木马群地址 增加 2x

FLogo

hxxp://www.wowut.net/mm/ok1.exe
。。。
hxxp://www.wowut.net/mm/ok7.exe


hxxp://www.jx3wg.com/syxh/ok1.exe
。。。
hxxp://www.jx3wg.com/syxh/ok25.exe

样本全部打包上传！外加一个病毒样本（貌似只针对kaba做的免杀）！木马群地址未上报...

to kaba kill,waiting for reply。。。（kaba miss 19x heur 5x）

Hello,


1.exe - Trojan.Win32.Agent2.eft

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Sebastian

Starting the file scan:

Begin scan in 'D:\new\1.zip'
D:\new\1.zip
    [NOTE]      A backup was created as '4a1e7fb7.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\new\TDDOWNLOAD'
D:\new\TDDOWNLOAD\ok1(1).exe
    [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    [NOTE]      A backup was created as '49d57ff5.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok1.exe
    [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '48568496.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok10.exe
    [0] Archive type: OVL
    --> Object
      [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '49d57ff7.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok11.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '48568498.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok12.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '49d57ff9.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok13.exe
    [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '4856849a.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok14.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '49d57ffb.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok15.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '4856849c.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok16.exe
    [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '49d57ffd.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok17.exe
      [DETECTION] Is the TR/Dldr.Delphi.Gen Trojan
    [NOTE]      A backup was created as '4856849e.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok18.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '49d57fff.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok19.exe
    [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '48567b60.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok2(1).exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '49d67ff5.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok2.exe
    [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '49d67ff6.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok20.exe
    [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '48558497.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok21.exe
    [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '49d67ff8.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok22.exe
    [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '48558499.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok23.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '49d67ffa.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok24.exe
    [0] Archive type: OVL
    --> Object
      [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '4855849b.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok25.exe
    [0] Archive type: OVL
    --> Object
      [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '49d67ffc.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok3(1).exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '49d77ff6.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok3.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '48548497.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok4(1).exe
      [DETECTION] Is the TR/Dldr.Delphi.Gen Trojan
    [NOTE]      A backup was created as '49d87ff6.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok4.exe
    [0] Archive type: OVL
    --> Object
      [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '485b8497.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok5(1).exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '49d97ff6.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok5.exe
    [0] Archive type: OVL
    --> Object
      [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '485a8497.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok6(1).exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '49da7ff6.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok6.exe
    [0] Archive type: OVL
    --> Object
      [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '48598497.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok7(1).exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '49db7ff6.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok7.exe
    [0] Archive type: OVL
    --> Object
      [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '49db7ff7.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok8.exe
    [0] Archive type: OVL
    --> Object
      [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '49dc7ff7.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\TDDOWNLOAD\ok9.exe
    [0] Archive type: OVL
    --> Object
      [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '49dd7ff7.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!


End of the scan: 2009年2月25日  07:15
Used time: 00:09 Minute(s)

The scan has been done completely.

      1 Scanning directories
     34 Files were scanned
     33 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
     33 files were deleted
      0 files were repaired
     33 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      0 Warnings
     33 Notes

ledled

MISS 22 to VB

kingmuro

hanqq52099

我解压的时候我的小红伞狂叫，微点狂弹，解压完了以后看看文件夹发现是空的，没有NOD32什么事了， 多装一款杀软是多么重要呀！！！

江湖的fans

上报下载点

love求求

NOD 32清空


2009-2-25 17:39:17        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok9.exe        Win32/PSW.OnLineGames.NRD 特洛伊木马        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:39:17        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok8.exe        Win32/PSW.OnLineGames.NRD 特洛伊木马 的变种        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:39:16        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok7.exe        Win32/PSW.OnLineGames.NRD 特洛伊木马 的变种        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:39:15        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok7(1).exe        可能是 Win32/PSW.WOW.DZI 特洛伊木马 的变种        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:39:13        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok6.exe        Win32/PSW.OnLineGames.NRD 特洛伊木马 的变种        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:39:12        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok6(1).exe        Win32/PSW.OnLineGames.NUO 特洛伊木马 的变种        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:39:10        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok5.exe        Win32/PSW.OnLineGames.NRD 特洛伊木马        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:39:09        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok5(1).exe        可能是 Win32/PSW.OnLineGames.NSU 特洛伊木马 的变种        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:39:09        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok4.exe        Win32/PSW.OnLineGames.NRD 特洛伊木马 的变种        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:39:08        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok4(1).exe        Win32/PSW.Legendmir.NGZ 特洛伊木马 的变种        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:39:07        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok3.exe        Win32/PSW.OnLineGames.NUO 特洛伊木马 的变种        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:39:06        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok3(1).exe        可能是 Win32/PSW.OnLineGames.NUO 特洛伊木马 的变种        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:39:05        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok25.exe        Win32/PSW.OnLineGames.NRD 特洛伊木马 的变种        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:39:04        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok24.exe        Win32/PSW.OnLineGames.NRD 特洛伊木马        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:39:03        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok23.exe        Win32/PSW.OnLineGames.OEP 特洛伊木马        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:39:02        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok22.exe        Win32/PSW.OnLineGames.NTM 特洛伊木马        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:39:01        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok21.exe        Win32/PSW.OnLineGames.NTM 特洛伊木马 的变种        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:39:00        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok20.exe        Win32/PSW.OnLineGames.NTM 特洛伊木马 的变种        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:38:59        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok2.exe        Win32/PSW.OnLineGames.NTM 特洛伊木马 的变种        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:38:57        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok2(1).exe        可能是 Win32/PSW.WOW.DZI 特洛伊木马 的变种        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:38:56        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok19.exe        Win32/PSW.OnLineGames.NTM 特洛伊木马 的变种        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:38:54        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok18.exe        可能是 Win32/PSW.OnLineGames.NSU 特洛伊木马 的变种        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:38:53        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok17.exe        Win32/PSW.Legendmir.NGZ 特洛伊木马 的变种        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:38:52        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok16.exe        Win32/PSW.OnLineGames.NTM 特洛伊木马 的变种        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:38:51        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok15.exe        可能是 Win32/PSW.OnLineGames.NSU 特洛伊木马 的变种        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:38:50        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok14.exe        可能是 Win32/PSW.WOW.DZI 特洛伊木马 的变种        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:38:49        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok13.exe        Win32/PSW.OnLineGames.NTM 特洛伊木马        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:38:48        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok12.exe        可能是 Win32/PSW.WOW.DZI 特洛伊木马 的变种        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:38:47        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok11.exe        可能是 Win32/PSW.OnLineGames.NUO 特洛伊木马 的变种        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:38:46        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok10.exe        Win32/PSW.OnLineGames.NRD 特洛伊木马 的变种        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:38:44        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok1.exe        Win32/PSW.OnLineGames.NTM 特洛伊木马 的变种        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2009-2-25 17:38:42        文件系统实时防护        文件        D:\病毒\TDDOWNLOAD[1]\TDDOWNLOAD\ok1(1).exe        可能是 Win32/TrojanDropper.Delf.NJA 特洛伊木马 的变种        通过删除清除 - 已隔离        20090105-1144\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.

[ 本帖最后由 love求求 于 2009-2-25 17:42 编辑 ]

Palkia

8 to rs