13

sam.to

14edfa5e85d89757a1f1e18e7fac7241   FTP081201-3229.ex
64cd024d3b0118f8e38ddd252daae43c   FTP081201-3130.exe277
40bd07e6a71108df927ba6cf353a45d8   FTP081201-2774.exe277
33aa134d8b1846b12a1b84854ed64c03   FTP081201-2638.td
30a6ffb9939ece55e7e9581d2b2005db   FTP081201-2579.exe277
01d9d21da3b231c011226bff17d4d533   FTP081201-2578
0a71ec3f30c1553c414f3667206a15ea   FTP081201-2070.exe277
ae43bbb0aac01d163254d9d2acaca232   FTP081201-1520
09efb69c1a470ec0b4b2a0d22b803115   FTP081201-1476
98c2e4f941d973e1699422af7316c5f4   FTP081201-1368.td
1363f14d09438b73a3b3e4ce1da9a11f   1363f14d09438b73a3b3e4ce1da9a11f.exe277
033b955aa92c826711205b34e224b742   033b955aa92c826711205b34e224b742.exe277
319c0b3c78c82284662096e02671c9b5   FTP081201-3845.ex


to kl

[ 本帖最后由 sam.to 于 2009-2-7 17:07 编辑 ]

lingbo110120

SO BIG....

ledled

名称: Packed/Themida
类型: Sequence

描述:


文件:
c:\users\administrator\desktop\04152\ftp081201-1520
其它上报VB

[ 本帖最后由 ledled 于 2009-2-7 17:31 编辑 ]

mofunzone

6个to vlab

Starting the file scan:

Begin scan in 'C:\Users\Administrator\Desktop\04152'
C:\Users\Administrator\Desktop\04152\04152\033b955aa92c826711205b34e224b742.exe277
    [DETECTION] Is the TR/Gendal.358419 Trojan
C:\Users\Administrator\Desktop\04152\04152\1363f14d09438b73a3b3e4ce1da9a11f.exe277
    [DETECTION] Contains recognition pattern of the WORM/Otwycal.g worm
C:\Users\Administrator\Desktop\04152\04152\FTP081201-1368.td
  [0] Archive type: OVL
    [WARNING]   No further files can be extracted from this archive. The archive will be closed
    --> Object
      [1] Archive type: NSIS
      --> ProgramFilesDir/CoopenDownloader.Config
        [WARNING]   No further files can be extracted from this archive. The archive will be closed
C:\Users\Administrator\Desktop\04152\04152\FTP081201-2578
    [DETECTION] Is the TR/Crypt.FKM.Gen Trojan
C:\Users\Administrator\Desktop\04152\04152\FTP081201-2579.exe277
    [DETECTION] Contains recognition pattern of the DR/Delphi.Gen dropper
C:\Users\Administrator\Desktop\04152\04152\FTP081201-2638.td
  [0] Archive type: RSRC
    [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
C:\Users\Administrator\Desktop\04152\04152\FTP081201-2774.exe277
  [0] Archive type: ZIP SFX (self extracting)
    [DETECTION] Is the TR/Small.1742864.A Trojan
C:\Users\Administrator\Desktop\04152\04152\FTP081201-3229.ex
    [DETECTION] Is the TR/Crypt.ASPM.Gen Trojan

Beginning disinfection:
C:\Users\Administrator\Desktop\04152\04152\033b955aa92c826711205b34e224b742.exe277
    [DETECTION] Is the TR/Gendal.358419 Trojan
    [NOTE]      The file was moved to '49c052d1.qua'!
C:\Users\Administrator\Desktop\04152\04152\1363f14d09438b73a3b3e4ce1da9a11f.exe277
    [DETECTION] Contains recognition pattern of the WORM/Otwycal.g worm
    [NOTE]      The file was moved to '49c352d1.qua'!
C:\Users\Administrator\Desktop\04152\04152\FTP081201-2578
    [DETECTION] Is the TR/Crypt.FKM.Gen Trojan
    [NOTE]      The file was moved to '49dd52f2.qua'!
C:\Users\Administrator\Desktop\04152\04152\FTP081201-2579.exe277
    [DETECTION] Contains recognition pattern of the DR/Delphi.Gen dropper
    [NOTE]      The file was moved to '4aea05e3.qua'!
C:\Users\Administrator\Desktop\04152\04152\FTP081201-2638.td
    [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    [NOTE]      The file was moved to '4aeb1dbb.qua'!
C:\Users\Administrator\Desktop\04152\04152\FTP081201-2774.exe277
    [DETECTION] Is the TR/Small.1742864.A Trojan
    [NOTE]      The file was moved to '4af5ba33.qua'!
C:\Users\Administrator\Desktop\04152\04152\FTP081201-3229.ex
    [DETECTION] Is the TR/Crypt.ASPM.Gen Trojan
    [NOTE]      The file was moved to '4ae43453.qua'!


