送大家一包样本

SONGBOWEN

在别人家里修机器时搜集的，一共7个……
分两包……

[ 本帖最后由 SONGBOWEN 于 2008-6-8 12:23 编辑 ]

HC303

包呢？

SONGBOWEN

网速问题，上传不上来，闷……

HC303

慢慢来，不急。

SONGBOWEN

OK，分两次上传就搞定了……

hj5abc

woai_jolin

扫描开始于2008年6月8日 12:52:55
G:\v\新建文件夹\svchos1.exe,查到病毒: Suspicious, 操作: <无>
G:\v\新建文件夹\kolya.exe,查到病毒: Suspicious, 操作: <无>
G:\v\新建文件夹\Down(0).exe,查到病毒: Spy/Emogen, 操作: 删除/隔离
G:\v\新建文件夹\1.exe,查到病毒: Suspicious, 操作: <无>
扫描结束于2008年6月8日 12:52:56
总共扫描了5个文件, 其中感染病毒文件为4个. 总共扫描了0个引导区, 感染的引导区为0个.

浪滔天

卡巴 7.0.1.325 高启发

6个 剩下一个上报

已删除: 病毒 Worm.Win32.AutoRun.doq        文件: F:\病毒样本\Virus2\1.exe
已删除: 木马程序 Trojan-Spy.Win32.Agent.cby        文件: F:\病毒样本\Virus2\Down(0).exe
已删除: 木马程序 Trojan-Spy.Win32.Agent.cgd        文件: F:\病毒样本\Virus2\kl88.exe
已删除: 木马程序 Trojan-Downloader.Win32.Delf.gkq        文件: F:\病毒样本\Virus2\kolya.exe
已隔离: 病毒 Heur.Trojan.Generic （变种）        文件: F:\病毒样本\Virus2\svchos1.exe//PE_Patch//UPack
已删除: 木马程序 Backdoor.Win32.Hupigon.bmxo        文件: F:\病毒样本\Virus1\auto.exe

The EQs

C:\Users\Administrator\Desktop\s2.exe - probably a variant of Win32/Hupigon.NGU trojan - cleaned by deleting - quarantined
C:\Users\Administrator\Desktop\auto.exe - probably a variant of Win32/Spy.Delf.NIO trojan - cleaned by deleting - quarantined
C:\Users\Administrator\Desktop\kolya.exe - a variant of Win32/AutoRun.JX worm - cleaned by deleting - quarantined
C:\Users\Administrator\Desktop\Down(0).exe - Win32/PSW.QQRob.NAW trojan - cleaned by deleting - quarantined
C:\Users\Administrator\Desktop\kl88.exe - Win32/PSW.QQRob.NAW trojan - cleaned by deleting - quarantined
C:\Users\Administrator\Desktop\1.exe - a variant of Win32/AutoRun.JO worm - cleaned by deleting - quarantined

Kitman

Begin scan in 'C:\Documents and Settings\Administrator\桌面\Virus1.rar'
C:\Documents and Settings\Administrator\桌面\Virus1.rar
  [0] Archive type: RAR
  --> auto.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.bmxo Backdoor server programs
  --> s2.exe
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [NOTE]      A backup was created as '48bd69c6.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!
Begin scan in 'C:\Documents and Settings\Administrator\桌面\Virus2.rar'
C:\Documents and Settings\Administrator\桌面\Virus2.rar
  [0] Archive type: RAR
    --> svchos1.exe
          [DETECTION] Contains suspicious code HEUR/Crypted
  --> 1.exe
      [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
  --> Down(0).exe
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
  --> kl88.exe
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
  --> kolya.exe
      [DETECTION] Is the Trojan horse TR/Agent.94720.H
      [NOTE]      A backup was created as '492c2a07.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!


End of the scan: 2008年6月8日  13:08
Used time: 00:02 min

The scan has been done completely.

      0 Scanning directories
      9 Files were scanned
      6 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      2 files were deleted
      0 files were repaired
      2 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      2 Archives were scanned
      0 Warnings
      2 Notes

25039713

svchos1.exe

164.32 KB

UNDER ANALYSIS

[ 本帖最后由 Kitman 于 2008-6-8 13:12 编辑 ]