[病毒样本] x24

显示全部楼层 · 发表于 2008-7-5 19:01:35

deleted: Trojan program Backdoor.Win32.Popwin.brn File: C:\Documents and Settings\kato9096\®à±\24.rar/137A90C8.DLL
deleted: Trojan program Backdoor.Win32.Popwin.brm File: C:\Documents and Settings\kato9096\®à±\24.rar/1602A8AE.EXE//PE_Patch//UPack
deleted: Trojan program Trojan-GameThief.Win32.OnLineGames.savy File: C:\Documents and Settings\kato9096\®à±\24.rar/cedafb.dll
deleted: Trojan program Trojan-GameThief.Win32.OnLineGames.sasw File: C:\Documents and Settings\kato9096\®à±\24.rar/ddserh.dll
deleted: Trojan program Trojan-GameThief.Win32.OnLineGames.rxww File: C:\Documents and Settings\kato9096\®à±\24.rar/fmcvxy.dll
deleted: Trojan program Trojan-GameThief.Win32.OnLineGames.saqk File: C:\Documents and Settings\kato9096\®à±\24.rar/fsrgeb.dll
deleted: Trojan program Trojan-GameThief.Win32.OnLineGames.saev File: C:\Documents and Settings\kato9096\®à±\24.rar/hhrdxd.dll
deleted: Trojan program Trojan-GameThief.Win32.OnLineGames.sanw File: C:\Documents and Settings\kato9096\®à±\24.rar/jdsaex.dll
deleted: Trojan program Trojan-GameThief.Win32.OnLineGames.safb File: C:\Documents and Settings\kato9096\®à±\24.rar/jfrwdh.dll
deleted: Trojan program Trojan-GameThief.Win32.OnLineGames.sait File: C:\Documents and Settings\kato9096\®à±\24.rar/jggtsr.dll
deleted: Trojan program Trojan-GameThief.Win32.OnLineGames.ryqk File: C:\Documents and Settings\kato9096\®à±\24.rar/jhfrxz.dll
deleted: Trojan program Trojan-GameThief.Win32.OnLineGames.sbap File: C:\Documents and Settings\kato9096\®à±\24.rar/mfdesy.dll
deleted: Trojan program Trojan-GameThief.Win32.OnLineGames.sbex File: C:\Documents and Settings\kato9096\®à±\24.rar/pedadt.dll
deleted: Trojan program Trojan-GameThief.Win32.OnLineGames.sazf File: C:\Documents and Settings\kato9096\®à±\24.rar/rfdswc.dll
deleted: Trojan program Trojan-GameThief.Win32.OnLineGames.sazm File: C:\Documents and Settings\kato9096\®à±\24.rar/sgdewg.dll
deleted: Trojan program Trojan-GameThief.Win32.OnLineGames.rxzy File: C:\Documents and Settings\kato9096\®à±\24.rar/tdffdl.dll//data0000
deleted: Trojan program Trojan-GameThief.Win32.OnLineGames.rxzy File: C:\Documents and Settings\kato9096\®à±\24.rar/tdffdl.dll//data0001
deleted: Trojan program Trojan-GameThief.Win32.OnLineGames.rxzy File: C:\Documents and Settings\kato9096\®à±\24.rar/tdffdl.dll//data0002
deleted: Trojan program Trojan-GameThief.Win32.OnLineGames.rxzy File: C:\Documents and Settings\kato9096\®à±\24.rar/tdffdl.dll//data0003
deleted: Trojan program Trojan-GameThief.Win32.OnLineGames.rxzy File: C:\Documents and Settings\kato9096\®à±\24.rar/tdffdl.dll//data0004
deleted: Trojan program Trojan-GameThief.Win32.OnLineGames.rxzy File: C:\Documents and Settings\kato9096\®à±\24.rar/tdffdl.dll//data0005
deleted: Trojan program Trojan-GameThief.Win32.OnLineGames.sbch File: C:\Documents and Settings\kato9096\®à±\24.rar/tdggrz.dll
deleted: Trojan program Trojan-PSW.Win32.QQPass.cdw File: C:\Documents and Settings\kato9096\®à±\24.rar/UnixSys08.Sys
deleted: Trojan program Trojan-GameThief.Win32.OnLineGames.sabp File: C:\Documents and Settings\kato9096\®à±\24.rar/wklsdd.dll
deleted: Trojan program Trojan-GameThief.Win32.OnLineGames.sbew File: C:\Documents and Settings\kato9096\®à±\24.rar/wyrsdj.dll
deleted: Trojan program Trojan-GameThief.Win32.OnLineGames.rxww File: C:\Documents and Settings\kato9096\®à±\24.rar/zefdst.dll
deleted: Trojan program Trojan-GameThief.Win32.OnLineGames.sahx File: C:\Documents and Settings\kato9096\®à±\24.rar/zgrjdx.dll

