explorer.exe病毒，nod没查到样本发到这

kingboy

卡巴查到



在nod发来着，没注意版规，原来样本只能发在这里，知错就改吧，呵呵

nosferatu

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\EXPLORER.rar'
C:\Documents and Settings\Administrator\桌面\EXPLORER.rar
  [0] Archive type: RAR
    --> EXPLORER.EXE
          [DETECTION] Contains suspicious code HEUR/Malware
      [NOTE]      The file was deleted!

su-tt

2008-5-21 10:29:46        内核        文件 'C:\Documents and Settings\Administrator\桌面\EXPLORER.rar' 已发送到 ESET 进行分析。

jiffy

金山毒霸~

tanlimo

http:  //x.us-001.net/hh.jpg

22
http://1.food00.net/a.exe
http://1.food00.net/a0.exe
http://1.food00.net/a1.exe
http://1.food00.net/a2.exe
http://1.food00.net/a3.exe
http://1.food00.net/a4.exe
http://1.food00.net/a5.exe
http://1.food00.net/a6.exe
http://1.food00.net/a7.exe
http://2.food00.net/a8.exe
http://2.food00.net/a9.exe
http://2.food00.net/a10.exe
http://2.food00.net/a11.exe
http://2.food00.net/a12.exe
http://2.food00.net/a13.exe
http://2.food00.net/a14.exe
http://3.food00.net/a15.exe
http://3.food00.net/a16.exe
http://4.food00.net/a35.exe
http://3.food00.net/a18.exe
http://3.food00.net/a19.exe
http://3.food00.net/a20.exe
http://3.food00.net/a21.exe
http://3.food00.net/a22.exe
http://3.food00.net/a23.exe
http://3.food00.net/a24.exe
http://4.food00.net/a25.exe
http://4.food00.net/a26.exe
http://4.food00.net/a27.exe
http://4.food00.net/a28.exe
http://4.food00.net/a29.exe
http://4.food00.net/a30.exe
http://4.food00.net/a31.exe
http://4.food00.net/a32.exe
http://4.food00.net/a33.exe
http://4.food00.net/a34.exe
http://4.food00.net/a36.exe

[ 本帖最后由 tanlimo 于 2008-5-21 12:20 编辑 ]

mofunzone

8以后貌似都失效了？

Starting the file scan:

Begin scan in 'C:\TDDOWNLOAD\a7.exe'
C:\TDDOWNLOAD\
  a7.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
          [2] Archive type: Runtime Packed
          --> Object
        --> Object
            [DETECTION] Is the Trojan horse TR/Proxy.Xorpix.FC
            [WARNING]   Infected files in archives cannot be repaired!
      [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
      [NOTE]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a.exe'
C:\TDDOWNLOAD\
  a.exe
      [DETECTION] Is the Trojan horse TR/Hijack.Explor.4796
      [NOTE]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a0.exe'
C:\TDDOWNLOAD\
  a0.exe
Begin scan in 'C:\TDDOWNLOAD\a1.exe'
C:\TDDOWNLOAD\
  a1.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
          [2] Archive type: Runtime Packed
          --> Object
        --> Object
      [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
      [NOTE]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a2.exe'
C:\TDDOWNLOAD\
  a2.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NVI.117
            [WARNING]   Infected files in archives cannot be repaired!
      [NOTE]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a3.exe'
C:\TDDOWNLOAD\
  a3.exe
    [0] Archive type: Runtime Packed
    --> Object
      [NOTE]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a4.exe'
C:\TDDOWNLOAD\
  a4.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
          [2] Archive type: Runtime Packed
          --> Object
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.afqn
            [WARNING]   Infected files in archives cannot be repaired!
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a5.exe'
C:\TDDOWNLOAD\
  a5.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aikx
            [WARNING]   Infected files in archives cannot be repaired!
      [NOTE]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a6.exe'
C:\TDDOWNLOAD\
  a6.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
          [2] Archive type: Runtime Packed
          --> Object
        --> Object
      [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
      [NOTE]      The file was deleted!


End of the scan: 2008年5月20日  21:12
Used time: 00:04 min

The scan has been done completely.

