过红伞的下载者下载的病毒打包。

yhjtj

下载物没过红伞
下载者
生成物

Palkia

miss to rs

rok827

NIS MISS

幸福的猪猪

kaba kill   >Trojan-Downloader.Win32.Agent.bkrv  (下载者）

生成物，kaba miss 9x，to kill ！

[ 本帖最后由 幸福的猪猪 于 2009-3-14 16:36 编辑 ]

一下子丫

报生成物如下28个，已上报
TrojWare.Win32.PSW.OnlineGames.~CQM@7991616  | WINDOWS.part3.rar:S4.exe
TrojWare.Win32.PSW.OnlineGames.~CQM@7991616  | WINDOWS.part3.rar:S5.exe
Heur.Pck.FSG  | WINDOWS.part1.rar:1a.exe
TrojWare.Win32.PSW.OnlineGames.~CQM@7991616  | WINDOWS.part3.rar:S6.exe
TrojWare.Win32.PSW.Jronline.~D@7937746  | WINDOWS.part3.rar:S7.exe
TrojWare.Win32.PSW.OnlineGames.~CQM@7991616  | WINDOWS.part3.rar:S8.exe
TrojWare.Win32.PSW.QQPass.~AAJ@9852731  | WINDOWS.part1.rar:a1.exe
Heur.Pck.NsPacK  | WINDOWS.part2.rar:fm.exe
Heur.Packed.Unknown  | WINDOWS.part2.rar:kill.exe
Heur.Packed.Unknown  | WINDOWS.part2.rar:L1.exe
Heur.Packed.Unknown  | WINDOWS.part2.rar:L17.exe
Heur.Packed.Unknown  | WINDOWS.part2.rar:L3.exe
Heur.Packed.Unknown  | WINDOWS.part2.rar:L4.exe
Heur.Packed.Unknown  | WINDOWS.part2.rar:L5.exe
Heur.Packed.Unknown  | WINDOWS.part2.rar:L6.exe
Heur.Packed.Unknown  | WINDOWS.part2.rar:L8.exe
Heur.Packed.Unknown  | WINDOWS.part2.rar:L9.exe
TrojWare.Win32.PSW.OnlineGames.~CQM@7991616  | WINDOWS.part2.rar:S1.exe
TrojWare.Win32.PSW.OnlineGames.~CQM@7991616  | WINDOWS.part2.rar:S10.exe
TrojWare.Win32.PSW.OnlineGames.~CQM@7991616  | WINDOWS.part2.rar:S11.exe
TrojWare.Win32.GameThief.Magania.~KL@8631204  | WINDOWS.part2.rar:S13.exe
TrojWare.Win32.PSW.OnlineGames.~CQM@7991616  | WINDOWS.part2.rar:S14.exe
TrojWare.Win32.GameThief.Magania.~KL@8631204  | WINDOWS.part2.rar:S15.exe
TrojWare.Win32.PSW.OnlineGames.~CQM@7991616  | WINDOWS.part2.rar:S16.exe
TrojWare.Win32.PSW.OnlineGames.~CQM@7991616  | WINDOWS.part2.rar:S19.exe
TrojWare.Win32.PSW.OnlineGames.~CQM@7991616  | WINDOWS.part2.rar:S2.exe
Heur.Packed.Unknown  | WINDOWS.part1.rar:a4.exe
TrojWare.Win32.Midgare.~BAAA@1424457  | WINDOWS.part1.rar:a8.exe

Sebastian

miss3
Starting the file scan:


Begin scan in 'D:\new\ok1-0311.rar'
D:\new\ok1-0311.rar
    [0] Archive type: RAR
      --> ok1-0311.exe
        --> Object
          [2] Archive type: RSRC
          --> Object
            [3] Archive type: CAB (Microsoft)
            --> Down.exe
              [DETECTION] Is the TR/Dldr.Agent.RET Trojan
    [NOTE]      A backup was created as '49ec6fe1.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!


Starting the file scan:


