[病毒样本] 6

显示全部楼层 · 发表于 2008-6-19 20:36:26

已刪除: 廣告軟體 not-a-virus:AdWare.Win32.BHO.bnp 檔案: C:\Documents and Settings\kato9096\桌面\1cc1\1cc1.dll
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Agent.tyc 檔案: C:\Documents and Settings\kato9096\桌面\1cc1\orz.exe2//UPack
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Agent.rlr 檔案: C:\Documents and Settings\kato9096\桌面\1cc1\WINHLP32.EXE2//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Agent.rlr 檔案: C:\Documents and Settings\kato9096\桌面\1cc1\WINHLP32.EXE3//PE_Patch//UPack

已上报2个到卡巴!!!!

显示全部楼层 · 发表于 2008-6-19 20:38:42

显示全部楼层 · 发表于 2008-6-19 20:41:37

D:\download\1cc1.rar>>1cc1.dll Adware.BHO.bnp.oycd.dll 广告程序还未处理
D:\download\1cc1.rar>>orz.exe2 TrojanDropper.Gen.dhbp 木马还未处理
D:\download\1cc1.rar>>WINHLP32.EXE2 TrojanDownloader.Nurech.bd.bmqk 木马还未处理
D:\download\1cc1.rar>>WINHLP32.EXE3 TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理

显示全部楼层 · 发表于 2008-6-19 20:42:55

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： RootKit.Win32.Agent.bcj
病毒： RootKit.Win32.Agent.bcj

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.49.32

显示全部楼层 · 发表于 2008-6-19 20:44:48

Vba32 3.12.7 Beta:
C:\Malware Test\1cc1.rar\<RAR>:WINHLP32.EXE2;;Infected;Trojan-Downloader.Win32.Agent.rlr;;
C:\Malware Test\1cc1.rar\<RAR>:WINHLP32.EXE3;;Infected;Trojan-Downloader.Win32.Agent.rlr;;

显示全部楼层 · 发表于 2008-6-19 20:46:11

00003410 00403410 0 http://www.infomt.net/dk.txt

显示全部楼层 · 发表于 2008-6-19 21:05:25

原帖由 EQ2 于 2008-6-19 20:46 发表
00003410 00403410 0 http://www.infomt.net/dk.txt

打包

显示全部楼层 · 发表于 2008-6-19 21:06:55

Starting the file scan:

Begin scan in 'C:\Documents and Settings\kato9096\桌面\85555'
C:\Documents and Settings\kato9096\桌面\85555\85555\soft0.exe3
   [DETECTION] Is the Trojan horse TR/Agent.nbj
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft1.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft10.exe3
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.ucm
   [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft11.exe3
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft12.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft13.exe3
   [DETECTION] Is the Trojan horse TR/Agent.qsa
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft14.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft15.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft16.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft17.exe3
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft18.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft19.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft2.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft20.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft21.exe3
   [DETECTION] Is the Trojan horse TR/Agent.1068320
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft22.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft23.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft24.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft25.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft26.exe3
   [DETECTION] Contains detection pattern of the Windows virus W32/Hllp.Alcaul.e
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft27.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft28.exe3
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.akxv
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft29.exe3
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft3.exe3
   [DETECTION] Is the Trojan horse TR/PWS.Lmir.UMK
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft30.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft31.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft32.exe3
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.amdt
   [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft33.exe3
   [DETECTION] Is the Trojan horse TR/Agent.NBJ.1
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft4.exe3
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.apth
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft5.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft6.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft7.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft8.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\85555\85555\soft9.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!

End of the scan: Thursday,19 June 2008  21:09
Used time: 00:29 min

The scan has been done completely.

   2 Scanning directories
   34 Files were scanned
   37 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   34 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   -3 Files not concerned
   0 Archives were scanned
   0 Warnings
   34 Notes

清空

已刪除: 特洛伊木馬程式 Trojan.Win32.Agent.nbj 檔案: C:\Documents and Settings\kato9096\桌面\85555.rar/85555\soft0.exe3
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aqzw 檔案: C:\Documents and Settings\kato9096\桌面\85555.rar/85555\soft1.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Agent.ucl 檔案: C:\Documents and Settings\kato9096\桌面\85555.rar/85555\soft10.exe3//FSG
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aqeb 檔案: C:\Documents and Settings\kato9096\桌面\85555.rar/85555\soft12.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.arpk 檔案: C:\Documents and Settings\kato9096\桌面\85555.rar/85555\soft16.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.arpk 檔案: C:\Documents and Settings\kato9096\桌面\85555.rar/85555\soft19.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.apqd 檔案: C:\Documents and Settings\kato9096\桌面\85555.rar/85555\soft2.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aqjy 檔案: C:\Documents and Settings\kato9096\桌面\85555.rar/85555\soft20.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aqzw 檔案: C:\Documents and Settings\kato9096\桌面\85555.rar/85555\soft22.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.arza 檔案: C:\Documents and Settings\kato9096\桌面\85555.rar/85555\soft24.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.arza 檔案: C:\Documents and Settings\kato9096\桌面\85555.rar/85555\soft25.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aqeb 檔案: C:\Documents and Settings\kato9096\桌面\85555.rar/85555\soft26.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aqeb 檔案: C:\Documents and Settings\kato9096\桌面\85555.rar/85555\soft27.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.akxv 檔案: C:\Documents and Settings\kato9096\桌面\85555.rar/85555\soft28.exe3//FSG
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.armt 檔案: C:\Documents and Settings\kato9096\桌面\85555.rar/85555\soft29.exe3
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.apla 檔案: C:\Documents and Settings\kato9096\桌面\85555.rar/85555\soft31.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.amey 檔案: C:\Documents and Settings\kato9096\桌面\85555.rar/85555\soft32.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan.Win32.Agent.nbj 檔案: C:\Documents and Settings\kato9096\桌面\85555.rar/85555\soft33.exe3
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.apbz 檔案: C:\Documents and Settings\kato9096\桌面\85555.rar/85555\soft4.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aqeb 檔案: C:\Documents and Settings\kato9096\桌面\85555.rar/85555\soft6.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aqzw 檔案: C:\Documents and Settings\kato9096\桌面\85555.rar/85555\soft7.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aqjy 檔案: C:\Documents and Settings\kato9096\桌面\85555.rar/85555\soft8.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.arlu 檔案: C:\Documents and Settings\kato9096\桌面\85555.rar/85555\soft9.exe3//PE_Patch//UPack

