop\84223.rar\84223\js5.exe2        Win32.Troj.OnlineGamesT.lg.106684        清除成功       
病毒        2008-05-05  12:30:51        D:\Desktop\84223.rar\84223\js4.exe2        Win32.Troj.OnlineGameT.zp.57344        清除成功       
病毒        2008-05-05  12:30:51        D:\Desktop\84223.rar\84223\js30.exe2        Win32.Troj.OnlineGamesT.zy.32923        清除成功       
病毒        2008-05-05  12:30:51        D:\Desktop\84223.rar\84223\js28.exe3        Win32.Troj.OnlineGameT.zp.57344        清除成功       
病毒        2008-05-05  12:30:51        D:\Desktop\84223.rar\84223\js27.exe3        Win32.Troj.OnlineGameT.zp.57344        清除成功       
病毒        2008-05-05  12:30:51        D:\Desktop\84223.rar\84223\js26.exe3        Win32.Troj.OnlineGamesT.zy.32923        清除成功       
病毒        2008-05-05  12:30:51        D:\Desktop\84223.rar\84223\js25.exe3        Win32.Troj.OnlineGameT.zp.57344        清除成功       
病毒        2008-05-05  12:30:51        D:\Desktop\84223.rar\84223\js24.exe3        Win32.Troj.OnlineGamesT.zy.32923        清除成功       
病毒        2008-05-05  12:30:51        D:\Desktop\84223.rar\84223\js23.exe3        Win32.Troj.OnlineGamesT.zy.32923        清除成功       
病毒        2008-05-05  12:30:51        D:\Desktop\84223.rar\84223\js22.exe3        Win32.Troj.OnlineGamesT.zy.32923        清除成功       
病毒        2008-05-05  12:30:51        D:\Desktop\84223.rar\84223\js2.exe2        Win32.Troj.QQPass.a.106612        清除成功       
病毒        2008-05-05  12:30:51        D:\Desktop\84223.rar\84223\js18.exe2        Win32.Troj.OnlineGamesT.zy.32923        清除成功       
病毒        2008-05-05  12:30:51        D:\Desktop\84223.rar\84223\js17.exe2        Win32.Troj.OnlineGameT.zp.57344        清除成功       
病毒        2008-05-05  12:30:50        D:\Desktop\84223.rar\84223\js16.exe2        Win32.Troj.OnlineGameT.zp.57344        清除成功       
病毒        2008-05-05  12:30:50        D:\Desktop\84223.rar\84223\js14.exe2        Win32.PSWTroj.OnLineGames.69632        清除成功       
病毒        2008-05-05  12:30:50        D:\Desktop\84223.rar\84223\js13.exe2        Win32.Troj.OnlineGameT.zp.57344        清除成功       
病毒        2008-05-05  12:30:50        D:\Desktop\84223.rar\84223\js12.exe2        Win32.Troj.OnlineGameT.zp.57344        清除成功       
病毒        2008-05-05  12:30:50        D:\Desktop\84223.rar\84223\js11.exe2        Win32.Troj.OnlineGameT.zp.57344        清除成功       
病毒        2008-05-05  12:30:50        D:\Desktop\84223.rar\84223\js10.exe2        Win32.Troj.OnlineGameT.zp.57344        清除成功       
病毒        2008-05-05  12:30:50        D:\Desktop\84223.rar\84223\js1.exe2        Win32.Troj.OnlineGamesT.lg.106684        清除成功
回复

举报

小白鼠
发表于 2008-5-5 14:51:47 | 显示全部楼层
信息        2008-05-05 14:52:13        您此次查毒清除了9个病毒                       
信息        2008-05-05 14:52:13        您此次查毒共查出7个病毒以及危险代码                       
信息        2008-05-05 14:52:13        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件76个                       
信息        2008-05-05 14:52:13        金山毒霸主程序查毒过程结束，查毒方式：全面杀毒                       
病毒        2008-05-05 14:52:13        C:\Documents and Settings\Administrator\My Documents\9.rar        VirusInRar        清除成功       
病毒        2008-05-05 14:52:13        C:\Documents and Settings\Administrator\My Documents\9.rar\kavsvchost.exe2        Win32.TrojDownloader.Losabel.io.73728        清除成功       
病毒        2008-05-05 14:52:12        C:\Documents and Settings\Administrator\My Documents\9.rar\msnlive.exe2        Win32.TrojDownloader.Losabel.io.73728        清除成功       
病毒        2008-05-05 14:52:12        C:\Documents and Settings\Administrator\My Documents\84223.rar        VirusInRar        清除成功       
病毒        2008-05-05 14:52:10        C:\Documents and Settings\Administrator\My Documents\84223.rar\84223\js30.exe2        Win32.PSWTroj.OnLineGames.65816        清除成功       
病毒        2008-05-05 14:52:08        C:\Documents and Settings\Administrator\My Documents\84223.rar\84223\js23.exe3        Win32.PSWTroj.OnLineGames.65816        清除成功       
病毒        2008-05-05 14:52:06        C:\Documents and Settings\Administrator\My Documents\84223.rar\84223\js2.exe2        Win32.PSWTroj.Lmir.30835        清除成功       
病毒        2008-05-05 14:52:06        C:\Documents and Settings\Administrator\My Documents\84223.rar\84223\js18.exe2        Win32.Troj.OnlineGames.cp.65816        清除成功       
病毒        2008-05-05 14:52:05        C:\Documents and Settings\Administrator\My Documents\84223.rar\84223\js14.exe2        Win32.PSWTroj.OnLineGames.69632        清除成功       
信息        2008-05-05 14:51:32        金山毒霸主程序启动查毒过程，查毒方式：全面杀毒
回复

举报

12
返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-5-18 05:09 , Processed in 0.098600 second(s), 15 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究，不得将上述内容用于商业或者其他非法用途，否则产生的一切后果自负，本站信息来自网络，版权争议问题与本站无关，您必须在下载后的24小时之内从您的电脑中彻底删除上述信息，如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表