[病毒样本] 17

显示全部楼层 · 发表于 2008-6-22 23:32:22

已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Agent.sqc 檔案: C:\Documents and Settings\kato9096\桌面\複製 -RsAgent.rar/Jack.exe1
已刪除: 特洛伊木馬程式 Backdoor.Win32.Ceckno.bdv 檔案: C:\Documents and Settings\kato9096\桌面\複製 -RsAgent.rar/xm.SYS2
已刪除: 特洛伊木馬程式 Trojan-Spy.Win32.Ardamax.gx 檔案: C:\Documents and Settings\kato9096\桌面\複製 -RsAgent.rar/FireFoxUpdater.exe2//PE_Patch//MEW
已刪除: 特洛伊木馬程式 Trojan.Win32.Agent.sav 檔案: C:\Documents and Settings\kato9096\桌面\複製 -RsAgent.rar/tpilerdk.exe1//PE_Patch.UPX//UPX
已刪除: 病毒 Worm.Win32.Downloader.on 檔案: C:\Documents and Settings\kato9096\桌面\複製 -RsAgent.rar/UUSeeMediaCenter.exe1//PE_Patch//UPack
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.BHO.bnp 檔案: C:\Documents and Settings\kato9096\桌面\複製 -RsAgent.rar/1cc1.dll2

6个,不报的已上报卡巴

[ 本帖最后由 kato9096 于 2008-6-22 23:34 编辑 ]

显示全部楼层 · 发表于 2008-6-22 23:37:08

显示全部楼层 · 发表于 2008-6-22 23:44:22

显示全部楼层 · 发表于 2008-6-22 23:46:50

这是什么來的

沒見过

显示全部楼层 · 发表于 2008-6-22 23:51:16

11
Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\RsAgent'
C:\Documents and Settings\Administrator\桌面\RsAgent\1cc1.dll2
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Bho.bnp
   [NOTE]    A backup was created as '48c1753b.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\RsAgent\Access.exe2
  [0] Archive type: RSRC
  --> Object
   [DETECTION] Contains suspicious code HEUR/Malware
   [NOTE]    A backup was created as '4946608c.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\RsAgent\AQBZYKICD1R.exe2
   [DETECTION] Is the Trojan horse TR/Drop.Agent.53248
   [NOTE]    A backup was created as '48a07529.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\RsAgent\FireFoxUpdater.exe2
   [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
   [NOTE]    A backup was created as '48d07541.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\RsAgent\Jack.exe1
   [DETECTION] Is the Trojan horse TR/Dldr.StartPa.B
   [NOTE]    A backup was created as '48c17539.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\RsAgent\RsAgent.dll2
   [DETECTION] Contains suspicious code HEUR/Crypted
   [NOTE]    The fund was classified as suspicious.
   [NOTE]    A backup was created as '489f754b.qua'  ( QUARANTINE )
C:\Documents and Settings\Administrator\桌面\RsAgent\stormliv.exe1
   [DETECTION] Contains suspicious code HEUR/Malware
   [NOTE]    The fund was classified as suspicious.
   [NOTE]    A backup was created as '48cd754c.qua'  ( QUARANTINE )
C:\Documents and Settings\Administrator\桌面\RsAgent\tpilerdk.exe1
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    A backup was created as '48c77548.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\RsAgent\UUSeeMediaCenter.exe1
   [DETECTION] Is the Trojan horse TR/Hijacker.Gen
   [NOTE]    A backup was created as '48b1752d.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\RsAgent\xm.SYS2
   [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Ceckno.bdv Backdoor server programs
   [NOTE]    A backup was created as '488c7545.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\RsAgent\ZSC9QLVJYM73msi.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
   [NOTE]    A backup was created as '48a1752b.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!

End of the scan: 2008年6月22日  23:50
Used time: 00:03 min

The scan has been done completely.

   1 Scanning directories
   17 Files were scanned
   8 viruses and/or unwanted programs were found
   3 Files were classified as suspicious:
   9 files were deleted
   0 files were repaired
   11 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   9 Files not concerned
   0 Archives were scanned
   0 Warnings
   11 Notes

25054762	gtwatch.exe3	28 KB	UNDER ANALYSIS
25054763	RsAgent.dll2	466.36 KB	UNDER ANALYSIS
25054764	spssvr.exe3	14.5 KB	UNDER ANALYSIS
25054765	stormliv.exe1	28 KB	UNDER ANALYSIS
25054766	uu.htm2	355 Byte	UNDER ANALYSIS
25054767	UUUpgrade.ini	237 Byte	UNDER ANALYSIS
515031	reg.exe2	63 KB	KNOWN CLEAN
205687	sc.exe5	30.5 KB	KNOWN CLEAN