End of the scan: 2009年2月7日  01:21
Used time: 00:00 Minute(s)

The scan has been done completely.

      2 Scanning directories
     24 Files were scanned
      7 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      7 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     17 Files not concerned
      2 Archives were scanned
      2 Warnings
      7 Notes

电影结束了

http://www.eeload.com/chinese/view/o/5811.html

分流。。。

密码：kafan

江湖的fans

rs  只查出1个

上报~

[ 本帖最后由 江湖的fans 于 2009-2-7 17:30 编辑 ]

gomu887

费尔占楼

saga3721

红伞剩下6个，运行后微点再杀2个
程序：
C:\DOCUMENTS AND SETTINGS\\桌面\04152\FTP081201-1368.EXE
是可疑程序!
试图修改系统时间!
是否阻止该进程继续运行?
程序：
C:\DOCUMENTS AND SETTINGS\\桌面\04152\FTP081201-1368.EXE
木马程序生成以下文件：
1) C:\DOCUMENTS AND SETTINGS\\LOCAL SETTINGS\TEMP\OUT.EXE
是否删除木马程序及其衍生物?


程序：
C:\DOCUMENTS AND SETTINGS\\桌面\04152\FTP081201-3845.EXE
木马程序生成以下文件：
1) C:\DOCUMENTS AND SETTINGS\\LOCAL SETTINGS\TEMP\E_4\KRNLN.FNR
2) C:\DOCUMENTS AND SETTINGS\\LOCAL SETTINGS\TEMP\E_4\DP1.FNE
3) C:\DOCUMENTS AND SETTINGS\\LOCAL SETTINGS\TEMP\E_4\ETHREAD.FNE
4) C:\DOCUMENTS AND SETTINGS\\LOCAL SETTINGS\TEMP\E_4\EIMGCONVERTER.FNE
5) C:\DOCUMENTS AND SETTINGS\\LOCAL
SETTINGS\TEMP\E_4\SHELL.FNE
6) C:\DOCUMENTS AND SETTINGS\\LOCAL SETTINGS\TEMP\E_4\EAPI.FNE
7) C:\DOCUMENTS AND SETTINGS\\LOCAL SETTINGS\TEMP\E_4\EDIRECTX.FNE
8) C:\DOCUMENTS AND SETTINGS\\LOCAL SETTINGS\TEMP\E_4\EMMEDIA.FNE
是否删除木马程序及其衍生物?

最后剩下这4个：


[ 本帖最后由 saga3721 于 2009-2-7 17:39 编辑 ]

凝逸反毒

凝逸反毒
10

e:\000木马\04152[1]\04152\033b955aa92c826711205b34e224b742.exe277,virus
e:\000木马\04152[1]\04152\1363f14d09438b73a3b3e4ce1da9a11f.exe277,virus
e:\000木马\04152[1]\04152\ftp081201-1368.td,virus
e:\000木马\04152[1]\04152\ftp081201-1520,virus
e:\000木马\04152[1]\04152\ftp081201-2070.exe277,virus
e:\000木马\04152[1]\04152\ftp081201-2578,virus
e:\000木马\04152[1]\04152\ftp081201-2579.exe277,virus
e:\000木马\04152[1]\04152\ftp081201-2638.td,virus
e:\000木马\04152[1]\04152\ftp081201-2774.exe277,virus
e:\000木马\04152[1]\04152\ftp081201-3130.exe277,virus

IllusionWing

ug 5 13x
ug 6 5x