捡来的一个

秋叶濛濛

来源：金山救援区
11.rar (7.18 KB, 下载次数: 151)

2008-5-27 15:54 上传

点击文件名下载附件

Log is generated by FreShow.
[wide]http://8.441xx.com/html/13
    [frame]http://xy99.saswsdwd.cn/wmcc/97xx.htm
        [frame]http://3dx7.aaqdqwd.cn/wmcc/14.htm
            [object]http://wxx.vwqpjmdmdwdqw.cn/11.exe
        [frame]http://d34s.qfdfqawd.cn/fzl.htm
            [object]http://wxx.vwqpjmdmdwdqw.cn/11.exe
        [frame]http://xy99.saswsdwd.cn/wmcc/real.htm
            [object]http://wxx.vwqpjmdmdwdqw.cn/11.exe
        [frame]http://xy99.saswsdwd.cn/wmcc/lz.htm
            [object]http://wxx.vwqpjmdmdwdqw.cn/11.exe

Avk

Trojan-Downloader.Win32.Small.wfe (AVP引擎)

Avira

HEUR/Malware

Dr.Web

Trojan.Downloader.62402

木马下载器


4
hxxp://xxx.dfasdaqwd.cn/cao/aa1.exe
hxxp://xxx.dfasdaqwd.cn/cao/aa2.exe
hxxp://xxx.dfasdaqwd.cn/cao/aa3.exe
hxxp://xxx.dfasdaqwd.cn/cao/aa4.exe
hxxp://xxx.dfasdaqwd.cn/cao/aa5.exe
hxxp://xxx.dfasdaqwd.cn/cao/aa6.exe
hxxp://xxx.dfasdaqwd.cn/cao/aa7.exe
hxxp://xxx.dfasdaqwd.cn/cao/aa8.exe
hxxp://111.dfasdaqwd.cn/cao/aa9.exe
hxxp://111.dfasdaqwd.cn/cao/aa10.exe
hxxp://111.dfasdaqwd.cn/cao/aa11.exe
hxxp://111.dfasdaqwd.cn/cao/aa12.exe
hxxp://111.dfasdaqwd.cn/cao/aa13.exe
hxxp://111.dfasdaqwd.cn/cao/aa14.exe
hxxp://111.dfasdaqwd.cn/cao/aa15.exe
hxxp://222.dfasdaqwd.cn/cao/aa16.exe
hxxp://222.dfasdaqwd.cn/cao/aa17.exe
hxxp://222.dfasdaqwd.cn/cao/aa18.exe
hxxp://222.dfasdaqwd.cn/cao/aa19.exe
hxxp://222.dfasdaqwd.cn/cao/aa20.exe
hxxp://222.dfasdaqwd.cn/cao/aa21.exe
hxxp://222.dfasdaqwd.cn/cao/aa22.exe
hxxp://333.dfasdaqwd.cn/cao/aa23.exe
hxxp://333.dfasdaqwd.cn/cao/aa24.exe
hxxp://333.dfasdaqwd.cn/cao/aa25.exe
hxxp://333.dfasdaqwd.cn/cao/aa26.exe
hxxp://333.dfasdaqwd.cn/cao/aa27.exe
hxxp://333.dfasdaqwd.cn/cao/aa32.exe

[ 本帖最后由 秋叶濛濛 于 2008-5-27 16:00 编辑 ]

tanlimo

http://xxx.fsdfefw.cn/cc/down.txt

4
http://xxx.dfasdaqwd.cn/cao/aa1.exe
http://xxx.dfasdaqwd.cn/cao/aa2.exe
http://xxx.dfasdaqwd.cn/cao/aa3.exe
http://xxx.dfasdaqwd.cn/cao/aa4.exe
http://xxx.dfasdaqwd.cn/cao/aa5.exe
http://xxx.dfasdaqwd.cn/cao/aa6.exe
http://xxx.dfasdaqwd.cn/cao/aa7.exe
http://xxx.dfasdaqwd.cn/cao/aa8.exe
http://111.dfasdaqwd.cn/cao/aa9.exe
http://111.dfasdaqwd.cn/cao/aa10.exe
http://111.dfasdaqwd.cn/cao/aa11.exe
http://111.dfasdaqwd.cn/cao/aa12.exe
http://111.dfasdaqwd.cn/cao/aa13.exe
http://111.dfasdaqwd.cn/cao/aa14.exe
http://111.dfasdaqwd.cn/cao/aa15.exe
http://222.dfasdaqwd.cn/cao/aa16.exe
http://222.dfasdaqwd.cn/cao/aa17.exe
http://222.dfasdaqwd.cn/cao/aa18.exe
http://222.dfasdaqwd.cn/cao/aa19.exe
http://222.dfasdaqwd.cn/cao/aa20.exe
http://222.dfasdaqwd.cn/cao/aa21.exe
http://222.dfasdaqwd.cn/cao/aa22.exe
http://333.dfasdaqwd.cn/cao/aa23.exe
http://333.dfasdaqwd.cn/cao/aa24.exe
http://333.dfasdaqwd.cn/cao/aa25.exe
http://333.dfasdaqwd.cn/cao/aa26.exe
http://333.dfasdaqwd.cn/cao/aa27.exe
http://333.dfasdaqwd.cn/cao/aa32.exe

以打包： 样本.rar (523.36 KB, 下载次数: 108)

2008-5-27 16:01 上传

点击文件名下载附件

[ 本帖最后由 tanlimo 于 2008-5-27 16:02 编辑 ]

palfan

又是木马群么 那我就懒得试了................

