病毒樣本列表，作者25日更新

显示全部楼层 · 发表于 2008-5-26 00:50:01

不是要测试杀毒软件的杀毒效果，是想有没有分析病毒的达人，分析盗号后上传的地址，还有有没有可能发现其他负责穿透的主机列表。就是挂马的站点。最近这两年流行这样的方法，首先有人使用带毒的软件或访问挂马的站点，病毒通过系统漏洞自身弄好大本营后，然后下载其他病毒程序，首要的就是负责建立大本营的电脑病毒，那个更新应该是最让杀软头疼的，这些列表更新的无非是些后继程序，用来获取账号密码等有经济价值的程序。这个列表是机器狗穿透后留下的一个下载列表。新的机器狗样本获取比较困难，对于安装还原软件类的计算机穿透后就删除自身，没穿透你又发现不了，有点头疼。我只发现这个列表更新，挂马负责穿透的站点前两天找过几个，后来站点给关闭了。郁闷。。。ing。

显示全部楼层 · 发表于 2008-5-26 11:30:03

显示全部楼层 · 发表于 2008-5-26 12:23:14

正在扫描日志
病毒库版本: 3129 (20080526)
日期: 2008-5-26 时间: 12:22:58
已扫描的磁盘、文件夹和文件: D:\firefox download\virus.rar
D:\firefox download\virus.rar > RAR > d10.exe - Win32/PSW.OnLineGames.ZJK 特洛伊木马的变种
D:\firefox download\virus.rar > RAR > d11.exe - 可能是 Win32/PSW.OnLineGames.NWC 特洛伊木马的变种
D:\firefox download\virus.rar > RAR > d12.exe - 可能是 Win32/PSW.OnLineGames.NWC 特洛伊木马的变种
D:\firefox download\virus.rar > RAR > d13.exe - 可能是 Win32/PSW.OnLineGames.NWC 特洛伊木马的变种
D:\firefox download\virus.rar > RAR > d14.exe - Win32/PSW.OnLineGames.NWC 特洛伊木马
D:\firefox download\virus.rar > RAR > d15.exe - Win32/PSW.OnLineGames.NWC 特洛伊木马
D:\firefox download\virus.rar > RAR > d16.exe - Win32/PSW.OnLineGames.NWC 特洛伊木马
D:\firefox download\virus.rar > RAR > d18.exe - Win32/PSW.OnLineGames.NWB 特洛伊木马的变种
D:\firefox download\virus.rar > RAR > d19.exe - 正常
D:\firefox download\virus.rar > RAR > d20.exe - 可能是 Win32/PSW.OnLineGames.NWC 特洛伊木马的变种
D:\firefox download\virus.rar > RAR > d21.exe - 可能是 Win32/PSW.OnLineGames.NWC 特洛伊木马的变种
D:\firefox download\virus.rar > RAR > d22.exe - Win32/PSW.OnLineGames.NWC 特洛伊木马的变种
D:\firefox download\virus.rar > RAR > d23.exe - 可能是 Win32/PSW.OnLineGames.NWC 特洛伊木马的变种
D:\firefox download\virus.rar > RAR > d24.exe - Win32/PSW.OnLineGames.NWB 特洛伊木马的变种
D:\firefox download\virus.rar > RAR > d25.exe - Win32/PSW.OnLineGames.NWB 特洛伊木马
D:\firefox download\virus.rar > RAR > d26.exe - 可能是 Win32/PSW.OnLineGames.NWC 特洛伊木马的变种
D:\firefox download\virus.rar > RAR > d27.exe - Win32/PSW.OnLineGames.NWB 特洛伊木马的变种
D:\firefox download\virus.rar > RAR > d28.exe - Win32/PSW.OnLineGames.ZJK 特洛伊木马的变种
D:\firefox download\virus.rar > RAR > d29.exe - Win32/PSW.OnLineGames.NWB 特洛伊木马的变种
D:\firefox download\virus.rar > RAR > d30.exe - Win32/PSW.OnLineGames.NWC 特洛伊木马的变种
D:\firefox download\virus.rar > RAR > d31.exe - Win32/PSW.OnLineGames.NWB 特洛伊木马
D:\firefox download\virus.rar > RAR > d32.exe - 正常
D:\firefox download\virus.rar > RAR > d33.exe - Win32/PSW.OnLineGames.NWC 特洛伊木马的变种
D:\firefox download\virus.rar > RAR > d34.exe - Win32/PSW.OnLineGames.NWB 特洛伊木马
D:\firefox download\virus.rar > RAR > d35.exe - 可能是 Win32/PSW.OnLineGames.NWC 特洛伊木马的变种
D:\firefox download\virus.rar > RAR > d36.exe - Win32/Small.NDW 特洛伊木马
D:\firefox download\virus.rar > RAR > d8.exe - Win32/PSW.OnLineGames.NMQ 特洛伊木马的变种
D:\firefox download\virus.rar > RAR > d9.exe - 可能是 Win32/PSW.OnLineGames.NWC 特洛伊木马的变种
D:\firefox download\virus.rar:Zone.Identifier - 正常
已扫描的对象数: 29
发现的威胁数: 26
已清除对象数:0
完成时间: 12:23:14 总扫描时间: 16 秒 (00:00:16)

显示全部楼层 · 发表于 2008-5-26 12:29:41

Starting the file scan:

