[病毒样本] 10x

显示全部楼层 · 发表于 2008-7-11 16:40:39

费尔8个

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Backdoor.Win32.PcClient.elm
病毒： Worm.Mail.Win32.Zhelatin.wst
病毒： Trojan.DL.Agent.vl
病毒： Trojan.DL.Win32.Undef.ui

用户来源：互联网

软件版本：20.52.40

显示全部楼层 · 发表于 2008-7-12 09:50:10

2008-7-12 9:49:53 Real-time file system protection file E:\virus\bp0711\85589038 probably a variant of Win32/TrojanDownloader.Tiny.NJ trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-7-12 9:49:52 Real-time file system protection file E:\virus\bp0711\615D55D4 Win32/TrojanDownloader.Agent.OD trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-7-12 9:49:51 Real-time file system protection file E:\virus\bp0711\5D070F48 probably a variant of Win32/Nuwar worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.

显示全部楼层 · 发表于 2008-7-12 11:34:58

已刪除: 特洛伊木馬程式 Backdoor.Win32.PcClient.eua 檔案: C:\Documents and Settings\kato9096\桌面\bp0711.rar/204CB78B
已刪除: 特洛伊木馬程式 Trojan.Win32.Shutdowner.na 檔案: C:\Documents and Settings\kato9096\桌面\bp0711.rar/4E1F1E45
已刪除: 特洛伊木馬程式 Trojan.Win32.Obfuscated.eba 檔案: C:\Documents and Settings\kato9096\桌面\bp0711.rar/4FB84BC2
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Tibs.aeu 檔案: C:\Documents and Settings\kato9096\桌面\bp0711.rar/5D070F48
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Agent.od 檔案: C:\Documents and Settings\kato9096\桌面\bp0711.rar/615D55D4//UPX
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Winlagons.yd 檔案: C:\Documents and Settings\kato9096\桌面\bp0711.rar/85589038//FSG
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.VB.fjy 檔案: C:\Documents and Settings\kato9096\桌面\bp0711.rar/A36A7AA3
已刪除: 特洛伊木馬程式 Backdoor.Win32.SdBot.dna 檔案: C:\Documents and Settings\kato9096\桌面\bp0711.rar/AC8B954D
已刪除: 特洛伊木馬程式 Trojan.Win32.Delf.ddn 檔案: C:\Documents and Settings\kato9096\桌面\bp0711.rar/B0F7F8B7//PE_Patch.UPX//UPX

有一个不报,已上报到卡巴

显示全部楼层 · 发表于 2008-7-12 12:49:12

Start of the scan: 2008年7月11日星期五  19:59

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\bp0711.rar'
C:\Documents and Settings\Administrator\桌面\bp0711.rar
  [0] Archive type: RAR
  --> 204CB78B
   [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Pcclient.eua Backdoor server programs
  --> 4B73AD24
   [DETECTION] Is the Trojan horse TR/Vundo.EQF
  --> 4E1F1E45
   [DETECTION] Is the Trojan horse TR/Shutdowner.NA
  --> 4FB84BC2
   [DETECTION] Is the Trojan horse TR/Obfuscated.eba
  --> 5D070F48
   [DETECTION] Contains detection pattern of the worm WORM/Zhelatin.Gen
  --> 615D55D4
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.OD.8
  --> 85589038
   [DETECTION] Is the Trojan horse TR/Agent.3109.A
  --> A36A7AA3
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> AC8B954D
   [DETECTION] Is the Trojan horse TR/Agent.45056.124
  --> B0F7F8B7
   [DETECTION] Is the Trojan horse TR/Delf.ddn
   [NOTE]    The file was deleted!

End of the scan: 2008年7月11日星期五  20:00
Used time: 00:10 min

The scan has been done completely.

   0 Scanning directories
   11 Files were scanned
   10 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   0 Warnings
   1 Notes

显示全部楼层 · 发表于 2008-7-12 15:58:28

所有的downloader:
http://www.threatexpert.com/repo ... 6ccb4a5ab5b6fffec6f
http://www.threatexpert.com/repo ... c422355dd4e2de04964
http://www.threatexpert.com/repo ... 6a87dac916039ffd251
http://www.threatexpert.com/repo ... 42f33c50e40b4d1bd0e