PDF解出来的东西

显示全部楼层 · 发表于 2009-3-29 16:21:13

*
* avast! 报告
* 这个文件自动被产生
*
* 任务 '简易用户界面' 被使用
* 开始于 2009年3月29日 16:20:09
* VPS: 090328-0, 2009-03-28
*
C:\Test\0903\29\Load.rar\file.exe [L] Win32:Dropper-BEJ [Trj] (0)
C:\Test\0903\29\Load.rar\fileff.exe [L] Win32:Walpak [Cryp] (0)
C:\Test\0903\29\Load.rar\files.exe [L] Win32:Trojan-gen {Other} (0)
C:\Test\0903\29\Load.rar\load.exe [L] Win32:Trojan-gen {Other} (0)
C:\Test\0903\29\Load.rar\loadee.exe [L] Win32:Wali [Cryp] (0)
C:\Test\0903\29\Load.rar\loadfff.exe [L] Win32:VB-LGG [Drp] (0)
C:\Test\0903\29\Load.rar\loadss.exe [L] Win32:Walpak [Cryp] (0)
C:\Test\0903\29\Load.rar\loadsss.exe [L] Win32:Spyware-gen [Trj] (0)
C:\Test\0903\29\Load.rar\loadv.exe [L] Win32:Walpak [Cryp] (0)
已感染文件: 9
总共文件: 19
总共文件夹: 1
总共大小: 2.5 MB
*
* 任务被停止: 2009年3月29日 16:20:11
* 运作时间是 2 秒
*

显示全部楼层 · 发表于 2009-3-29 16:22:41

卡巴杀10启发1漏5

已删除：木马程序 Trojan-Spy.Win32.Zbot.qus       文件　: D:\软件\其它\v\k\new\新建文件夹\Load.rar/file.exe
已删除：木马程序 Packed.Win32.Krap.m       文件　: D:\软件\其它\v\k\new\新建文件夹\Load.rar/fileff.exe
已隔离：新威胁 PECompact (修改)       文件　: D:\软件\其它\v\k\new\新建文件夹\Load.rar/install.exe//PE_Patch.PECompact//PecBundle//PECompact
已删除：木马程序 Trojan.Win32.Agent.bxve       文件　: D:\软件\其它\v\k\new\新建文件夹\Load.rar/KB908122.exe
已删除：病毒 Worm.Win32.AutoRun.adiw       文件　: D:\软件\其它\v\k\new\新建文件夹\Load.rar/loadee.exe
已删除：病毒 Email-Worm.Win32.Joleee.ke       文件　: D:\软件\其它\v\k\new\新建文件夹\Load.rar/loadeee.exe
已删除：病毒 Email-Worm.Win32.Joleee.ke       文件　: D:\软件\其它\v\k\new\新建文件夹\Load.rar/loadf.exe
已删除：木马程序 Trojan.Win32.VB.moa       文件　: D:\软件\其它\v\k\new\新建文件夹\Load.rar/loadfff.exe
已删除：木马程序 Packed.Win32.Krap.m       文件　: D:\软件\其它\v\k\new\新建文件夹\Load.rar/loadss.exe
已删除：木马程序 Trojan-Spy.Win32.Zbot.gen       文件　: D:\软件\其它\v\k\new\新建文件夹\Load.rar/loadsss.exe
已删除：木马程序 Packed.Win32.Krap.m       文件　: D:\软件\其它\v\k\new\新建文件夹\Load.rar/loadv.exe

TO KL

Hello,

fileg.exe - Trojan.Win32.Tdss.vot
files.exe - Trojan.Win32.SpBot.o
install.exe - Trojan-Downloader.Win32.FraudLoad.dzj
load.exe - Trojan-PSW.Win32.Agent.mpj
loade.exe - Trojan-Downloader.Win32.Small.jmf
loads.exe - Trojan-Downloader.Win32.Agent.bpre

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

>From: lovefuwa0411@qq.com
>Sent: Mar 29 2009 12:24PM
>To: "New Virus" <newvirus@kaspersky.com>
>Subject: virus
>
>
>

Best Regards, NewVirus

10/1, 1st Volokolamsky Proezd, Moscow, 123060, Russia
Tel./Fax: + 7 (495) 797 8700
http://www.kaspersky.com http://www.viruslist.com

[ 本帖最后由 sbbdms 于 2009-3-29 18:22 编辑 ]