Begin scan in 'E:\AV\d.exe'
E:\AV\d.exe
   [DETECTION] Is the Trojan horse TR/Hijack.Explor.4796
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d0.exe'
Begin scan in 'E:\AV\d1.exe'
E:\AV\d1.exe
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aiyg
   [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d2.exe'
E:\AV\d2.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d3.exe'
E:\AV\d3.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d4.exe'
E:\AV\d4.exe
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajnn
   [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d5.exe'
E:\AV\d5.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d6.exe'
E:\AV\d6.exe
   [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d7.exe'
E:\AV\d7.exe
   [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d8.exe'
E:\AV\d8.exe
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Contains detection pattern of the worm WORM/Downloader.LY
   [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d9.exe'
E:\AV\d9.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d10.exe'
E:\AV\d10.exe
  [0] Archive type: RSRC
  --> Object
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.afqn
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d11.exe'
E:\AV\d11.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d12.exe'
E:\AV\d12.exe
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NVI.104
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d13.exe'
E:\AV\d13.exe
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NVI.135
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d14.exe'
E:\AV\d14.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aiaq
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d15.exe'
E:\AV\d15.exe
   [DETECTION] Is the Trojan horse TR/Onlinegames.NVI
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d16.exe'
E:\AV\d16.exe
   [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d35.exe'
E:\AV\d35.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d18.exe'
E:\AV\d18.exe
   [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d19.exe'
E:\AV\d19.exe
   [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d20.exe'
E:\AV\d20.exe
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajhk
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d21.exe'
E:\AV\d21.exe
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajjy
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d22.exe'
E:\AV\d22.exe
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.afeg
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d23.exe'
E:\AV\d23.exe
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajnd
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d24.exe'
E:\AV\d24.exe
   [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d25.exe'
E:\AV\d25.exe
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/Proxy.Xorpix.EQ
   --> Object
      [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.ald
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d26.exe'
E:\AV\d26.exe
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajcm
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d27.exe'
E:\AV\d27.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d28.exe'
E:\AV\d28.exe
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.afqn
   [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d29.exe'
E:\AV\d29.exe
   [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d30.exe'
E:\AV\d30.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d31.exe'
E:\AV\d31.exe
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/Proxy.Xorpix.FC
   [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d32.exe'
Begin scan in 'E:\AV\d33.exe'
E:\AV\d33.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d34.exe'
E:\AV\d34.exe
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/Proxy.Xorpix.FC
   [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\d36.exe'

End of the scan: 2008年5月26日  12:31
Used time: 00:19 min

The scan has been done completely.

   0 Scanning directories
   37 Files were scanned
   42 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   34 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   -5 Files not concerned
   0 Archives were scanned
   0 Warnings
   34 Notes

25020880	d0.exe	16 KB	CLEAN
25023771	d32.exe	20 KB	CLEAN
25024713	d36.exe	16 KB	CLEAN

[ 本帖最后由 Exia 于 2008-5-26 12:32 编辑 ]

显示全部楼层 · 发表于 2008-5-26 12:44:28

Time Module Object Name Threat Action User Information
2008/5/26 12:44:14 DMON archive http://bbs.kafan.cn/attachment.p ... 64&t=1211776940 multiple infiltrations quarantined - deleted Jason-PC\Jason

显示全部楼层 · 发表于 2008-5-26 13:28:23

木马名称:Trojan-PSW.Win32.OL-Game.vpx
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\D12.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.OL-Game.yla
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\D13.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.OL-Game.ven
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\D14.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.OL-Game.utr
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\D15.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.OL-Game.yjf
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\D16.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.OL-Game.trp
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\D22.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.OL-Game.sei
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\D25.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

]
木马名称:Trojan-PSW.Win32.OL-Game.yjb
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\D26.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.OL-Game.trv
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\D27.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.OL-Game.utq
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\D28.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.OL-Game.ovs
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\D30.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.OL-Game.xek
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\D31.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.OL-Game.xod
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\D34.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.OL-Game.xuh
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\D35.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

蠕虫名称:Worm.Win32.Small.xb
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\D36.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.OL-Game.wbx
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\D9.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\D10.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\SYSZXAC.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\D11.EXE
木马程序生成以下文件:
1) C:\WINDOWS\FMSBBQI.EXE
2) C:\WINDOWS\SYSTEM32\FMSBBQI.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\D18.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TMP67.TMP
2) C:\WINDOWS\SYSTEM32\MSOSMNSF00.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\D20.EXE
木马程序生成以下文件:
1) C:\WINDOWS\YUIABCT.EXE
2) C:\WINDOWS\SYSTEM32\YUIABCT.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\D21.EXE
木马程序生成以下文件:
1) C:\WINDOWS\MFCHLP64.EXE
2) C:\WINDOWS\SYSTEM32\MFCHLP64.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\D23.EXE
木马程序生成以下文件:
1) C:\WINDOWS\WINSVR64.EXE
2) C:\WINDOWS\SYSTEM32\WINSVR64.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\D24.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TMP69.TMP
2) C:\WINDOWS\SYSTEM32\MSOSPTFS00.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\D29.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TMP6B.TMP
2) C:\WINDOWS\SYSTEM32\MSOSDROP00.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\D33.EXE
木马程序生成以下文件:
1) C:\WINDOWS\ISNDNTIO.EXE
2) C:\WINDOWS\SYSTEM32\ISNDNTIO.DLL
是否删除木马程序及其衍生物?

[病毒样本] 病毒樣本列表，作者25日更新

回复 22楼 omcia 的帖子

本帖子中包含更多资源