番茄每日精选 20080618

显示全部楼层 · 发表于 2008-6-18 22:39:41

样本都是4月份的样本，5，6月的样本因为要做list，就不放出来了。

PS：欢迎光临PC安全实验室,网站已经全新改版 http://www.pcsl.info/cn/index.php

同时番茄感谢给analysis@pcsl.info发送样本的各位用户，这几天以来我们收到了非常多的网友给我们发来的样本，我们会分析并加入到我们的平台中，再次感谢，感恩感恩。

显示全部楼层 · 发表于 2008-6-18 22:42:40

扫描系统区域...
扫描所选择的目录和文件...
对象: 20080618\XX_220.exe
在压缩档案里: F:\20080618.rar
Status: 已发现病毒
病毒: Trojan.PWS.OnlineGames.YXF (BD 引擎)
对象: 20080618\XX_228.exe
在压缩档案里: F:\20080618.rar
Status: 可疑病毒
病毒: BehavesLike:Win32.Malware (BD 引擎)
对象: 20080618\XX_229.exe
在压缩档案里: F:\20080618.rar
Status: 已发现病毒
病毒: Backdoor.Bifrose.UW (BD 引擎)
对象: 20080618\XX_234.exE
在压缩档案里: F:\20080618.rar
Status: 已发现病毒
病毒: Trojan.PWS.OnLineGames.NVI (BD 引擎)
对象: 20080618\XX_241.exe
在压缩档案里: F:\20080618.rar
Status: 已发现病毒
病毒: Trojan.Pws.Delf.TY (BD 引擎)
对象: 20080618\XX_243.exe
在压缩档案里: F:\20080618.rar
Status: 已发现病毒
病毒: Backdoor.Bandok.BJ (BD 引擎)
对象: 20080618\XX_251.exe
在压缩档案里: F:\20080618.rar
Status: 已发现病毒
病毒: Backdoor.Firefly.I (BD 引擎)
对象: 20080618\XX_252.exe
在压缩档案里: F:\20080618.rar
Status: 已发现病毒
病毒: MemScan:Win32.Worm.Delf.NEX (BD 引擎)
对象: 20080618\XX_254.exe
在压缩档案里: F:\20080618.rar
Status: 已发现病毒
病毒: Trojan.Dropper.VB.AQD (BD 引擎)
对象: 20080618\XX_255.exe
在压缩档案里: F:\20080618.rar
Status: 已发现病毒
病毒: Trojan.Downloader.Agent.ZCR (BD 引擎)
对象: 20080618\XX_262.exe
在压缩档案里: F:\20080618.rar
Status: 已发现病毒
病毒: Trojan.VB.NPY (BD 引擎)
对象: 20080618\XX_264.exe
在压缩档案里: F:\20080618.rar
Status: 已发现病毒
病毒: Trojan.Inject.GP (BD 引擎)
对象: 20080618\XX_267.exe
在压缩档案里: F:\20080618.rar
Status: 已发现病毒
病毒: Dropped:Trojan.Generic.242864 (BD 引擎)
对象: 20080618\XX_268.exe
在压缩档案里: F:\20080618.rar
Status: 已发现病毒
病毒: Trojan.Dropper.VB.1 (BD 引擎)

显示全部楼层 · 发表于 2008-6-18 22:43:48

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\20080618'
C:\Documents and Settings\Administrator\桌面\20080618\XX_220.exe
   [DETECTION] Is the Trojan horse TR/Drop.Agent.12134
   [NOTE]    A backup was created as '48b81f81.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\20080618\XX_228.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
   [NOTE]    A backup was created as '4930a512.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\20080618\XX_229.exe
   [DETECTION] Is the Trojan horse TR/Drop.Delf.gn
   [NOTE]    A backup was created as '48b81f83.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\20080618\XX_234.exE
   [DETECTION] Is the Trojan horse TR/Hijacker.Gen
   [NOTE]    A backup was created as '4930a514.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\20080618\XX_241.exe
   [DETECTION] Is the Trojan horse TR/Proxy.Delf.CA
   [NOTE]    A backup was created as '48b81f82.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\20080618\XX_243.exe
   [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
   [NOTE]    A backup was created as '4930a513.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\20080618\XX_248.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [NOTE]    A backup was created as '48b81f84.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\20080618\XX_251.exe
   [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/FireFly.I.19 Backdoor server programs
   [NOTE]    A backup was created as '4930a515.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\20080618\XX_252.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
   [NOTE]    A backup was created as '48b81f86.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\20080618\XX_254.exe
   [DETECTION] Is the Trojan horse TR/Dldr.VB.ebb.4
   [NOTE]    A backup was created as '4930a517.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\20080618\XX_255.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.7168.31
   [NOTE]    A backup was created as '48b81f88.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\20080618\XX_262.exe
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/Inrok.1
   --> Object
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.zrv
   [NOTE]    A backup was created as '4930a519.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\20080618\XX_264.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.YZD
   [NOTE]    A backup was created as '48b81f8a.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\20080618\XX_267.exe
   [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
   [NOTE]    A backup was created as '4930a51b.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\20080618\XX_268.exe
   [DETECTION] Is the Trojan horse TR/Drop.VB.1.74
   [NOTE]    A backup was created as '48b81f8c.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!