27,有2个不报,已上报.

显示全部楼层 · 发表于 2008-7-5 19:47:32

Begin scan in 'C:\Documents and Settings\Administrator\桌面\24'
C:\Documents and Settings\Administrator\桌面\24\137A90C8.DLL
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.53248
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\24\1602A8AE.EXE
   [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Popwin.brm Backdoor server programs
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\24\cedafb.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\24\ddserh.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\24\fmcvxy.dll
   [DETECTION] Is the Trojan horse TR/Crypt.Delf.F.410
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\24\fsrgeb.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\24\hhrdxd.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\24\jdsaex.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\24\jfrwdh.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\24\jggtsr.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\24\jhfrxz.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\24\mfdesy.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\24\pedadt.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\24\rfdswc.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\24\sgdewg.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\24\tdffdl.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\24\tdggrz.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\24\tfsdmz.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\24\UnixSys08.Sys
   [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\24\wklsdd.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\24\wyrsdj.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\24\zefdst.dll
   [DETECTION] Is the Trojan horse TR/Crypt.Delf.F.417
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\24\zgrjdx.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!

End of the scan: 星期六 2008年7月5日  19:47
Used time: 00:15 min

The scan has been done completely.

   1 Scanning directories
   24 Files were scanned
   23 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   23 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   0 Archives were scanned
   0 Warnings
   23 Notes

显示全部楼层 · 发表于 2008-7-5 19:49:26

Filename Result
UnixSys32.Jmp UNDER ANALYSIS

The file 'UnixSys32.Jmp' has been determined to be 'UNDER ANALYSIS'.

显示全部楼层 · 发表于 2008-7-5 20:01:32

kv 23个

显示全部楼层 · 发表于 2008-7-5 20:02:17

MicroVita AntiSpyware
_____________________________________________

         风暴微塔反间谍 T2
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]
               http://221.10.254.214/
----------------------------------------------
开始扫描……

正在检查启动……
[C:\Documents and Settings\Administrator\桌面\24\1602A8AE.EXE]
                  …………发现Spy！报告:[1] Win32.Unknow
文件信息:  大小:14471  MD5:550d1883be008d894fe1d4f86a6707ac

文件数:22 病毒数:1  比重:0.04545454545455
OK  扫描完毕！

  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎
[2] 文件特征码引擎
[1] 文件启发式引擎

显示全部楼层 · 发表于 2008-7-5 20:02:55

已发现病毒数量: 23

显示全部楼层 · 发表于 2008-7-5 20:13:41

[Found downloader] <W32/Downloader.C.gen!Eldorado (not disinfectable, generic)> C:\Download Files\24.rar->137A90C8.DLL
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Download Files\24.rar->1602A8AE.EXE->(UPack)
[Found virus] <W32/InfoStealer!Generic (not disinfectable)> C:\Download Files\24.rar->jfrwdh.dll
[Found virus] <W32/InfoStealer!Generic (not disinfectable)> C:\Download Files\24.rar->UnixSys08.Sys

---------------------------------------------------------------------
Scan ended: 2008-7-5, 20:13:19
Duration: 0:00:04

Scan result:

Scanned files:    7
Infected objects:    4
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

显示全部楼层 · 发表于 2008-7-5 20:14:39

[Scanning : C:\Download Files]

