大多数杀软能识别的

幸福的猪猪

kaba heur，to kill！（挂马网页上面得到的）


Hello,


g.exe - Trojan-Dropper.Win32.Mudrop.yx

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.


传到在线沙盘运行，得到一份病毒下载列表：（kaba miss 5x ，以打包上报，  下载地址一起上报）

hxxp://u8.ggoovv.com/sb/ko.exe
hxxp://u1.ggoovv.com/la/L2.exe
hxxp://u4.ggoovv.com/gb/B10.exe
hxxp://u4.ggoovv.com/gb/B5.exe
hxxp://u4.ggoovv.com/gb/B6.exe
hxxp://u4.ggoovv.com/gb/B2.exe
hxxp://u4.ggoovv.com/gb/B3.exe
hxxp://u4.ggoovv.com/gb/B4.exe
hxxp://u4.ggoovv.com/gb/B7.exe
hxxp://u9.ggoovv.com/cj/a1.exe
hxxp://u3.ggoovv.com/lm/S10.exe
hxxp://u3.ggoovv.com/lm/S8.exe
hxxp://u3.ggoovv.com/lm/S1.exe
hxxp://u2.ggoovv.com/gz/G3.exe
hxxp://u2.ggoovv.com/gz/G1.exe
hxxp://u2.ggoovv.com/gz/G5.exe
hxxp://u2.ggoovv.com/gz/G31.exe
hxxp://u2.ggoovv.com/gz/G4.exe
hxxp://u2.ggoovv.com/gz/G39.exe
hxxp://u2.ggoovv.com/gz/G36.exe
hxxp://u2.ggoovv.com/gz/G37.exe
hxxp://u2.ggoovv.com/gz/G33.exe
hxxp://u2.ggoovv.com/gz/G32.exe
hxxp://u2.ggoovv.com/gz/G35.exe
hxxp://u2.ggoovv.com/gz/G15.exe
hxxp://u2.ggoovv.com/gz/G22.exe
hxxp://u2.ggoovv.com/gz/G12.exe
hxxp://u2.ggoovv.com/gz/G9.exe
hxxp://u9.ggoovv.com/cj/csj1.exe
hxxp://u9.ggoovv.com/cj/a2.exe
hxxp://u9.ggoovv.com/cj/a10.exe
hxxp://u9.ggoovv.com/cj/a6.exe
hxxp://u9.ggoovv.com/cj/q1.exe
hxxp://u9.ggoovv.com/cj/q2.exe
hxxp://u9.ggoovv.com/cj/csj.exe
hxxp://u9.ggoovv.com/cj/a8.exe
hxxp://u8.ggoovv.com/sb/05.exe

[ 本帖最后由 幸福的猪猪 于 2009-4-2 08:26 编辑 ]

HC303

g.zip:
When accessing data from the URL, "http://bbs.kafan.cn/attachment.php?aid=502192&k=8b5e35903cff6509f75511512cb15f8d&t=1238633736"
a virus or unwanted program 'TR/Rootkit.Gen' [trojan] was found.
Action taken: Ignored
tddownload.zip:
G:\virus\TDDOWNLOAD.zip
  [0] Archive type: ZIP
    --> TDDOWNLOAD/05.exe
      [DETECTION] Is the TR/Agent.7799.A Trojan
    --> TDDOWNLOAD/L2.exe
      [DETECTION] Is the TR/Dropper.Gen Trojan
    --> TDDOWNLOAD/B6.exe
      [DETECTION] Is the TR/Spy.Gen Trojan
    --> TDDOWNLOAD/G3.exe
      --> Object
        [2] Archive type: RSRC
        --> Object
          [DETECTION] Is the TR/Agent2.gxl Trojan
        --> Object
          [DETECTION] Is the TR/PSW.25088.3 Trojan
    --> TDDOWNLOAD/G33.exe
      [DETECTION] Contains HEUR/Malware suspicious code
      --> Object
        [2] Archive type: RSRC
        --> Object
          [DETECTION] Is the TR/Agent2.gxl Trojan

ledled

Name: Packed/Upack
Type: Sequence

Description:


Files:
c:\users\administrator\desktop\g.exe

薇薇兔

Generic.Malware.SP!BPk!Tkg.11D560E1 (Engine A)&Generic.PWS.Games.3.CBA7F6E5, Generic.PWS.Games.3.670688AD, Generic.PWS.Games.3.CA5F9918 (Engine A), Win32:Trojan-gen {Other} (2x) (Engine B)

kalynn84

Win32:Trojan-gen {Other}

wrq

Warning

--------------------------------------------------------------------------------

In order not to compromise your security, this page will not be accessed


A virus or unwanted program has been detected
in the HTTP data on the requested page.

--------------------------------------------------------------------------------

Requested URL: http://bbs.kafan.cn/attachment.p ... db&t=1238649386
Information Is the TR/Rootkit.Gen Trojan


--------------------------------------------------------------------------------

Generated by AntiVir WebGuard 9.0.3.0, AVE 8.2.0.129, VDF 7.1.3.2

mikzh

anaylics over character is good

姚明扣板

请问楼主要是这些病毒大部分杀毒软件都能识别，是不是我们就可以放心作用了，在这方面还得注意些什么呢？