End of the scan: 2008年6月18日  22:43
Used time: 00:02 min

The scan has been done completely.

   1 Scanning directories
   15 Files were scanned
   16 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   15 files were deleted
   0 files were repaired
   15 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   -1 Files not concerned
   0 Archives were scanned
   0 Warnings
   15 Notes

显示全部楼层 · 发表于 2008-6-18 22:44:32

BD漏了XX_248.exe

显示全部楼层 · 发表于 2008-6-18 22:46:11

剩余264.exe一个！TIS

显示全部楼层 · 发表于 2008-6-18 22:46:40

xx_228 xx_248 xx_264三个江民未报

显示全部楼层 · 发表于 2008-6-18 22:47:21

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.SunOnline.nh
病毒： Backdoor.Bifrose.ddk
病毒： Trojan.PSW.Win32.GameOL.nsu
病毒： Trojan.PSW.Delf.esx
病毒： Suspicious.Trojan.Win32.Downldr.a
病毒： Backdoor.FireFly.bc
病毒： Worm.Win32.Agent.zoi
病毒： Trojan.Win32.Undef.dnc
病毒： Trojan.DL.Win32.VB.ysq
病毒： Worm.Win32.VB.zqe
病毒： Backdoor.Win32.IRAT.h

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.49.22

显示全部楼层 · 发表于 2008-6-18 22:47:55

13个/15

显示全部楼层 · 发表于 2008-6-18 23:00:03

无法识别的..已上传卡巴分析

显示全部楼层 · 发表于 2008-6-18 23:01:05

D:\firefox download\20080618.rar » RAR » 20080618\XX_220.exe - Win32/PSW.OnLineGames.PBQ trojan
D:\firefox download\20080618.rar » RAR » 20080618\XX_228.exe » UPX v12_m2 - is OK
D:\firefox download\20080618.rar » RAR » 20080618\XX_229.exe - Win32/Bifrose.E trojan
D:\firefox download\20080618.rar » RAR » 20080618\XX_234.exE - a variant of Win32/PSW.OnLineGames.OAR trojan
D:\firefox download\20080618.rar » RAR » 20080618\XX_241.exe - a variant of Win32/PSW.Delf.TY trojan
D:\firefox download\20080618.rar » RAR » 20080618\XX_243.exe - a variant of Win32/Bandok trojan
D:\firefox download\20080618.rar » RAR » 20080618\XX_248.exe - probably a variant of Win32/Genetik trojan
D:\firefox download\20080618.rar » RAR » 20080618\XX_251.exe - probably a variant of Win32/Delf trojan
D:\firefox download\20080618.rar » RAR » 20080618\XX_252.exe - probably a variant of Win32/Delf.NDF worm
D:\firefox download\20080618.rar » RAR » 20080618\XX_254.exe - probably unknown NewHeur_PE virus
D:\firefox download\20080618.rar » RAR » 20080618\XX_255.exe - Win32/Poison.NAE trojan
D:\firefox download\20080618.rar » RAR » 20080618\XX_262.exe - Win32/VB.NMV trojan
D:\firefox download\20080618.rar » RAR » 20080618\XX_264.exe - is OK
D:\firefox download\20080618.rar » RAR » 20080618\XX_267.exe - is OK
D:\firefox download\20080618.rar » RAR » 20080618\XX_268.exe - is OK
D:\firefox download\20080618.rar:Zone.Identifier - is OK

[病毒样本] 番茄每日精选 20080618

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

30/11

mcafee

回复 1楼 lanvin 的帖子

11