显示全部楼层 · 发表于 2009-3-29 16:22:58

Starting the file scan:

Begin scan in 'D:\new\new'
D:\new\new\file.exe
[DETECTION] Is the TR/Dropper.Gen Trojan
[NOTE]    A backup was created as '4a3b30b7.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
D:\new\new\fileff.exe
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE]    A backup was created as '4b4dc5c8.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
D:\new\new\files.exe
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE]    A backup was created as '4a3b30b9.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
D:\new\new\install.exe
[DETECTION] Contains recognition pattern of the ADSPY/AdSpy.Gen adware or spyware
[NOTE]    A backup was created as '4a4230bd.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
D:\new\new\KB908122.exe
[DETECTION] Is the TR/Crypt.ULPM.Gen Trojan
[NOTE]    A backup was created as '4a083091.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
D:\new\new\load.exe
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE]    A backup was created as '4a3030be.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
D:\new\new\loade.exe
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
[NOTE]    A backup was created as '4b46c5cf.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
D:\new\new\loadfff.exe
[DETECTION] Is the TR/VB.moa Trojan
[NOTE]    A backup was created as '4a3030a0.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
D:\new\new\loads.exe
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
[NOTE]    A backup was created as '4b46c5d1.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
D:\new\new\loadss.exe
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE]    A backup was created as '4a3030a2.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
D:\new\new\loadsss.exe
[DETECTION] Is the TR/Spy.ZBot.6144.1 Trojan
[NOTE]    A backup was created as '4b46c5d3.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
D:\new\new\loadv.exe
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE]    A backup was created as '4a3030a4.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

End of the scan: 2009年3月29日  16:24
Used time: 00:01 Minute(s)

The scan has been done completely.

   1 Scanned directories
   16 Files were scanned
   12 Viruses and/or unwanted programs were found
   0 Files were classified as suspicious
   12 files were deleted
   0 Viruses and unwanted programs were repaired
   12 Files were moved to quarantine
   0 Files were renamed
   0 Files cannot be scanned
   4 Files not concerned
   0 Archives were scanned
   0 Warnings
   12 Notes

显示全部楼层 · 发表于 2009-3-29 16:28:33

金山 0

显示全部楼层 · 发表于 2009-3-29 18:22:24

Hello,

fileg.exe - Trojan.Win32.Tdss.vot
files.exe - Trojan.Win32.SpBot.o
install.exe - Trojan-Downloader.Win32.FraudLoad.dzj
load.exe - Trojan-PSW.Win32.Agent.mpj
loade.exe - Trojan-Downloader.Win32.Small.jmf
loads.exe - Trojan-Downloader.Win32.Agent.bpre

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

>From: lovefuwa0411@qq.com
>Sent: Mar 29 2009 12:24PM
>To: "New Virus" <newvirus@kaspersky.com>
>Subject: virus
>
>
>

Best Regards, NewVirus

10/1, 1st Volokolamsky Proezd, Moscow, 123060, Russia
Tel./Fax: + 7 (495) 797 8700
http://www.kaspersky.com http://www.viruslist.com

显示全部楼层 · 发表于 2009-3-29 18:24:27

DR.WEB TO 7

显示全部楼层 · 发表于 2009-3-29 18:30:32

卡巴
已删除：木马程序 Trojan-Spy.Win32.Zbot.qus 文件: D:\Load.rar/file.exe
已删除：木马程序 Packed.Win32.Krap.m 文件: D:\Load.rar/fileff.exe
已删除：新威胁 PECompact (修改) 文件: D:\Load.rar/install.exe//PE_Patch.PECompact//PecBundle//PECompact
已删除：木马程序 Trojan.Win32.Agent.bxve 文件: D:\Load.rar/KB908122.exe
已删除：病毒 Worm.Win32.AutoRun.adiw 文件: D:\Load.rar/loadee.exe
已删除：病毒 Email-Worm.Win32.Joleee.ke 文件: D:\Load.rar/loadeee.exe
已删除：病毒 Email-Worm.Win32.Joleee.ke 文件: D:\Load.rar/loadf.exe
已删除：木马程序 Trojan.Win32.VB.moa 文件: D:\Load.rar/loadfff.exe
已删除：木马程序 Packed.Win32.Krap.m 文件: D:\Load.rar/loadss.exe