挪威的冬天

金山毒霸 0

哪个贴子... 求援区我不常去

Starting the file scan:

Begin scan in 'E:\AV\aa2.exe'
E:\AV\aa2.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa3.exe'
E:\AV\aa3.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa4.exe'
E:\AV\aa4.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa5.exe'
E:\AV\aa5.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajnn
      [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa6.exe'
E:\AV\aa6.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa7.exe'
E:\AV\aa7.exe
      [DETECTION] Is the Trojan horse TR/Downloader.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa8.exe'
E:\AV\aa8.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa9.exe'
E:\AV\aa9.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.afqn
      [DETECTION] Is the Trojan horse TR/Downloader.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa10.exe'
E:\AV\aa10.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa11.exe'
E:\AV\aa11.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa12.exe'
E:\AV\aa12.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa13.exe'
E:\AV\aa13.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa14.exe'
E:\AV\aa14.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.afqn
      [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa15.exe'
E:\AV\aa15.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa16.exe'
E:\AV\aa16.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa17.exe'
E:\AV\aa17.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa18.exe'
E:\AV\aa18.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa19.exe'
E:\AV\aa19.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa20.exe'
E:\AV\aa20.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa21.exe'
E:\AV\aa21.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa22.exe'
E:\AV\aa22.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa23.exe'
E:\AV\aa23.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa24.exe'
E:\AV\aa24.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa25.exe'
E:\AV\aa25.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/Proxy.Xorpix.FC
      [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa26.exe'
E:\AV\aa26.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa27.exe'
E:\AV\aa27.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa32.exe'
E:\AV\aa32.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\aa1.exe'
E:\AV\aa1.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!


End of the scan: 2008年5月27日  16:06
Used time: 00:30 min

The scan has been done completely.

      0 Scanning directories
     28 Files were scanned
     32 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
     28 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     -4 Files not concerned
      0 Archives were scanned
      0 Warnings
     28 Notes

挪威的冬天

信息        2008-05-27  16:06:28        您此次查毒清除了14个病毒                       
信息        2008-05-27  16:06:28        您此次查毒共查出14个病毒以及危险代码                       
信息        2008-05-27  16:06:28        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件68个                       
信息        2008-05-27  16:06:28        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
病毒        2008-05-27  16:06:28        D:\Desktop\Ñù±¾.rar\aa5.exe        Win32.Troj.OnlineGameT.ss.106496        清除成功       
病毒        2008-05-27  16:06:26        D:\Desktop\Ñù±¾.rar\aa32.exe        Win32.Troj.Agent.cd.81920        清除成功       
病毒        2008-05-27  16:06:26        D:\Desktop\Ñù±¾.rar\aa27.exe        Win32.Troj.OnlineGames.cd.49152        清除成功       
病毒        2008-05-27  16:06:26        D:\Desktop\Ñù±¾.rar\aa25.exe        Win32.Troj.OnlineGames.aw.49385        清除成功       
病毒        2008-05-27  16:06:26        D:\Desktop\Ñù±¾.rar\aa24.exe        Win32.Troj.OnlineGamesT.ak.110799        清除成功       
病毒        2008-05-27  16:06:25        D:\Desktop\Ñù±¾.rar\aa21.exe        Win32.Troj.OnlineGamesT.ak.110799        清除成功       
病毒        2008-05-27  16:06:24        D:\Desktop\Ñù±¾.rar\aa17.exe        Win32.Troj.OnlineGamesT.ak.110799        清除成功       
病毒        2008-05-27  16:06:24        D:\Desktop\Ñù±¾.rar\aa14.exe        Win32.PSWTroj.OnLineGames.106496        清除成功       
病毒        2008-05-27  16:06:23        D:\Desktop\Ñù±¾.rar\aa13.exe        Win32.Troj.OnlineGameT.xx.102475        清除成功       
病毒        2008-05-27  16:06:23        D:\Desktop\Ñù±¾.rar\aa12.exe        Win32.Troj.OnlineGamesT.ak.110799        清除成功       
病毒        2008-05-27  16:06:23        D:\Desktop\Ñù±¾.rar\aa10.exe        Win32.Troj.OnlineGamesT.ak.110799        清除成功       
病毒        2008-05-27  16:06:23        D:\Desktop\Ñù±¾.rar\aa9.exe        Win32.PSWTroj.OnLineGames.106496        清除成功       
病毒        2008-05-27  16:06:23        D:\Desktop\Ñù±¾.rar\aa8.exe        Win32.Troj.OnlineGameT.qq.106639        清除成功       
病毒        2008-05-27  16:06:22        D:\Desktop\Ñù±¾.rar\aa7.exe        Win32.Troj.OnlineGamesT.xe.106496        清除成功

