赶尽杀绝。。。

aribeth199

已检测到: 木马程序 Trojan-Downloader.Win32.Small.wga        URL: http://bbs.kafan.cn/attachment.p ... 1941377//MM/BAK.CSS

gaojun7206

MM.zip
    [0] Archive type: ZIP
    --> MM/BAK.CSS
        [DETECTION] Is the Trojan horse TR/Dldr.Small.iwh
    --> MM/soft0.exe
        [DETECTION] Is the Trojan horse TR/Agent.nbj
      --> MM/soft1.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
            [3] Archive type: Runtime Packed
            --> Object
          --> Object
      --> MM/soft10.exe
        [1] Archive type: Runtime Packed
        --> Object
      --> MM/soft11.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
            [3] Archive type: Runtime Packed
            --> Object
          --> Object
      --> MM/soft12.exe
        [1] Archive type: Runtime Packed
        --> Object
      --> MM/soft13.exe
        [1] Archive type: Runtime Packed
        --> Object
      --> MM/soft14.exe
        [1] Archive type: Runtime Packed
        --> Object
      --> MM/soft15.exe
        [1] Archive type: Runtime Packed
        --> Object
      --> MM/soft16.exe
        [1] Archive type: Runtime Packed
        --> Object
    --> MM/soft17.exe
        [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.anz.2
      --> MM/soft18.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
            [3] Archive type: Runtime Packed
            --> Object
          --> Object
      --> MM/soft19.exe
        [1] Archive type: Runtime Packed
        --> Object
      --> MM/soft2.exe
        [1] Archive type: Runtime Packed
        --> Object
      --> MM/soft20.exe
        [1] Archive type: Runtime Packed
        --> Object
      --> MM/soft21.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
            [3] Archive type: Runtime Packed
            --> Object
          --> Object
              [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.adwk
              [WARNING]   Infected files in archives cannot be repaired!
      --> MM/soft22.exe
        [1] Archive type: Runtime Packed
        --> Object
      --> MM/soft23.exe
        [1] Archive type: Runtime Packed
        --> Object
      --> MM/soft24.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
            [3] Archive type: Runtime Packed
            --> Object
          --> Object
      --> MM/soft25.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
            [3] Archive type: Runtime Packed
            --> Object
          --> Object
      --> MM/soft26.exe
        [1] Archive type: Runtime Packed
        --> Object
      --> MM/soft27.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
            [3] Archive type: Runtime Packed
            --> Object
          --> Object
      --> MM/soft28.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
            [3] Archive type: Runtime Packed
            --> Object
          --> Object
              [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.afqn
              [WARNING]   Infected files in archives cannot be repaired!
      --> MM/soft29.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
            [3] Archive type: Runtime Packed
            --> Object
          --> Object
              [DETECTION] Contains detection pattern of the worm WORM/Downloader.ME
              [WARNING]   Infected files in archives cannot be repaired!
      --> MM/soft3.exe
        [1] Archive type: Runtime Packed
        --> Object
      --> MM/soft30.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
      --> MM/soft31.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
            [3] Archive type: Runtime Packed
            --> Object
          --> Object
    --> MM/soft32.exe
        [DETECTION] Is the Trojan horse TR/Agent.nbl
      --> MM/soft33.exe
        [1] Archive type: Runtime Packed
        --> Object
      --> MM/soft34.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
            [3] Archive type: Runtime Packed
            --> Object
          --> Object
              [DETECTION] Is the Trojan horse TR/Proxy.Xorpix.FC
              [WARNING]   Infected files in archives cannot be repaired!
      --> MM/soft35.exe
        [1] Archive type: Runtime Packed
        --> Object
    --> MM/soft36.exe
        [DETECTION] Is the Trojan horse TR/Agent.NBJ.1
      --> MM/soft4.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
            [3] Archive type: Runtime Packed
            --> Object
          --> Object
              [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajnn
              [WARNING]   Infected files in archives cannot be repaired!
      --> MM/soft5.exe
        [1] Archive type: Runtime Packed
        --> Object
      --> MM/soft6.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
            [3] Archive type: Runtime Packed
            --> Object
          --> Object
      --> MM/soft7.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
            [3] Archive type: Runtime Packed
            --> Object
          --> Object
      --> MM/soft8.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
            [3] Archive type: Runtime Packed
            --> Object
          --> Object
      --> MM/soft9.exe
        [1] Archive type: Runtime Packed
        --> Object
    --> MM/softd.exe
        [DETECTION] Is the Trojan horse TR/Agent.nbl
      [NOTE]      The file was moved to '486acea7.qua'!

Hi Exia,

Thank you for submitting in your virus sample.

It has been identified as Mal/Heuri-E by our virus lab.

Please see this link for more information: http://www.sophos.com/security/a ... are/malheurie.html.

