[病毒样本] 14x

显示全部楼层 · 发表于 2008-11-9 21:08:25

传附件太麻烦了
下载地址http://www.brsbox.com/filebox/down/fc/b089c9d664becab0fdb313d8a1efc356

显示全部楼层 · 发表于 2008-11-9 21:12:43

C:\Documents and Settings\Owner\桌面\新建文件夹\A0072149.dll - Win32/PSW.OnLineGames.NQM 特洛伊木马 - 通过删除清除 - 已隔离
C:\Documents and Settings\Owner\桌面\新建文件夹\A0072150.dll - Win32/PSW.OnLineGames.NQM 特洛伊木马 - 通过删除清除 - 已隔离
C:\Documents and Settings\Owner\桌面\新建文件夹\A0072152.dll - Win32/PSW.OnLineGames.NQM 特洛伊木马 - 通过删除清除 - 已隔离
C:\Documents and Settings\Owner\桌面\新建文件夹\A0072153.dll - Win32/PSW.OnLineGames.NQM 特洛伊木马 - 通过删除清除 - 已隔离
C:\Documents and Settings\Owner\桌面\新建文件夹\A0072154.exe - Win32/TrojanDownloader.Adload.NFH 特洛伊木马的变种 - 通过删除清除 - 已隔离
C:\Documents and Settings\Owner\桌面\新建文件夹\A0074771.dll - Win32/PSW.OnLineGames.NRW 特洛伊木马的变种 - 通过删除清除 - 已隔离
C:\Documents and Settings\Owner\桌面\新建文件夹\A0074773.exe - Win32/PSW.OnLineGames.NRF 特洛伊木马的变种 - 通过删除清除 - 已隔离
C:\Documents and Settings\Owner\桌面\新建文件夹\A0074787.dll - Win32/PSW.OnLineGames.NRW 特洛伊木马的变种 - 通过删除清除 - 已隔离
C:\Documents and Settings\Owner\桌面\新建文件夹\A0074789.exe - Win32/PSW.OnLineGames.NRF 特洛伊木马的变种 - 通过删除清除 - 已隔离
C:\Documents and Settings\Owner\桌面\新建文件夹\A0074803.dll - Win32/PSW.OnLineGames.NRW 特洛伊木马的变种 - 通过删除清除 - 已隔离
C:\Documents and Settings\Owner\桌面\新建文件夹\A0074805.exe - Win32/PSW.OnLineGames.NRF 特洛伊木马的变种 - 通过删除清除 - 已隔离

显示全部楼层 · 发表于 2008-11-9 21:18:43

rs09 killed 4

卡巴~上报旧版MISS的啦~

已删除: 木马程序 Trojan-GameThief.Win32.OnLineGames.tqwi       文件: E:\virus.rar/A0072149.dll
已删除: 木马程序 Trojan-GameThief.Win32.OnLineGames.tprh       文件: E:\virus.rar/A0072150.dll
已删除: 木马程序 Trojan-GameThief.Win32.OnLineGames.tprh       文件: E:\virus.rar/A0072152.dll
已删除: 木马程序 Trojan-GameThief.Win32.OnLineGames.tqwi       文件: E:\virus.rar/A0072153.dll
已删除: 木马程序 Trojan-GameThief.Win32.OnLineGames.trsd       文件: E:\virus.rar/A0074771.dll
已删除: 木马程序 Trojan-GameThief.Win32.MultiFirst.t       文件: E:\virus.rar/A0074773.exe
已删除: 木马程序 Trojan-GameThief.Win32.OnLineGames.trsd       文件: E:\virus.rar/A0074787.dll
已删除: 木马程序 Trojan-GameThief.Win32.MultiFirst.t       文件: E:\virus.rar/A0074789.exe
已删除: 木马程序 Trojan-GameThief.Win32.OnLineGames.trsd       文件: E:\virus.rar/A0074803.dll
已删除: 木马程序 Trojan-GameThief.Win32.MultiFirst.t       文件: E:\virus.rar/A0074805.exe

[ 本帖最后由 tvuser2007 于 2008-11-9 21:19 编辑 ]

显示全部楼层 · 发表于 2008-11-9 21:20:38

费尔

显示全部楼层 · 发表于 2008-11-9 21:21:23

avast!清空

显示全部楼层 · 发表于 2008-11-9 21:24:55

25184725 A0072236.exe 387.89 KB UNDER ANALYSIS
25171716 A0075587.exe 370.5 KB CLEAN

显示全部楼层 · 发表于 2008-11-9 21:51:32

这个才是呢

Hello,

A0072154.exe_ - not-a-virus:AdWare.Win32.Ejik.zn

This file is an Advertizing Tool, It's detection will be included in the next
update of extended databases set. See more info about
extended databases here: http://www.kaspersky.com/extraavupdates

A0072236.exe_ - Trojan.Win32.DelFiles.cl

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

A0075587.exe_,
HKNTDLL.dll

No malicious code were found in these files.