显示全部楼层 · 发表于 2009-3-29 18:35:30

卡巴斯基杀毒报告

扫描文件数：38

查杀（病毒、木马）数：12

详细杀毒报告列表：

2009-3-29 18:34:54 检测到威胁: Trojan-Spy.Win32.Zbot.qus C:\Documents and Settings\Try\桌面\Load.rar/file.exe
2009-3-29 18:34:54 未处理: Trojan-Spy.Win32.Zbot.qus C:\Documents and Settings\Try\桌面\Load.rar/file.exe 延期
2009-3-29 18:34:54 检测到威胁: Packed.Win32.Krap.m C:\Documents and Settings\Try\桌面\Load.rar/fileff.exe
2009-3-29 18:34:54 未处理: Packed.Win32.Krap.m C:\Documents and Settings\Try\桌面\Load.rar/fileff.exe 延期
2009-3-29 18:34:55 检测到威胁: PECompact C:\Documents and Settings\Try\桌面\Load.rar/install.exe/PE_Patch.PECompact/PecBundle/PECompact
2009-3-29 18:34:55 未处理: PECompact C:\Documents and Settings\Try\桌面\Load.rar/install.exe/PE_Patch.PECompact/PecBundle/PECompact 延期
2009-3-29 18:34:55 检测到威胁: HEUR:Trojan.Win32.Generic C:\Documents and Settings\Try\桌面\Load.rar/KB908122.exe
2009-3-29 18:34:55 未处理: HEUR:Trojan.Win32.Generic C:\Documents and Settings\Try\桌面\Load.rar/KB908122.exe 延期
2009-3-29 18:34:55 检测到威胁: HEUR:Trojan.Win32.Generic C:\Documents and Settings\Try\桌面\Load.rar/load.exe
2009-3-29 18:34:55 未处理: HEUR:Trojan.Win32.Generic C:\Documents and Settings\Try\桌面\Load.rar/load.exe 延期
2009-3-29 18:34:55 检测到威胁: HEUR:Trojan-Downloader.Win32.Generic C:\Documents and Settings\Try\桌面\Load.rar/loade.exe
2009-3-29 18:34:55 未处理: HEUR:Trojan-Downloader.Win32.Generic C:\Documents and Settings\Try\桌面\Load.rar/loade.exe 延期
2009-3-29 18:34:55 检测到威胁: HEUR:Trojan-Downloader.Win32.Generic C:\Documents and Settings\Try\桌面\Load.rar/loade.exe
2009-3-29 18:34:56 检测到威胁: HEUR:Worm.Win32.Generic C:\Documents and Settings\Try\桌面\Load.rar/loadeee.exe
2009-3-29 18:34:56 未处理: HEUR:Worm.Win32.Generic C:\Documents and Settings\Try\桌面\Load.rar/loadeee.exe 延期
2009-3-29 18:34:56 检测到威胁: HEUR:Worm.Win32.Generic C:\Documents and Settings\Try\桌面\Load.rar/loadeee.exe
2009-3-29 18:34:56 检测到威胁: HEUR:Worm.Win32.Generic C:\Documents and Settings\Try\桌面\Load.rar/loadf.exe
2009-3-29 18:34:56 未处理: HEUR:Worm.Win32.Generic C:\Documents and Settings\Try\桌面\Load.rar/loadf.exe 延期
2009-3-29 18:34:56 检测到威胁: HEUR:Worm.Win32.Generic C:\Documents and Settings\Try\桌面\Load.rar/loadf.exe
2009-3-29 18:34:56 检测到威胁: Trojan.Win32.VB.moa C:\Documents and Settings\Try\桌面\Load.rar/loadfff.exe
2009-3-29 18:34:56 未处理: Trojan.Win32.VB.moa C:\Documents and Settings\Try\桌面\Load.rar/loadfff.exe 延期
2009-3-29 18:34:56 检测到威胁: Packed.Win32.Krap.m C:\Documents and Settings\Try\桌面\Load.rar/loadss.exe
2009-3-29 18:34:56 未处理: Packed.Win32.Krap.m C:\Documents and Settings\Try\桌面\Load.rar/loadss.exe 延期
2009-3-29 18:34:56 检测到威胁: Trojan-Spy.Win32.Zbot.gen C:\Documents and Settings\Try\桌面\Load.rar/loadsss.exe
2009-3-29 18:34:56 未处理: Trojan-Spy.Win32.Zbot.gen C:\Documents and Settings\Try\桌面\Load.rar/loadsss.exe 延期