Regards,

Darren Leong
Sophos Technical Support

ranguangning

【打好各种软件和操作系统漏洞】

【没想到这些个抓肉鸡的人利用漏洞这么快，漏洞利用程序满天飞，咋没见发现漏洞也这么快。。。】

bank-w3000

蜘蛛杀13个！

scottxzt

Begin scan in 'C:\Documents and Settings\Administrator\桌面\MM.zip'
C:\Documents and Settings\Administrator\桌面\MM.zip
  [0] Archive type: ZIP
  --> MM/BAK.CSS
      [DETECTION] Is the Trojan horse TR/Dldr.Small.iwh
  --> MM/soft0.exe
      [DETECTION] Is the Trojan horse TR/Agent.nbj
    --> MM/soft1.exe
      --> Object
        [2] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajus
    --> MM/soft10.exe
          [DETECTION] Is the Trojan horse TR/Dropper.Gen
    --> MM/soft12.exe
          [DETECTION] Is the Trojan horse TR/Dropper.Gen
    --> MM/soft13.exe
          [DETECTION] Is the Trojan horse TR/Dropper.Gen
    --> MM/soft14.exe
          [DETECTION] Is the Trojan horse TR/Dropper.Gen
    --> MM/soft15.exe
          [DETECTION] Is the Trojan horse TR/Dropper.Gen
    --> MM/soft16.exe
          [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> MM/soft17.exe
      [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.anz.2
    --> MM/soft18.exe
      --> Object
        [2] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajte
        --> Object
            [DETECTION] Contains detection pattern of the worm WORM/Downloader.MM
    --> MM/soft19.exe
          [DETECTION] Is the Trojan horse TR/Dropper.Gen
    --> MM/soft2.exe
          [DETECTION] Is the Trojan horse TR/Dropper.Gen
    --> MM/soft20.exe
          [DETECTION] Is the Trojan horse TR/Dropper.Gen
    --> MM/soft21.exe
      --> Object
        [2] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.adwk
    --> MM/soft22.exe
          [DETECTION] Is the Trojan horse TR/Dropper.Gen
    --> MM/soft23.exe
          [DETECTION] Is the Trojan horse TR/Dropper.Gen
    --> MM/soft24.exe
      --> Object
        [2] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajtb
        --> Object
            [DETECTION] Contains detection pattern of the worm WORM/Downloader.MM
    --> MM/soft25.exe
      --> Object
        [2] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajyq
        --> Object
            [DETECTION] Contains detection pattern of the worm WORM/Downloader.MM
    --> MM/soft26.exe
          [DETECTION] Is the Trojan horse TR/Dropper.Gen
    --> MM/soft27.exe
      --> Object
        [2] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajsq
        --> Object
            [DETECTION] Contains detection pattern of the worm WORM/Downloader.MM
    --> MM/soft28.exe
      --> Object
        [2] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.afqn
    --> MM/soft29.exe
      --> Object
        [2] Archive type: RSRC
        --> Object
            [DETECTION] Contains detection pattern of the worm WORM/Downloader.ME
    --> MM/soft3.exe
          [DETECTION] Is the Trojan horse TR/Dropper.Gen
    --> MM/soft31.exe
      --> Object
        [2] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajtm
        --> Object
            [DETECTION] Contains detection pattern of the worm WORM/Downloader.MM
  --> MM/soft32.exe
      [DETECTION] Is the Trojan horse TR/Agent.nbl
    --> MM/soft33.exe
          [DETECTION] Is the Trojan horse TR/Dropper.Gen
    --> MM/soft34.exe
      --> Object
        [2] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/Proxy.Xorpix.FC
    --> MM/soft35.exe
          [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> MM/soft36.exe
      [DETECTION] Is the Trojan horse TR/Agent.NBJ.1
    --> MM/soft4.exe
      --> Object
        [2] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajnn
    --> MM/soft5.exe
          [DETECTION] Is the Trojan horse TR/Dropper.Gen
    --> MM/soft6.exe
      --> Object
        [2] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajtp
    --> MM/soft7.exe
      --> Object
        [2] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajtg
        --> Object
            [DETECTION] Contains detection pattern of the worm WORM/Downloader.MM
    --> MM/soft9.exe
          [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> MM/softd.exe
      [DETECTION] Is the Trojan horse TR/Agent.nbl
      [NOTE]      The file was successfully wiped!
      [NOTE]      The file was deleted!


End of the scan: 2008年5月28日  17:06
Used time: 00:40 min

The scan has been done completely.

      0 Scanning directories
     40 Files were scanned
     50 viruses and/or unwanted programs were found

allinwonderi

[Scanning : C:\Documents and Settings\All Users\Documents\Test]


