盗号木马，挂的很惨！几乎都被过了

运指如飞

无意中发现的一个游戏盗号的木马：



这次挂的惨，大家赶紧上报吧


扫描结果

扫描结果 :	15%的杀软(6/39)报告发现病毒
时间 :	2008/10/23 17:50:41 (CST)

a-squared	4.0.0.23	2008.10.22	2008-10-22	-	1.527
AntiVir	7.9.0.5	7.0.7.76	2008-10-23	-	2.472
Arcavir	1.0.5	200810221535	2008-10-22	-	1.229
Authentium	5.1.1	200810230012	2008-10-23	-	1.110
AVAST!	3.0.1	081022-1	2008-10-22	Win32:Trojan-gen {Other}	0.715
AVG	7.5.52.442	270.8.2/1740	2008-10-22	-	1.822
BitDefender	7.60825.1932360	7.21417	2008-10-23	-	3.345
CA (VET)	9.0.0.143	31.6.6164	2008-10-22	-	5.422
ClamAV	0.94	8471	2008-10-23	-	0.360
Comodo	2.11	2.0.0.685	2008-10-23	-	0.578
CP Secure	1.1.0.715	2008.10.23	2008-10-23	Troj.W32.Agent.abm	6.476
Dr.Web	4.44.0.9170	2008.10.23	2008-10-23	-	3.627
ewido	4.0.0.2	2008.10.22	2008-10-22	Not-A-Virus.HackTool.Win32.Delf.hi	3.158
F-Prot	4.4.4.56	20081022	2008-10-22	-	1.112
F-Secure	5.51.6100	2008.10.23.03	2008-10-23	-	3.808
GData	19.1169/19.73	20081023	2008-10-23	Win32:Trojan-gen {Other} [Engine:B]	2.697
Ikarus	T3.1.01.44	2008.10.23.71701	2008-10-23	-	3.529
Microsoft	1.4005	2008.10.23	2008-10-23	-	4.105
mks_vir	2.01	2008.10.22	2008-10-22	-	2.920
Norman	5.93.01	5.93.00	2008-10-22	-	5.229
nProtect	2008-10-23.00	2312559	2008-10-23	-	0.000
Quick Heal	9.50	2008.10.23	2008-10-23	-	0.000
Sophos	2.79.0	4.34	2008-10-23	-	0.000
Sunbelt	3.1.1747.1	2338	2008-10-23	-	0.000
The Hacker	6.3.1.0	v00124	2008-10-22	-	0.000
VBA32	3.12.8.8	20081023.0742	2008-10-23	-	0.000
ViRobot	20081023	2008.10.23	2008-10-23	-	0.413
VirusBuster	4.5.11.10	10.90.10/651862	2008-10-22	-	0.000
卡巴斯基	5.5.10	2008.10.23	2008-10-23	-	0.283
安博士V3	2008.10.23.02	2008.10.23	2008-10-23	Win-Trojan/Xema.variant	0.946
安天	2.0.18	20081023.1512524	2008-10-23	HackTool/Win32.Delf.hi	0.122
江民杀毒	11.0.706	2008.10.21	2008-10-21	-	1.332
熊猫卫士	9.05.01	2008.10.22	2008-10-22	-	0.000
瑞星	20.0	20.67.22.00	2008-10-22	-	0.000
赛门铁克	1.3.0.24	20081022.006	2008-10-22	-	0.000
趋势科技	8.700-1004	5.614.06	2008-10-22	-	0.000
迈克菲	5.3.00	5412	2008-10-22	-	2.267
金山毒霸	2008.9.8.18	2008.10.23.17	2008-10-23	-	1.065
飞塔	2.81-3.113	9.666	2008-10-22	-	0.698

黑色虾米

为什么这么巧我下载软件的时候正好在下载这病毒测试 结果按的太快了直接运行了这东西   微点没报 怎麽办  怎么解决这病毒

中国崛起

avast 报了
Sign of "Win32:Trojan-gen {Other}" has been found in "http://bbs.kafan.cn/attachment.php?aid=383005&k=d4e92ecc134ee6f016ff3e37b998b689&t=1224756260\Dscj.exe" file.

中国崛起

没现象怎么解决

Kitman

File ID         Filename         Size (Byte)        Result
25169955         ZX_DSCJ.zip.zip        469.08 KB        OK
A listing of files contained inside archives alongside their results can be found below:

File ID         Filename         Size (Byte)        Result
25115607         sock.dat         156.5 KB         CLEAN
25169956         Dscj.exe         371.5 KB         UNDER ANALYSIS

Filename	Result
Dscj.exe	MALWARE

The file 'Dscj.exe' has been determined to be 'MALWARE'.
Our analysts named the threat TR/Dldr.OnlineGa.woj. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates. 

[ 本帖最后由 Kitman 于 2008-10-23 19:39 编辑 ]

granthill

运行生成物 直接释放到c:\windows 点登陆后才有生成物 还有两个，今天以身试毒了

[ 本帖最后由 granthill 于 2008-10-23 18:50 编辑 ]

kkgh

费尔  Hacktool.Delf.ib.oiko

zdlzp

微点不报,运行红伞报,
可能运行起来的那个是正常文件吧

fzz8848

Begin scan in 'E:\Download\Virus\Setup.rar'
E:\Download\Virus\Setup.rar
    [0] Archive type: RAR
    --> Setup.exe
      [DETECTION] Is the TR/Dldr.Delphi.Gen Trojan
    [NOTE]      The file was deleted!

黑色虾米

我C盘没有发现setup.exe- -