23,已上报

[ 本帖最后由 kato9096 于 2008-6-19 21:09 编辑 ]

显示全部楼层 · 发表于 2008-6-19 21:09:52

Begin scan in 'C:\Documents and Settings\Administrator\桌面\新資料夾'
C:\Documents and Settings\Administrator\桌面\新資料夾\1cc1.dll
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Bho.bnp
   [NOTE]    A backup was created as '48bd5b04.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾\orz.exe2
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/Inject.HN.1
   [NOTE]    A backup was created as '48d45b13.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾\WINHLP32.EXE2
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.rlr
   [NOTE]    A backup was created as '48a85aea.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾\WINHLP32.EXE3
   [DETECTION] Contains suspicious code HEUR/Malware
   [NOTE]    A backup was created as '48a85aeb.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!

End of the scan: 2008年6月19日  21:09
Used time: 00:02 min

The scan has been done completely.

   1 Scanning directories
   6 Files were scanned
   3 viruses and/or unwanted programs were found
   1 Files were classified as suspicious:
   4 files were deleted
   0 files were repaired
   4 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   3 Files not concerned
   0 Archives were scanned
   0 Warnings
   4 Notes
553237    EJ82F1.EXE2    168.07 KB    CLEAN
25052243    user32.dll    544.5 KB    UNDER ANALYSIS

[ 本帖最后由 Kitman 于 2008-6-19 21:11 编辑 ]

显示全部楼层 · 发表于 2008-6-19 21:10:31

D:\download\85555.rar>>85555\soft0.exe3 W32.Small.NDW.akkb 病毒还未处理
D:\download\85555.rar>>85555\soft1.exe3 TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理
D:\download\85555.rar>>85555\soft10.exe3 TrojanDownloader.Agent.ucl.bjda 木马还未处理
D:\download\85555.rar>>85555\soft11.exe3 Heuri.Suspicious.ERNM 启发式扫描还未处理
D:\download\85555.rar>>85555\soft12.exe3 TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理
D:\download\85555.rar>>85555\soft13.exe3 Heuri.Suspicious.ERNM 启发式扫描还未处理
D:\download\85555.rar>>85555\soft14.exe3 TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理
D:\download\85555.rar>>85555\soft15.exe3 TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理
D:\download\85555.rar>>85555\soft16.exe3 TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理
D:\download\85555.rar>>85555\soft17.exe3 Trojan.Cap86191.xbtf 木马还未处理
D:\download\85555.rar>>85555\soft18.exe3 TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理
D:\download\85555.rar>>85555\soft19.exe3 TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理
D:\download\85555.rar>>85555\soft2.exe3 TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理
D:\download\85555.rar>>85555\soft20.exe3 Trojan.Cap861516.xldw 木马还未处理
D:\download\85555.rar>>85555\soft21.exe3 Trojan.Cap861817.kqjc 木马还未处理
D:\download\85555.rar>>85555\soft22.exe3 TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理
D:\download\85555.rar>>85555\soft23.exe3 TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理
D:\download\85555.rar>>85555\soft24.exe3 TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理
D:\download\85555.rar>>85555\soft25.exe3 TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理
D:\download\85555.rar>>85555\soft26.exe3 TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理
D:\download\85555.rar>>85555\soft27.exe3 TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理
D:\download\85555.rar>>85555\soft28.exe3 Trojan.Cap85303.bows 木马还未处理
D:\download\85555.rar>>85555\soft29.exe3 TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理
D:\download\85555.rar>>85555\soft3.exe3 TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理
D:\download\85555.rar>>85555\soft30.exe3 TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理
D:\download\85555.rar>>85555\soft31.exe3 TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理
D:\download\85555.rar>>85555\soft32.exe3 TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理
D:\download\85555.rar>>85555\soft33.exe3 W32.Small.NDW.akkb 病毒还未处理
D:\download\85555.rar>>85555\soft4.exe3 TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理
D:\download\85555.rar>>85555\soft5.exe3 TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理
D:\download\85555.rar>>85555\soft6.exe3 TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理
D:\download\85555.rar>>85555\soft7.exe3 TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理
D:\download\85555.rar>>85555\soft8.exe3 TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理
D:\download\85555.rar>>85555\soft9.exe3 TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理

34

[病毒样本] 6

本帖子中包含更多资源

mcafee报4

12/2

本帖子中包含更多资源

回复 7楼 kato9096 的帖子

回复 7楼 kato9096 的帖子