C:\Documents and Settings\All Users\Documents\Test\MM.zip<ZIP>:soft21.exe<UPack>:soft21.exe<DLLRES>:res1.exe <- Trojan.Psw.Onlinegames.Adwk : No action
C:\Documents and Settings\All Users\Documents\Test\MM.zip<ZIP>:soft28.exe<UPack>:soft28.exe <- Trojan.Psw.Onlinegames.Adup : No action
C:\Documents and Settings\All Users\Documents\Test\MM.zip<ZIP>:soft28.exe<UPack>:soft28.exe<DLLRES>:res0.exe <- Variant:Trojan.Psw.Onlinegames.Adup : No action
C:\Documents and Settings\All Users\Documents\Test\MM.zip<ZIP>:soft28.exe<UPack>:soft28.exe<DLLRES>:res0.exe<UPack>:res0.exe <- Trojan.Psw.Wow.Azc : No action
C:\Documents and Settings\All Users\Documents\Test\MM.zip<ZIP>:soft28.exe<UPack>:soft28.exe<DLLRES>:res1.exe <- Trojan.Psw.Onlinegames.Afqn : No action
C:\Documents and Settings\All Users\Documents\Test\MM.zip<ZIP>:soft30.exe<FSG>:soft30.exe <- Trojan.Psw.Onlinegames.Ygb : No action
C:\Documents and Settings\All Users\Documents\Test\MM.zip<ZIP>:soft30.exe<FSG>:soft30.exe<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Ygh : No action
C:\Documents and Settings\All Users\Documents\Test\MM.zip<ZIP>:soft34.exe <- Trojan.Psw.Onlinegames.Aimc : No action
C:\Documents and Settings\All Users\Documents\Test\MM.zip<ZIP>:soft34.exe<FSG>:soft34.exe<DLLRES>:res1.exe <- Trojan.Proxy.Xorpix.Fc : No action
C:\Documents and Settings\All Users\Documents\Test\MM.zip<ZIP>:soft4.exe <- Trojan.Psw.Onlinegames.Ajnn : No action
C:\Documents and Settings\All Users\Documents\Test\MM.zip<ZIP>:soft4.exe<UPack>:soft4.exe<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Ajnn : No action



Scanned objects : 122

Infected objects : 11

allinwonderi

[Found security risk]         <W32/Agent.L.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\MM.zip->MM/soft1.exe->(embedded)
[Found security risk]         <W32/Agent.L.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\MM.zip->MM/soft11.exe
[Found worm]         <W32/Warezov.B.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\MM.zip->MM/soft17.exe
[Found security risk]         <W32/Agent.L.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\MM.zip->MM/soft18.exe->(embedded)
[Found security risk]         <W32/Agent.L.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\MM.zip->MM/soft21.exe
[Found security risk]         <W32/Agent.L.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\MM.zip->MM/soft24.exe->(embedded)
[Found security risk]         <W32/Agent.L.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\MM.zip->MM/soft25.exe->(embedded)
[Found security risk]         <W32/Agent.L.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\MM.zip->MM/soft27.exe->(embedded)
[Found security risk]         <W32/Agent.L.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\MM.zip->MM/soft28.exe
[Found security risk]         <W32/Agent.L.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\MM.zip->MM/soft29.exe->(embedded)
[Found security risk]         <W32/Injector.A.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\MM.zip->MM/soft30.exe->(FSG)
[Found security risk]         <W32/Agent.L.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\MM.zip->MM/soft31.exe->(embedded)
[Found security risk]         <W32/Agent.L.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\MM.zip->MM/soft34.exe->(embedded)
[Found security risk]         <W32/Agent.L.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\MM.zip->MM/soft4.exe
[Found security risk]         <W32/Agent.L.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\MM.zip->MM/soft6.exe->(embedded)
[Found security risk]         <W32/Agent.L.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\MM.zip->MM/soft7.exe->(embedded)
[Found security risk]         <W32/Agent.L.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\MM.zip->MM/soft8.exe->(embedded)

---------------------------------------------------------------------
Scan ended:        2008-5-28, 20:15:56
Duration:        0:00:12

Scan result:

Scanned files:                 6
Infected objects:         17
Disinfected objects:         0
Quarantined files:         0
----------------------------------------------------------------

Palkia

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.DL.Win32.Mnless.agu
病毒： Trojan.Win32.Undef.gzb   
病毒： Trojan.PSW.Win32.GameOL.GEN
病毒： Trojan.PSW.Win32.GameOL.nsq
病毒： RootKit.Win32.RESSDT.au  
病毒： Trojan.PSW.Win32.SunOnline.oq
病毒： Trojan.PSW.Win32.GameOL.nsu
病毒： Trojan.DL.Win32.Mnless.agu
病毒： RootKit.Win32.RESSDT.al  
病毒： Trojan.PSW.Win32.GamesOnline.wc
病毒： Trojan.PSW.Win32.GamesOnline.wb
病毒： Trojan.PSW.Win32.SunOnline.op
病毒： RootKit.Win32.Undef.ic   

MAC 地址：00:0C:29:DE:9A:3B

用户来源：局域网

软件版本：20.46.22

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.DL.Win32.Mnless.agu
病毒： Trojan.Win32.Undef.gzb   
病毒： Trojan.PSW.Win32.GameOL.GEN
病毒： Trojan.PSW.Win32.GameOL.nsq
病毒： RootKit.Win32.RESSDT.au  
病毒： Trojan.PSW.Win32.SunOnline.oq
病毒： Trojan.PSW.Win32.GameOL.nsu
病毒： Trojan.DL.Win32.Mnless.agu
病毒： RootKit.Win32.RESSDT.al  
病毒： Trojan.PSW.Win32.GamesOnline.wc
病毒： Trojan.PSW.Win32.GamesOnline.wb
病毒： Trojan.PSW.Win32.SunOnline.op
病毒： RootKit.Win32.Undef.ic   

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.46.22