      0 Scanning directories
      9 Files were scanned
     10 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      8 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     -1 Files not concerned
      0 Archives were scanned
      4 Warnings
      8 Notes

su-tt

C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a23.exe - Win32/PSW.OnLineGames.NWC 特洛伊木马 的变种
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a24.exe - Win32/PSW.OnLineGames.NWB 特洛伊木马 的变种
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a25.exe - Win32/PSW.OnLineGames.NWB 特洛伊木马
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a26.exe - Win32/PSW.OnLineGames.NWC 特洛伊木马 的变种
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a27.exe - Win32/PSW.OnLineGames.NWB 特洛伊木马 的变种
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a28.exe - Win32/PSW.OnLineGames.ZJK 特洛伊木马 的变种
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a29.exe - Win32/PSW.OnLineGames.NWB 特洛伊木马 的变种
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a30.exe - Win32/PSW.OnLineGames.NWC 特洛伊木马 的变种
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a31.exe - Win32/PSW.OnLineGames.NWB 特洛伊木马
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a32.exe - Win32/PSW.QQPass.NCZ 特洛伊木马 的变种
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a33.exe - Win32/PSW.OnLineGames.NWC 特洛伊木马 的变种
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a34.exe - Win32/PSW.OnLineGames.NWB 特洛伊木马
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a1.exe - Win32/PSW.OnLineGames.NWB 特洛伊木马 的变种
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a2.exe - Win32/PSW.OnLineGames.NWC 特洛伊木马
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a3.exe - Win32/PSW.OnLineGames.OAR 特洛伊木马
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a4.exe - Win32/PSW.OnLineGames.ZJK 特洛伊木马 的变种
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a5.exe - Win32/PSW.OnLineGames.NWC 特洛伊木马
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a6.exe - Win32/PSW.OnLineGames.NWB 特洛伊木马 的变种
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a7.exe - Win32/PSW.OnLineGames.NWB 特洛伊木马
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a8.exe - Win32/PSW.OnLineGames.NWB 特洛伊木马 的变种
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a9.exe - 可能是 Win32/PSW.OnLineGames.NWC 特洛伊木马 的变种
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a10.exe - Win32/PSW.OnLineGames.ZJK 特洛伊木马 的变种
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a11.exe - 可能是 Win32/PSW.OnLineGames.NWC 特洛伊木马 的变种
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a12.exe - 可能是 Win32/PSW.OnLineGames.NWC 特洛伊木马 的变种
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a13.exe - Win32/PSW.OnLineGames.NWC 特洛伊木马 的变种
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a14.exe - Win32/PSW.OnLineGames.NWC 特洛伊木马
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a15.exe - Win32/PSW.OnLineGames.NWC 特洛伊木马
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a16.exe - Win32/PSW.OnLineGames.NWC 特洛伊木马 的变种
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a35.exe - 可能是 Win32/PSW.OnLineGames.NWC 特洛伊木马 的变种
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a18.exe - Win32/PSW.OnLineGames.NWB 特洛伊木马 的变种
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a19.exe - Win32/PSW.OnLineGames.NWC 特洛伊木马
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a20.exe - 可能是 Win32/PSW.OnLineGames.NWC 特洛伊木马 的变种
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a21.exe - Win32/PSW.OnLineGames.NWC 特洛伊木马
C:\Documents and Settings\Administrator\桌面\样本.rar > RAR > a22.exe - Win32/PSW.OnLineGames.NWC 特洛伊木马 的变种

Palkia

kv 1

挪威的冬天

信息        2008-05-21  12:32:06        您此次查毒清除了33个病毒                       
信息        2008-05-21  12:32:06        您此次查毒共查出33个病毒以及危险代码                       
信息        2008-05-21  12:32:06        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件79个                       
信息        2008-05-21  12:32:06        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒

Palkia

在 C:\Documents and Settings\Administrator\桌面\样本.rar->a23.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a24.exe 中发现 TrojanDropper.Driver.a 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a25.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a26.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a27.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a28.exe 中发现 Trojan/PSW.OnLineGames.sss 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a29.exe 中发现 TrojanDropper.Driver.a 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a30.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a31.exe 中发现 TrojanDropper.Driver.a 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a32.exe 中发现 Trojan/PSW.QQPass.swu 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a33.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a34.exe 中发现 TrojanDropper.Driver.a 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a1.exe 中发现 TrojanDropper.Driver.a 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a2.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a3.exe 中发现 Trojan/PSW.OnLineGames.tvm 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a4.exe 中发现 Trojan/PSW.OnLineGames.sss 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a5.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a6.exe 中发现 TrojanDropper.Driver.a 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a7.exe 中发现 TrojanDropper.Driver.a 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a8.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a9.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a10.exe 中发现 Trojan/PSW.OnLineGames.sss 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a11.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a12.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a13.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a14.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a15.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a16.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a35.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a18.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a19.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a20.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a21.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本.rar->a22.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除