[ 本帖最后由 Kitman 于 2008-6-22 23:53 编辑 ]

显示全部楼层 · 发表于 2008-6-23 00:23:26

TRUST PORT 来自捷克的五引擎怪物

，很强很暴力

显示全部楼层 · 发表于 2008-6-23 00:25:02

IKARUS 9
D:\病毒测试\临时解压\RsAgent.rar:\RsAgent.dll2 - 特征码 'VirTool.Win32.DelfInject.X' 被发现
D:\病毒测试\临时解压\RsAgent.rar:\Access.exe2
D:\病毒测试\临时解压\RsAgent.rar:\stormliv.exe1
D:\病毒测试\临时解压\RsAgent.rar:\Jack.exe1 - 特征码 'Trojan-Downloader.Win32.Agent.sqc' 被发现
D:\病毒测试\临时解压\RsAgent.rar:\spssvr.exe3 - 特征码 'Trojan.Win32.Arveye.A' 被发现
D:\病毒测试\临时解压\RsAgent.rar:\xm.SYS2 - 特征码 'Backdoor.Win32.Ceckno.bdv' 被发现
D:\病毒测试\临时解压\RsAgent.rar:\AQBZYKICD1R.exe2 - 特征码 'Trojan-Dropper.Agent.zaf' 被发现
D:\病毒测试\临时解压\RsAgent.rar:\FireFoxUpdater.exe2 - 特征码 'Backdoor.Win32.IRCBot.BV' 被发现
D:\病毒测试\临时解压\RsAgent.rar:\gtwatch.exe3
D:\病毒测试\临时解压\RsAgent.rar:\reg.exe2
D:\病毒测试\临时解压\RsAgent.rar:\sc.exe5
D:\病毒测试\临时解压\RsAgent.rar:\ZSC9QLVJYM73msi.exe3
D:\病毒测试\临时解压\RsAgent.rar:\tpilerdk.exe1 - 特征码 'Trojan-PWS.OnlineGames.ZAY' 被发现
D:\病毒测试\临时解压\RsAgent.rar:\uu.htm2
D:\病毒测试\临时解压\RsAgent.rar:\UUSeeMediaCenter.exe1 - 特征码 'Win32.SuspectCrc' 被发现
D:\病毒测试\临时解压\RsAgent.rar:\UUUpgrade.ini
D:\病毒测试\临时解压\RsAgent.rar:\1cc1.dll2 - 特征码 'Virus.Win32.Qhost.AYU' 被发现
D:\病毒测试\临时解压\RsAgent.rar

18 文件被扫描
(1 压缩档 17 文件)
9 特征码被侦测
0 可疑代码段被发现
耗时: 0:08.122

显示全部楼层 · 发表于 2008-6-23 00:27:24

avast!  3
2008-6-23 0:26:07 LuckyStar 1904 Sign of "Win32:Agent-XJF [Trj]" has been found in "D:\病毒测试\临时解压\RsAgent.rar\Jack.exe1" file.
2008-6-23 0:26:07 LuckyStar 1904 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "D:\病毒测试\临时解压\RsAgent.rar\xm.SYS2" file.
2008-6-23 0:26:07 LuckyStar 1904 Sign of "Win32:Trojan-gen {Other}" has been found in "D:\病毒测试\临时解压\RsAgent.rar\UUSeeMediaCenter.exe1\[Upack]\[Embedded#03008]\[Embedded#0a808]" file.

显示全部楼层 · 发表于 2008-6-23 01:32:01

D:\下载文件夹\RsAgent.rar > RAR > Access.exe2 - 未查明的 NewHeur_PE 病毒
D:\下载文件夹\RsAgent.rar > RAR > stormliv.exe1 - 未查明的 NewHeur_PE 病毒
D:\下载文件夹\RsAgent.rar > RAR > FireFoxUpdater.exe2 - 未查明的 NewHeur_PE 病毒
D:\下载文件夹\RsAgent.rar > RAR > UUSeeMediaCenter.exe1 - 可能是 Win32/Jalous 蠕虫的变种

显示全部楼层 · 发表于 2008-6-23 01:37:45

无法识别的//已上传卡巴分析

[病毒样本] 17

本帖子中包含更多资源

rising kill

本帖子中包含更多资源

本帖子中包含更多资源

回复 3楼 linkak 的帖子

回复 4楼 kato9096 的帖子

回复 1楼 kato9096 的帖子