小马一只
费尔说：桌面\新建文件夹\新建文件夹 (2)\tianlong.rar>>tianlong.exe>>tl.exe Trojan.Cap81250.lfae 木马 还未处理
这只是个天天盗号的，我在那个服，天天有人中招，可能都在网吧，或安装杀毒软件没有更新。
网马下载：ht tp://www.cls33.cn/tianlong.exe
（前几天我发过了，但注意MD5不一样，如果下载后MD5与我不一样，请上报给杀毒软件公司，谢谢。）
Norman Sandbox: [ General information ]
* File length: 121277 bytes.
[ Changes to filesystem ]
* Creates directory C:.
* Creates directory C:\WINDOWS.
* Creates file C:\WINDOWS\__tmp_rar_sfx_access_check_511.
* Deletes file __tmp_rar_sfx_access_check_511.
* Creates file C:\WINDOWS\)_k_.exe.
* Creates file C:\WINDOWS\tl.exe.
[ Process/window information ]
* Creates a dialogbox with caption \"WinRAR _____\".
* Buttons found in dialogbox: id102[278,173]\"O_(&W)...\" id1[211,223]\"__\" id2[278,223]\"__\" .
* Creates a dialogbox with caption \"\".
* Buttons found in dialogbox: id1[211,223]\"__\" id2[278,223]\"__\" .
* Pressing button with id 1 \"\".
* Attempts to open CLSID {00000005-0000-0000-2C00-000094590500}.
* Attemps to NULL C:\WINDOWS\)_k_.exe NULL.
* Creates process \")_k_.exe\".
[ Signature Scanning ]
* C:\WINDOWS\)_k_.exe (20480 bytes) : no signature detection.
* C:\WINDOWS\tl.exe (16896 bytes) : W32/OnLineGames.CJPH.
沙盘日志2：ht tp://www.threatexpert.com/report.aspx?md5=5f7cc4bc80bfeaad64e78895ee0b5f05
文件 tianlong.exe 接收于 2008.12.09 08:47:44 (CET)
结果: 22/38 (57.9%)
反病毒引擎 版本 最后更新 扫描结果
AhnLab-V3 2008.12.8.1 2008.12.09 -
AntiVir 7.9.0.43 2008.12.08 TR/PSW.Online.bin
Authentium 5.1.0.4 2008.12.08 -
Avast 4.8.1281.0 2008.12.08 Win32:Trojan-gen {Other}
AVG 8.0.0.199 2008.12.08 -
BitDefender 7.2 2008.12.09 Trojan.PWS.OnlineGames.ZWU
CAT-QuickHeal 10.00 2008.12.09 -
ClamAV 0.94.1 2008.12.09 -
Comodo 713 2008.12.09 -
DrWeb 4.44.0.09170 2008.12.09 Trojan.DownLoad.25605
eSafe 7.0.17.0 2008.12.08 Suspicious File
eTrust-Vet 31.6.6246 2008.12.05 -
Ewido 4.0 2008.12.08 -
F-Prot 4.4.4.56 2008.12.08 -
F-Secure 8.0.14332.0 2008.12.09 W32/Malware
Fortinet 3.117.0.0 2008.12.09 -
GData 19 2008.12.09 Trojan.PWS.OnlineGames.ZWU
Ikarus T3.1.1.45.0 2008.12.08 Trojan-Spy.Win32.Treemz
K7AntiVirus 7.10.548 2008.12.08 -
Kaspersky 7.0.0.125 2008.12.09 Trojan-GameThief.Win32.OnLineGames.twmv
McAfee 5458 2008.12.08 PWS-Gamania.gen.dll
McAfee+Artemis 5458 2008.12.09 PWS-Gamania.gen.dll
Microsoft 1.4205 2008.12.09 TrojanSpy:Win32/Treemz.gen!A
NOD32 3675 2008.12.09 probably a variant of Win32/PSW.OnLineGames.NXI
Norman 5.80.02 2008.12.08 W32/OnLineGames.CJPH.dropper
Panda 9.0.0.4 2008.12.08 Suspicious file
PCTools 4.4.2.0 2008.12.08 -
Prevx1 V2 2008.12.09 -
Rising 21.07.02.00 2008.12.08 Trojan.PSW.Win32.GameOL.sng
SecureWeb-Gateway 6.7.6 2008.12.09 Trojan.PSW.Online.bin
Sophos 4.36.0 2008.12.09 Mal/Dropper-Y
Sunbelt 3.1.1832.2 2008.12.01 Trojan-Dropper.Win32.VB!cobra (v)
Symantec 10 2008.12.09 Infostealer.Gampass
TheHacker 6.3.1.2.180 2008.12.09 -
TrendMicro 8.700.0.1004 2008.12.09 Mal_OLGM-15
VBA32 3.12.8.10 2008.12.09 Malware-Dropper.Win32.Pimpa.3
ViRobot 2008.12.9.1507 2008.12.09 -
VirusBuster 4.5.11.0 2008.12.08 -
附加信息
File size: 121277 bytes
MD5...: 5f7cc4bc80bfeaad64e78895ee0b5f05
SHA1..: 242e15a0d84f82e64c80c2773896403e46c6ffaf