C:\Download Files\24.rar<RAR>:137A90C8.DLL <- Trojan.Popwin.Brn : No action
C:\Download Files\24.rar<RAR>:1602A8AE.EXE <- Trojan.Popwin.Brm : No action
C:\Download Files\24.rar<RAR>:fmcvxy.dll <- Trojan.Gamethief.Onlinegames.Rxww : No action
C:\Download Files\24.rar<RAR>:fmcvxy.dll<DLLRES>:file0.exe <- Trojan.Gamethief.Onlinegames.Rxww : No action
C:\Download Files\24.rar<RAR>:fmcvxy.dll<DLLRES>:file1.exe <- Trojan.Gamethief.Onlinegames.Rxww : No action
C:\Download Files\24.rar<RAR>:fmcvxy.dll<DLLRES>:file2.exe <- Trojan.Gamethief.Onlinegames.Rxww : No action
C:\Download Files\24.rar<RAR>:fmcvxy.dll<DLLRES>:file3.exe <- Trojan.Gamethief.Onlinegames.Rxww : No action
C:\Download Files\24.rar<RAR>:fmcvxy.dll<DLLRES>:file4.exe <- Trojan.Gamethief.Onlinegames.Rxww : No action
C:\Download Files\24.rar<RAR>:fmcvxy.dll<DLLRES>:file5.exe <- Trojan.Gamethief.Onlinegames.Rxww : No action
C:\Download Files\24.rar<RAR>:jhfrxz.dll <- Trojan.Gamethief.Onlinegames.Ryqk : No action
C:\Download Files\24.rar<RAR>:jhfrxz.dll<DLLRES>:file0.exe <- Trojan.Gamethief.Onlinegames.Ryqk : No action
C:\Download Files\24.rar<RAR>:jhfrxz.dll<DLLRES>:file1.exe <- Trojan.Gamethief.Onlinegames.Ryqk : No action
C:\Download Files\24.rar<RAR>:jhfrxz.dll<DLLRES>:file2.exe <- Trojan.Gamethief.Onlinegames.Ryqk : No action
C:\Download Files\24.rar<RAR>:jhfrxz.dll<DLLRES>:file3.exe <- Trojan.Gamethief.Onlinegames.Ryqk : No action
C:\Download Files\24.rar<RAR>:jhfrxz.dll<DLLRES>:file4.exe <- Trojan.Gamethief.Onlinegames.Ryqk : No action
C:\Download Files\24.rar<RAR>:jhfrxz.dll<DLLRES>:file5.exe <- Trojan.Gamethief.Onlinegames.Ryqk : No action
C:\Download Files\24.rar<RAR>:UnixSys08.Sys <- Trojan.Psw.Qqpass.Cdw : No action
C:\Download Files\24.rar<RAR>:zefdst.dll <- Trojan.Gamethief.Onlinegames.Rxww : No action
C:\Download Files\24.rar<RAR>:zefdst.dll<DLLRES>:file0.exe <- Trojan.Gamethief.Onlinegames.Rxww : No action
C:\Download Files\24.rar<RAR>:zefdst.dll<DLLRES>:file1.exe <- Trojan.Gamethief.Onlinegames.Rxww : No action
C:\Download Files\24.rar<RAR>:zefdst.dll<DLLRES>:file2.exe <- Trojan.Gamethief.Onlinegames.Rxww : No action
C:\Download Files\24.rar<RAR>:zefdst.dll<DLLRES>:file3.exe <- Trojan.Gamethief.Onlinegames.Rxww : No action
C:\Download Files\24.rar<RAR>:zefdst.dll<DLLRES>:file4.exe <- Trojan.Gamethief.Onlinegames.Rxww : No action
C:\Download Files\24.rar<RAR>:zefdst.dll<DLLRES>:file5.exe <- Trojan.Gamethief.Onlinegames.Rxww : No action