2009-3-29 18:34:56 检测到威胁: Packed.Win32.Krap.m C:\Documents and Settings\Try\桌面\Load.rar/loadv.exe
2009-3-29 18:34:56 未处理: Packed.Win32.Krap.m C:\Documents and Settings\Try\桌面\Load.rar/loadv.exe 延期
2009-3-29 18:34:57 检测到威胁: HEUR:Trojan.Win32.Generic C:\Documents and Settings\Try\桌面\Load.rar/KB908122.exe
2009-3-29 18:34:57 检测到威胁: Trojan-Spy.Win32.Zbot.qus C:\Documents and Settings\Try\桌面\Load.rar/file.exe
2009-3-29 18:34:57 已删除: Trojan-Spy.Win32.Zbot.qus C:\Documents and Settings\Try\桌面\Load.rar/file.exe
2009-3-29 18:34:57 检测到威胁: Packed.Win32.Krap.m C:\Documents and Settings\Try\桌面\Load.rar/fileff.exe
2009-3-29 18:34:57 已删除: Packed.Win32.Krap.m C:\Documents and Settings\Try\桌面\Load.rar/fileff.exe
2009-3-29 18:34:57 检测到威胁: PECompact C:\Documents and Settings\Try\桌面\Load.rar/install.exe/PE_Patch.PECompact/PecBundle/PECompact
2009-3-29 18:34:57 检测到威胁: HEUR:Trojan.Win32.Generic C:\Documents and Settings\Try\桌面\Load.rar/load.exe
2009-3-29 18:34:57 检测到威胁: HEUR:Trojan-Downloader.Win32.Generic C:\Documents and Settings\Try\桌面\Load.rar/loade.exe
2009-3-29 18:34:57 检测到威胁: HEUR:Trojan-Downloader.Win32.Generic C:\Documents and Settings\Try\桌面\Load.rar/loade.exe
2009-3-29 18:34:58 检测到威胁: HEUR:Trojan.Win32.Generic C:\Documents and Settings\Try\桌面\Load.rar/loadeee.exe
2009-3-29 18:34:59 检测到威胁: HEUR:Worm.Win32.Generic C:\Documents and Settings\Try\桌面\Load.rar/loadeee.exe
2009-3-29 18:34:59 检测到威胁: HEUR:Worm.Win32.Generic C:\Documents and Settings\Try\桌面\Load.rar/loadeee.exe
2009-3-29 18:35:00 检测到威胁: HEUR:Trojan.Win32.Generic C:\Documents and Settings\Try\桌面\Load.rar/loadf.exe
2009-3-29 18:35:00 检测到威胁: HEUR:Worm.Win32.Generic C:\Documents and Settings\Try\桌面\Load.rar/loadf.exe
2009-3-29 18:35:00 检测到威胁: HEUR:Worm.Win32.Generic C:\Documents and Settings\Try\桌面\Load.rar/loadf.exe
2009-3-29 18:35:00 检测到威胁: Trojan.Win32.VB.moa C:\Documents and Settings\Try\桌面\Load.rar/loadfff.exe
2009-3-29 18:35:00 已删除: Trojan.Win32.VB.moa C:\Documents and Settings\Try\桌面\Load.rar/loadfff.exe
2009-3-29 18:35:00 检测到威胁: Packed.Win32.Krap.m C:\Documents and Settings\Try\桌面\Load.rar/loadss.exe
2009-3-29 18:35:00 已删除: Packed.Win32.Krap.m C:\Documents and Settings\Try\桌面\Load.rar/loadss.exe
2009-3-29 18:35:00 检测到威胁: Trojan-Spy.Win32.Zbot.gen C:\Documents and Settings\Try\桌面\Load.rar/loadsss.exe
2009-3-29 18:35:00 已删除: Trojan-Spy.Win32.Zbot.gen C:\Documents and Settings\Try\桌面\Load.rar/loadsss.exe
2009-3-29 18:35:00 检测到威胁: Packed.Win32.Krap.m C:\Documents and Settings\Try\桌面\Load.rar/loadv.exe
2009-3-29 18:35:00 已删除: Packed.Win32.Krap.m C:\Documents and Settings\Try\桌面\Load.rar/loadv.exe

显示全部楼层 · 发表于 2009-3-29 19:04:36

费尔11个

显示全部楼层 · 发表于 2009-3-29 21:23:20

McAfee 报了5个。。

[病毒样本] PDF解出来的东西

本帖子中包含更多资源