今天提取的样本

显示全部楼层 · 发表于 2009-1-11 23:02:12

在客服机再次提取一些不认识的的未知文件

显示全部楼层 · 发表于 2009-1-11 23:04:16

avast!

显示全部楼层 · 发表于 2009-1-11 23:05:52

TO KL

显示全部楼层 · 发表于 2009-1-11 23:09:34

那些exe可以跳过.

显示全部楼层 · 发表于 2009-1-11 23:20:25

查出的全是DLL
C:\Documents and Settings\Administrator\桌面\未知病毒.rar > RAR > bzctieyt.dll - 可能是 Win32/PSW.OnLineGames.OEP 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\未知病毒.rar > RAR > cvexouvc.dll - 可能是 Win32/PSW.OnLineGames.OEP 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\未知病毒.rar > RAR > edhnsuzg.dll - 可能是 Win32/PSW.OnLineGames.OEP 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\未知病毒.rar > RAR > imrryjha.dll - 可能是 Win32/PSW.OnLineGames.OEP 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\未知病毒.rar > RAR > ofxjizzb.dll - 可能是 Win32/PSW.OnLineGames.OEP 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\未知病毒.rar > RAR > vhojynts.dll - 可能是 Win32/PSW.OnLineGames.OEP 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\未知病毒.rar > RAR > xmeomvxj.dll - 可能是 Win32/PSW.OnLineGames.OEP 特洛伊木马的变种

显示全部楼层 · 发表于 2009-1-11 23:31:19

因为它们的MD5是一样的.

显示全部楼层 · 发表于 2009-1-11 23:53:05

File ID  Filename Size (Byte) Result
25229967  文件.rar 305.43 KB OK

A listing of files contained inside archives alongside their results can be found below:

File ID  Filename Size (Byte) Result
25229944  xmeomvxj.dll  28 KB  UNDER ANALYSIS
546721  dfcjj32tmp2.exe  459.5 KB  CLEAN
25229947  ormsgse.axz  32 Byte  UNDER ANALYSIS
25007059  r12019.exe  32 KB  CLEAN
---------------------------------------------------------------------------------
to Avira

显示全部楼层 · 发表于 2009-1-12 21:31:39

原帖由 08红伞威点 于 2009-1-11 23:53 发表
File ID  Filename Size (Byte) Result
25229967  文件.rar 305.43 KB OK

A listing of files contained inside archives alongside their results can be found below:

File ID  Filename Size (Byte) Res ...

File ID	Filename	Size (Byte)	Result
25229944	xmeomvxj.dll	28 KB	MALWARE
546721	dfcjj32tmp2.exe	459.5 KB	CLEAN
25229947	ormsgse.axz	32 Byte	CLEAN
25007059	r12019.exe	32 KB	CLEAN

Please find a detailed report concerning each individual sample below:

Filename	Result
xmeomvxj.dll	MALWARE

The file 'xmeomvxj.dll' has been determined to be 'MALWARE'.
Our analysts named the threat TR/Spy.BHO.AM. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.01.01.98.

回复:(xmeomvxj.dll)红伞确认已入库在V7.01.01.98。

显示全部楼层 · 发表于 2009-1-12 21:35:04

[Scanning : C:\Test]

C:\Test\未知病毒.rar<RAR>:bzctieyt.dll <- Trojan.Agent.Rwe : No action

显示全部楼层 · 发表于 2009-1-12 21:56:24

新年新病毒嚣张

[病毒样本] 今天提取的样本

本帖子中包含更多资源

本帖子中包含更多资源

回复 5楼 su-tt 的帖子

ArcaVir 2008