Begin scan in 'D:\new\fonts'
D:\new\fonts\bzvnzcrt.dll
    [DETECTION] Contains HEUR/Malware suspicious code
    [NOTE]      The detection was classified as suspicious.
    [NOTE]      A backup was created as '4a316f63.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\fonts\cwvvacad.dll
    [DETECTION] Contains HEUR/Malware suspicious code
    [NOTE]      The detection was classified as suspicious.
    [NOTE]      A backup was created as '4a316f60.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\fonts\knuxdcgy.dll.dat
    [DETECTION] Contains HEUR/Malware suspicious code
    [NOTE]      The detection was classified as suspicious.
    [NOTE]      A backup was created as '4a306f57.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\fonts\pvntdyyc.dll.dat
    [DETECTION] Contains HEUR/Malware suspicious code
    [NOTE]      The detection was classified as suspicious.
    [NOTE]      A backup was created as '4a296f5f.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\new\system32'
D:\new\system32\1a.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '49e96f4b.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\a1.exe
      [DETECTION] Is the TR/ATRAPS.Gen Trojan
    [NOTE]      A backup was created as '49e96f1b.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\a10.exe
    [0] Archive type: NSIS
    --> 52D77ECE7B32424dB93B9A6EFBDDB0DF/[TempDir]/152.exe
      [DETECTION] Contains recognition pattern of the DR/Cinmus.amcx.2 dropper
    [DETECTION] Contains recognition pattern of the ADSPY/AdMedia.ED.313 adware or spyware
    [NOTE]      A backup was created as '49eb6f1b.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\a2.exe
    [0] Archive type: NSIS
    --> ProgramFilesDir/89.exe
      [DETECTION] Contains recognition pattern of the ADSPY/Cin.FBT.53248 adware or spyware
    [DETECTION] Contains recognition pattern of the DR/BHO.fuu dropper
    [NOTE]      A backup was created as '49e96f1d.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\a4.exe
    [DETECTION] Is the TR/ATRAPS.Gen Trojan
    [NOTE]      A backup was created as '49e96f1f.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\a6.exe
      [DETECTION] Is the TR/Downloader.Gen Trojan
    [NOTE]      A backup was created as '49e96f21.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\a8.exe
    [DETECTION] Contains recognition pattern of the DR/Delphi.Gen dropper
    [NOTE]      A backup was created as '49e96f23.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\a9.exe
    [0] Archive type: NSIS
    --> ProgramFilesDir/avtapit.dll
      [DETECTION] Is the TR/Dldr.Agent.aek Trojan
    [DETECTION] Is the TR/Agent.56946 Trojan
    [NOTE]      A backup was created as '49e96f24.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\fm.exe
      [DETECTION] Is the TR/Hijacker.Gen Trojan
    [NOTE]      A backup was created as '49e96f59.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\kill.exe
      [DETECTION] Is the TR/ATRAPS.Gen Trojan
      --> kk.dll
        [1] Archive type: RSRC
        --> Object
          [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '4a276f55.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\kk.dll
    [0] Archive type: RSRC
    --> Object
      [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '49e96f57.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\kk.exe
    [DETECTION] Is the TR/ATRAPS.Gen Trojan
    [NOTE]      A backup was created as '486c8b20.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\L1.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '486c8b66.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\L17.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '49f26f1d.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\L2.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '49e96f1e.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\L3.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '486c8b58.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\L4.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '49e96f20.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\L5.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '49e96f22.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\L6.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '486c8b5c.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\L8.exe
    [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '49e96f25.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\L9.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '49e96f26.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\S1.exe
    [0] Archive type: OVL
    --> Object
      [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '486c8b67.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\S10.exe
    [0] Archive type: OVL
    --> Object
      [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '49eb6f1e.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\S11.exe
    [0] Archive type: OVL
    --> Object
      [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '49ec6f1e.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\S13.exe
    [0] Archive type: OVL
    --> Object
      [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '49ee6f1e.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\S14.exe
    [0] Archive type: OVL
    --> Object
      [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '49ef6f1e.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\S15.exe
    [0] Archive type: OVL
    --> Object
      [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '49f06f1e.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\S16.exe
    [0] Archive type: OVL
    --> Object
      [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '49f16f1e.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\S19.exe
    [0] Archive type: OVL
    --> Object
      [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '49f46f1e.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\S2.exe
    [0] Archive type: OVL
    --> Object
      [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '486c8b59.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\S20.exe
    [0] Archive type: OVL
    --> Object
      [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '49eb6f20.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\S4.exe
    [0] Archive type: OVL
    --> Object
      [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '486c8b5b.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\S5.exe
    [0] Archive type: OVL
    --> Object
      [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '486c8b5e.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\S6.exe
    [0] Archive type: OVL
    --> Object
      [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '486c8b5d.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\S7.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '49e96f27.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\system32\S8.exe
    [0] Archive type: OVL
    --> Object
      [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '486c8b5f.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!


End of the scan: 2009年3月14日  16:46
Used time: 00:04 Minute(s)

The scan has been done completely.

      2 Scanning directories
     51 Files were scanned
     40 viruses and/or unwanted programs were found
      4 Files were classified as suspicious:
     40 files were deleted
      0 files were repaired
     40 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      7 Files not concerned
      3 Archives were scanned
      0 Warnings
     40 Notes

[ 本帖最后由 Sebastian 于 2009-3-14 16:49 编辑 ]

ledled

OSS Kill 23, 未查出的上报

heaven888

瑞星21.29.51
Trojan.DL.win32.mnless.cll
并启发一个

揍敌客

Backdoor.Win32.Beastdoor
ik kill 32

马灵耀

下载的东西不经过红伞检查过吗。那看来红伞没什么作用，很容易感染病毒。