SHA256: 1a64dc3472e08e82b25909779102e12899187e2ac23f6bba9a68b51eaf02b95c
SHA512: c40db2a4ab07ff1a88399b3f7ea4b7ede3291198b33135307662f2c35fe4737c
c924fbbd850dde07e4049ad134e9723b03c5c362365b28ff032434392cb8852b
ssdeep: 3072:awxVMhOC/dTDbq91+mno3t4QZQ3rt8iJk0aUKEecn9Jo2YB:aTfFDbRnOTr
t5J/a3Xc9Jor
PEiD..: -
TrID..: File type identification
WinRAR Self Extracting archive (96.2%)
Win32 Executable Generic (1.5%)
Win32 Dynamic Link Library (generic) (1.4%)
Generic Win/DOS Executable (0.3%)
DOS Executable Generic (0.3%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x401000
timedatestamp.....: 0x48cfc008 (Tue Sep 16 14:17:44 2008)
machinetype.......: 0x14c (I386)
( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x14000 0x13a00 6.48 d9c3b0b82d7da6d18b0896fb360cea84
.data 0x15000 0x8000 0xa00 4.93 568dd221456d807ca821813c84d65e70
.idata 0x1d000 0x2000 0x1200 4.79 bc7806e1c1ce9ebfd00ad834c1f7a647
.rsrc 0x1f000 0x3310 0x3400 5.23 fb01eefbb15676f4cb0b1ff4d25c8f27
( 8 imports )
> ADVAPI32.DLL: AdjustTokenPrivileges, LookupPrivilegeValueA, OpenProcessToken, RegCloseKey, RegCreateKeyExA, RegOpenKeyExA, RegQueryValueExA, RegSetValueExA, SetFileSecurityA, SetFileSecurityW
> KERNEL32.DLL: CloseHandle, CompareStringA, CreateDirectoryA, CreateDirectoryW, CreateFileA, CreateFileW, DeleteFileA, DeleteFileW, DosDateTimeToFileTime, ExitProcess, ExpandEnvironmentStringsA, FileTimeToLocalFileTime, FileTimeToSystemTime, FindClose, FindFirstFileA, FindFirstFileW, FindNextFileA, FindNextFileW, FindResourceA, FreeLibrary, GetCPInfo, GetCommandLineA, GetCurrentDirectoryA, GetCurrentProcess, GetDateFormatA, GetFileAttributesA, GetFileAttributesW, GetFileType, GetFullPathNameA, GetLastError, GetLocaleInfoA, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleA, GetNumberFormatA, GetProcAddress, GetProcessHeap, GetStdHandle, GetSystemTime, GetTempPathA, GetTickCount, GetTimeFormatA, GetVersionExA, GlobalAlloc, HeapAlloc, HeapFree, HeapReAlloc, IsDBCSLeadByte, LoadLibraryA, LocalFileTimeToFileTime, MoveFileA, MoveFileExA, MultiByteToWideChar, ReadFile, SetCurrentDirectoryA, SetEndOfFile, SetEnvironmentVariableA, SetFileAttributesA, SetFileAttributesW, SetFilePointer, SetFileTime, SetLastError, Sleep, SystemTimeToFileTime, WaitForSingleObject, WideCharToMultiByte, WriteFile, lstrcmpiA, lstrlenA
> COMCTL32.DLL: -
> COMDLG32.DLL: CommDlgExtendedError, GetOpenFileNameA, GetSaveFileNameA
> GDI32.DLL: DeleteObject
> SHELL32.DLL: SHBrowseForFolderA, SHChangeNotify, SHFileOperationA, SHGetFileInfoA, SHGetMalloc, SHGetSpecialFolderLocation, ShellExecuteExA, SHGetPathFromIDListA
> USER32.DLL: CharToOemA, CharToOemBuffA, CharUpperA, CopyRect, CreateWindowExA, DefWindowProcA, DestroyIcon, DestroyWindow, DialogBoxParamA, DispatchMessageA, EnableWindow, EndDialog, FindWindowExA, GetClassNameA, GetClientRect, GetDlgItem, GetDlgItemTextA, GetMessageA, GetParent, GetSysColor, GetSystemMetrics, GetWindow, GetWindowLongA, GetWindowRect, GetWindowTextA, IsWindow, IsWindowVisible, LoadBitmapA, LoadCursorA, LoadIconA, LoadStringA, MapWindowPoints, MessageBoxA, OemToCharA, OemToCharBuffA, PeekMessageA, PostMessageA, RegisterClassExA, SendDlgItemMessageA, SendMessageA, SetDlgItemTextA, SetFocus, SetMenu, SetWindowLongA, SetWindowPos, SetWindowTextA, ShowWindow, TranslateMessage, UpdateWindow, WaitForInputIdle, wsprintfA, wvsprintfA