gaojun7206

HEUR/Malware

The file '11.exe' has been determined to be 'MALWARE'. Our analysts discovered that the file is a Trojan containing download functionality. Detection will be added to our virus definition file (VDF) with one of the next updates. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Malware.

Nerazzurri

deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajeu        File: C:\Users\Nerazzurri\Desktop\Ñù±¾.rar/aa8.exe//PE_Patch//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.afqn        File: C:\Users\Nerazzurri\Desktop\Ñù±¾.rar/aa9.exe//#
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajqm        File: C:\Users\Nerazzurri\Desktop\Ñù±¾.rar/aa10.exe//PE_Patch//UPack
deleted: Trojan program Trojan.Win32.Agent.qop        File: C:\Users\Nerazzurri\Desktop\Ñù±¾.rar/aa12.exe//#
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajrw        File: C:\Users\Nerazzurri\Desktop\Ñù±¾.rar/aa13.exe//#
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.afqn        File: C:\Users\Nerazzurri\Desktop\Ñù±¾.rar/aa14.exe//#
deleted: virus Heur.Trojan.Generic (modification)        File: C:\Users\Nerazzurri\Desktop\Ñù±¾.rar/aa15.exe//FSG
deleted: virus Heur.Trojan.Generic (modification)        File: C:\Users\Nerazzurri\Desktop\Ñù±¾.rar/aa16.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajpo        File: C:\Users\Nerazzurri\Desktop\Ñù±¾.rar/aa17.exe//PE_Patch//UPack
deleted: virus Heur.Invader (modification)        File: C:\Users\Nerazzurri\Desktop\Ñù±¾.rar/aa18.exe//FSG
deleted: virus Heur.Trojan.Generic (modification)        File: C:\Users\Nerazzurri\Desktop\Ñù±¾.rar/aa19.exe//FSG
deleted: virus Heur.Trojan.Generic (modification)        File: C:\Users\Nerazzurri\Desktop\Ñù±¾.rar/aa20.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajpo        File: C:\Users\Nerazzurri\Desktop\Ñù±¾.rar/aa21.exe//PE_Patch//UPack
deleted: virus Heur.Trojan.Generic (modification)        File: C:\Users\Nerazzurri\Desktop\Ñù±¾.rar/aa23.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajpo        File: C:\Users\Nerazzurri\Desktop\Ñù±¾.rar/aa24.exe//#
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.aimm        File: C:\Users\Nerazzurri\Desktop\Ñù±¾.rar/aa25.exe//FSG
deleted: virus Heur.Invader (modification)        File: C:\Users\Nerazzurri\Desktop\Ñù±¾.rar/aa26.exe//FSG
deleted: virus Heur.Invader (modification)        File: C:\Users\Nerazzurri\Desktop\Ñù±¾.rar/aa27.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajrr        File: C:\Users\Nerazzurri\Desktop\Ñù±¾.rar/aa1.exe//FSG//#
deleted: virus Heur.Invader (modification)        File: C:\Users\Nerazzurri\Desktop\Ñù±¾.rar/aa2.exe//FSG
deleted: virus Heur.Trojan.Generic (modification)        File: C:\Users\Nerazzurri\Desktop\Ñù±¾.rar/aa3.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajnn        File: C:\Users\Nerazzurri\Desktop\Ñù±¾.rar/aa5.exe//#
deleted: virus Heur.Trojan.Generic (modification)        File: C:\Users\Nerazzurri\Desktop\Ñù±¾.rar/aa6.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.afql        File: c:\users\nerazzurri\desktop\Ñù±¾.rar/aa9.exe//PE_Patch//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajqm        File: c:\users\nerazzurri\desktop\Ñù±¾.rar/aa12.exe//PE_Patch//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.aijz        File: c:\users\nerazzurri\desktop\Ñù±¾.rar/aa13.exe//PE_Patch//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.adup        File: c:\users\nerazzurri\desktop\Ñù±¾.rar/aa14.exe//PE_Patch//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajpo        File: c:\users\nerazzurri\desktop\Ñù±¾.rar/aa24.exe//PE_Patch//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajnn        File: c:\users\nerazzurri\desktop\Ñù±¾.rar/aa5.exe//PE_Patch//UPack

电影结束了

http://bbs.kafan.cn/viewthread.php?tid=257513&extra=page%3D3

应该和这个是一样的。。。