Scanned objects : 147

Infected objects : 24

显示全部楼层 · 发表于 2008-7-5 20:26:24

病毒 2008-07-05  20:25:41 C:\Documents and Settings\Administrator\桌面\24.rar\zgrjdx.dll Win32.Troj.OnlienGamesT.ny.232960 清除成功
病毒 2008-07-05  20:25:41 C:\Documents and Settings\Administrator\桌面\24.rar\zefdst.dll Win32.Troj.OnlienGamesT.ny.254464 清除成功
病毒 2008-07-05  20:25:41 C:\Documents and Settings\Administrator\桌面\24.rar\wyrsdj.dll Win32.Troj.OnlienGamesT.ny.232960 清除成功
病毒 2008-07-05  20:25:41 C:\Documents and Settings\Administrator\桌面\24.rar\wklsdd.dll Win32.Troj.OnlienGamesT.ny.232960 清除成功
病毒 2008-07-05  20:25:41 C:\Documents and Settings\Administrator\桌面\24.rar\UnixSys08.Sys Win32.Troj.QQPassT.va.48260 清除成功
病毒 2008-07-05  20:25:41 C:\Documents and Settings\Administrator\桌面\24.rar\tfsdmz.dll Win32.Troj.OnlienGamesT.ny.232960 清除成功
病毒 2008-07-05  20:25:41 C:\Documents and Settings\Administrator\桌面\24.rar\tdggrz.dll Win32.Troj.OnlienGamesT.ny.232960 清除成功
病毒 2008-07-05  20:25:41 C:\Documents and Settings\Administrator\桌面\24.rar\tdffdl.dll Win32.Troj.OnlienGamesT.ny.254464 清除成功
病毒 2008-07-05  20:25:41 C:\Documents and Settings\Administrator\桌面\24.rar\sgdewg.dll Win32.Troj.OnlienGamesT.ny.232960 清除成功
病毒 2008-07-05  20:25:41 C:\Documents and Settings\Administrator\桌面\24.rar\rfdswc.dll Win32.Troj.OnlienGamesT.ny.232960 清除成功
病毒 2008-07-05  20:25:41 C:\Documents and Settings\Administrator\桌面\24.rar\pedadt.dll Win32.Troj.OnlienGamesT.ny.232960 清除成功
病毒 2008-07-05  20:25:41 C:\Documents and Settings\Administrator\桌面\24.rar\mfdesy.dll Win32.Troj.OnlienGamesT.ny.232960 清除成功
病毒 2008-07-05  20:25:41 C:\Documents and Settings\Administrator\桌面\24.rar\jhfrxz.dll Win32.Troj.OnlienGamesT.ny.254464 清除成功
病毒 2008-07-05  20:25:41 C:\Documents and Settings\Administrator\桌面\24.rar\jggtsr.dll Win32.Troj.OnlienGamesT.ny.232960 清除成功
病毒 2008-07-05  20:25:41 C:\Documents and Settings\Administrator\桌面\24.rar\jfrwdh.dll Win32.Troj.OnlienGamesT.ny.232960 清除成功
病毒 2008-07-05  20:25:41 C:\Documents and Settings\Administrator\桌面\24.rar\jdsaex.dll Win32.Troj.OnlienGamesT.ny.232960 清除成功
病毒 2008-07-05  20:25:41 C:\Documents and Settings\Administrator\桌面\24.rar\hhrdxd.dll Win32.Troj.OnlienGamesT.ny.232960 清除成功
病毒 2008-07-05  20:25:41 C:\Documents and Settings\Administrator\桌面\24.rar\fsrgeb.dll Win32.Troj.OnlienGamesT.ny.232960 清除成功
病毒 2008-07-05  20:25:41 C:\Documents and Settings\Administrator\桌面\24.rar\fmcvxy.dll Win32.Troj.OnlienGamesT.ny.254464 清除成功
病毒 2008-07-05  20:25:41 C:\Documents and Settings\Administrator\桌面\24.rar\ddserh.dll Win32.Troj.OnlienGamesT.ny.232960 清除成功
病毒 2008-07-05  20:25:41 C:\Documents and Settings\Administrator\桌面\24.rar\cedafb.dll Win32.Troj.OnlienGamesT.ny.232960 清除成功
病毒 2008-07-05  20:25:41 C:\Documents and Settings\Administrator\桌面\24.rar\1602A8AE.EXE Worm.DownLoaderT.at.180224 清除成功
病毒 2008-07-05  20:25:41 C:\Documents and Settings\Administrator\桌面\24.rar\137A90C8.DLL Win32.Troj.Pophot.ex.49152 清除成功

[病毒样本] x24

本帖子中包含更多资源

F-Prot 4.4.4

ArcaVir2008