Please quote all when answering.
The answer is relevant to the latest bases from update sources.

--
Best regards, Sergey Temnikov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

>
>

[ 本帖最后由 tvuser2007 于 2008-11-9 21:57 编辑 ]

显示全部楼层 · 发表于 2008-11-10 02:47:24

Scanning Engines:
F-Secure AVP: 7.00.171, 2008-11-09
F-Secure Hydra: 2.08.8110, 2008-11-09

Result: 10 malware found
Trojan-GameThief.Win32.OnLineGames.tqwi (virus)
C:\Documents and Settings\sk\桌面\virusrun\081109\14virus\A0072149.dll Action: deleted
C:\Documents and Settings\sk\桌面\virusrun\081109\14virus\A0072153.dll Action: deleted
Trojan-GameThief.Win32.OnLineGames.tprh (virus)
C:\Documents and Settings\sk\桌面\virusrun\081109\14virus\A0072150.dll Action: deleted
C:\Documents and Settings\sk\桌面\virusrun\081109\14virus\A0072152.dll Action: deleted
Trojan-GameThief.Win32.OnLineGames.trsd (virus)
C:\Documents and Settings\sk\桌面\virusrun\081109\14virus\A0074771.dll Action: deleted
C:\Documents and Settings\sk\桌面\virusrun\081109\14virus\A0074787.dll Action: deleted
C:\Documents and Settings\sk\桌面\virusrun\081109\14virus\A0074803.dll Action: deleted
Trojan-GameThief.Win32.MultiFirst.t (virus)
C:\Documents and Settings\sk\桌面\virusrun\081109\14virus\A0074773.exe Action: deleted
C:\Documents and Settings\sk\桌面\virusrun\081109\14virus\A0074789.exe Action: deleted
C:\Documents and Settings\sk\桌面\virusrun\081109\14virus\A0074805.exe Action: deleted

显示全部楼层 · 发表于 2008-11-10 07:58:25

金山毒霸可信认证技术查询结果如下

A0072149.dll    -----------    未知
A0072150.dll    -----------    未知
A0072152.dll    -----------    未知
A0072153.dll    -----------    未知
A0072154.exe    -----------    病毒
A0072236.exe    -----------    未知
A0074771.dll    -----------    分析中
A0074773.exe    -----------    可疑的
A0074787.dll    -----------    分析中
A0074789.exe    -----------    可疑的
A0074803.dll    -----------    分析中
A0074805.exe    -----------    可疑的
A0075587.exe    -----------    安全
HKNTDLL.dll    -----------    安全(*)

信息 2008-11-10  07:58:08 您此次查毒隔离了8个文件
信息 2008-11-10  07:58:08 您此次查毒共查出8个病毒以及危险代码
信息 2008-11-10  07:58:08 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件19个
信息 2008-11-10  07:58:08 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
病毒 2008-11-10  07:58:08 D:\Desktop\virus\A0074805.exe Win32.Troj.OnLineGames.fe.7680 隔离成功
病毒 2008-11-10  07:58:06 D:\Desktop\virus\A0074789.exe Win32.Troj.OnLineGames.fe.7680 隔离成功
病毒 2008-11-10  07:58:04 D:\Desktop\virus\A0074773.exe Win32.Troj.OnLineGames.fe.7680 隔离成功
病毒 2008-11-10  07:58:02 D:\Desktop\virus\A0072154.exe Win32.Troj.Agent.UN.94208 隔离成功
病毒 2008-11-10  07:58:00 D:\Desktop\virus\A0072153.dll Win32.Troj.EncodeGameT.vm.2438432 隔离成功
病毒 2008-11-10  07:57:58 D:\Desktop\virus\A0072152.dll Win32.Troj.EncodeGameT.vm.2438432 隔离成功
病毒 2008-11-10  07:57:56 D:\Desktop\virus\A0072150.dll Win32.Troj.EncodeGameT.vm.2438432 隔离成功
病毒 2008-11-10  07:57:54 D:\Desktop\virus\A0072149.dll Win32.Troj.EncodeGameT.vm.2438432 隔离成功

显示全部楼层 · 发表于 2008-11-10 08:09:41

[病毒样本] 14x

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源