> OLE32.DLL: CLSIDFromString, CoCreateInstance, CreateStreamOnHGlobal, OleInitialize, OleUninitialize
( 0 exports )
packers (Kaspersky): PE_Patch.UPX, UPX
packers (F-Prot): RAR, UPX
VirSCAN.org Scanned Report :
Scanned time : 2008/12/09 15:48:00 (CST)
Scanner results: 49%的杀软(19/39)报告发现病毒
File Name : tianlong.exe
File Size : 121277 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : 5f7cc4bc80bfeaad64e78895ee0b5f05
SHA1 : 242e15a0d84f82e64c80c2773896403e46c6ffaf
Online report : ht tp://virscan.org/report/22bb13f690aadbeaebb8c435ef564677.html
Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.0.0.27 20081209070113 2008-12-09 4.09 Trojan-Spy.Win32.Treemz!IK
安博士V3 2008.12.09.01 2008.12.09 2008-12-09 1.13 -
AntiVir 7.9.0.43 7.1.0.205 2008-12-08 1.62 TR/PSW.Online.bin
安天 2.0.18 20081208.1796541 2008-12-08 0.12 -
Arcavir 1.0.5 200812071316 2008-12-07 1.57 -
Authentium 5.1.1 200812081422 2008-12-08 1.35 -
AVAST! 3.0.1 081208-0 2008-12-08 0.79 Win32:Trojan-gen {Other}
AVG 7.5.52.442 270.9.15/1838 2008-12-08 2.01 -
BitDefender 7.81008.2337154 7.22403 2008-12-09 2.32 Trojan.PWS.OnlineGames.ZWU
CA (VET) 9.0.0.143 31.6.6250 2008-12-08 5.56 Win32/Treemz!generic trojan.
ClamAV 0.94.1 8733 2008-12-09 0.09 -
Comodo 3.0 711 2008-12-08 0.90 -
CP Secure 1.1.0.715 2008.12.09 2008-12-09 6.45 -
Dr.Web 4.44.0.9170 2008.12.08 2008-12-08 3.83 Trojan.DownLoad.25605
ewido 4.0.0.2 2008.12.08 2008-12-08 3.22 -
F-Prot 4.4.4.56 20081208 2008-12-08 1.31 -
F-Secure 5.51.6100 2008.12.09.02 2008-12-09 4.27 -
飞塔 2.81-3.117 9.796 2008-12-08 0.33 -
GData 19.1840/19.138 20081209 2008-12-09 3.02 Win32:Trojan-gen {Other} [Engine:B]
ViRobot 20081208 2008.12.08 2008-12-08 0.47 -
Ikarus T3.1.01.45 2008.12.09.71979 2008-12-09 5.24 Trojan-Spy.Win32.Treemz
江民杀毒 11.0.706 2008.12.09 2008-12-09 1.62 Trojan/PSW.OnLineGames.apjz
卡巴斯基 5.5.10 2008.12.09 2008-12-09 0.18 -
金山毒霸 2008.9.8.18 2008.12.9.14 2008-12-09 1.50 Win32.PSWTroj.Undef.65536
迈克菲 5.3.00 5457 2008-12-07 2.74 PWS-Gamania.gen.dll
Microsoft 1.4205 2008.12.08 2008-12-08 8.19 TrojanSpy:Win32/Treemz.gen!A
mks_vir 2.01 2008.12.07 2008-12-07 2.97 -
Norman 5.93.01 5.93.00 2008-12-08 5.95 -
熊猫卫士 9.05.01 2008.12.08 2008-12-08 2.96 Suspicious file
趋势科技 8.700-1004 5.698.03 2008-12-08 0.08 Mal_OLGM-15
Quick Heal 10.00 2008.12.09 2008-12-09 1.67 -
瑞星 20.0 21.07.02.00 2008-12-08 1.84 Trojan.PSW.Win32.GameOL.sng
Sophos 2.81.2 4.36 2008-12-09 2.12 Mal/Dropper-Y
Sunbelt 4674 4674 2008-11-04 0.85 -
赛门铁克 1.3.0.24 20081208.003 2008-12-08 3.52 Infostealer.Gampass
nProtect 2008-12-08.01 2751014 2008-12-08 3.34 Trojan/W32.Chifrax.632940
The Hacker 6.3.1.2 v00180 2008-12-08 0.48 -
VBA32 3.12.8.10 20081208.1844 2008-12-08 1.60 Malware-Dropper.Win32.Pimpa.3
VirusBuster 4.5.11.10 10.95.1/730088 2008-12-08 1.08 - |
发表于 2008-12-9 16:11:57
楼主
