病毒列表hxxp://ccg.jd2g.com/01/fz.txt(已打包)

cchao21

病毒列表hxxp://ccg.jd2g.com/01/fz.txt(已打包)

关于:hxxp://ccg.jd2g.com/01/fz.txt解密的日志(全体输出 -  46):

Level  0>http://ccg.jd2g.com/01/fz.txt
Level  1>http://u9.s8f3.com/sb/01/ok.exe  ●
Level  1>http://u1.s8f3.com/la/l1.exe  ●
Level  1>http://u1.s8f3.com/la/l3.exe  ●
Level  1>http://u1.s8f3.com/la/l4.exe （已失效）
Level  1>http://u1.s8f3.com/la/l2.exe （已失效）
Level  1>http://u9.s8f3.com/cj/a1.exe  ●
Level  1>http://u3.s8f3.com/lm/m39.exe  ●
Level  1>http://u3.s8f3.com/lm/m38.exe  ●
Level  1>http://u3.s8f3.com/lm/m23.exe  ●
Level  1>http://u3.s8f3.com/lm/m5.exe  ●
Level  1>http://u3.s8f3.com/lm/m25.exe  ●
Level  1>http://u3.s8f3.com/lm/m4.exe  ●
Level  1>http://u3.s8f3.com/lm/m01.exe  （已失效）
Level  1>http://u2.s8f3.com/lm/s10.exe  ●
Level  1>http://u2.s8f3.com/lm/s8.exe  ●
Level  1>http://u2.s8f3.com/lm/s1.exe  ●
Level  1>http://u2.s8f3.com/lm/s2.exe  ●
Level  1>http://u2.s8f3.com/lm/s12.exe  ●
Level  1>http://u2.s8f3.com/lm/s14.exe  ●
Level  1>http://u2.s8f3.com/lm/s15.exe  ●
Level  1>http://u2.s8f3.com/lm/s16.exe  ●
Level  1>http://u2.s8f3.com/lm/s21.exe  ●
Level  1>http://u2.s8f3.com/lm/s01.exe  ●
Level  1>http://u3.s8f3.com/lm/m33.exe  ●
Level  1>http://u3.s8f3.com/lm/m37.exe  ●
Level  1>http://u3.s8f3.com/lm/m15.exe  ●
Level  1>http://u3.s8f3.com/lm/m24.exe  ●
Level  1>http://u3.s8f3.com/lm/m02.exe  （已失效）
Level  1>http://u2.s8f3.com/lm/s13.exe  ●
Level  1>http://u2.s8f3.com/lm/s17.exe  ●
Level  1>http://u2.s8f3.com/lm/s20.exe  ●
Level  1>http://u2.s8f3.com/lm/s11.exe  ●
Level  1>http://u2.s8f3.com/lm/s02.exe  （已失效）
Level  1>http://u1.s8f3.com/la/l5.exe  （已失效）
Level  1>http://u1.s8f3.com/la/l6.exe  （已失效）
Level  1>http://u1.s8f3.com/la/l7.exe  ●
Level  1>http://u1.s8f3.com/la/l8.exe  ●
Level  1>http://u1.s8f3.com/la/l9.exe  ●
Level  1>http://u9.s8f3.com/cj/a2.exe  ●
Level  1>http://u9.s8f3.com/cj/a8.exe  ●
Level  1>http://u9.s8f3.com/cj/a6.exe （已失效）
Level  1>http://u9.s8f3.com/cj/a9.exe  （已失效）
Level  1>http://u9.s8f3.com/cj/a10.exe （已失效）
Level  1>http://u9.s8f3.com/cj/sb.exe  ●
Level  1>http://u0.s8f3.com/tt/01/01.exe  ●

网页分析：cchao21(打点的均为真实木马地址)

[ 本帖最后由 cchao21 于 2009-5-4 19:40 编辑 ]

Sebastian

Starting the file scan:

Begin scan in 'D:\kafan\2009-5-4___2757214.exe'
D:\kafan\2009-5-4___2757214.exe
    [DETECTION] Is the TR/Downloader.Gen Trojan
    [NOTE]      A backup was created as '4a2ee0c6.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___440447.exe'
D:\kafan\2009-5-4___440447.exe
    [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [NOTE]      A backup was created as '4ad333a7.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___71078.exe'
D:\kafan\2009-5-4___71078.exe
    [DETECTION] Is the TR/Crypt.FKM.Gen Trojan
    [NOTE]      A backup was created as '4a2ee0c8.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___1270829.exe'
D:\kafan\2009-5-4___1270829.exe
    [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [NOTE]      A backup was created as '4ad333a9.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___1410906.exe'
D:\kafan\2009-5-4___1410906.exe
    [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [NOTE]      A backup was created as '4a2ee0ca.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___1525549.exe'
D:\kafan\2009-5-4___1525549.exe
    [DETECTION] Is the TR/Dldr.Small.jqh Trojan
    [NOTE]      A backup was created as '4ad333ab.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___1534496.exe'
D:\kafan\2009-5-4___1534496.exe
    [DETECTION] Is the TR/Obfuscated.KU.447 Trojan
    --> ProgramFilesDir/15.exe
      [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '4a2ee0c7.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___445345.exe'
D:\kafan\2009-5-4___445345.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '4a2ee0cc.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___656824.exe'
D:\kafan\2009-5-4___656824.exe
    [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [NOTE]      A backup was created as '4ad333ad.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___67713.exe'
D:\kafan\2009-5-4___67713.exe
    [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [NOTE]      A backup was created as '4a2ee0ce.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___773045.exe'
D:\kafan\2009-5-4___773045.exe
    [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [NOTE]      A backup was created as '4ad333af.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___793808.exe'
D:\kafan\2009-5-4___793808.exe
    [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [NOTE]      A backup was created as '4a2ee0d0.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___845236.exe'
D:\kafan\2009-5-4___845236.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '4ad333b1.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___893262.exe'
D:\kafan\2009-5-4___893262.exe
    [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [NOTE]      A backup was created as '4a2ee0d2.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___960988.exe'
D:\kafan\2009-5-4___960988.exe
    [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [NOTE]      A backup was created as '4ad333b3.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___1743052.exe'
Begin scan in 'D:\kafan\2009-5-4___1749507.exe'
D:\kafan\2009-5-4___1749507.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
        [DETECTION] Contains recognition pattern of the SPR/Hacktool.28501 program
    [NOTE]      A backup was created as '4a2ee0d4.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___1831265.exe'
D:\kafan\2009-5-4___1831265.exe
    [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    [NOTE]      A backup was created as '4ad333b5.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___2341621.exe'
D:\kafan\2009-5-4___2341621.exe
    [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [NOTE]      A backup was created as '4a2ee0d6.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___2504209.exe'
D:\kafan\2009-5-4___2504209.exe
    [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [NOTE]      A backup was created as '4ad333b7.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___2579008.exe'
D:\kafan\2009-5-4___2579008.exe
    [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '4a2ee0c9.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___2581893.exe'
D:\kafan\2009-5-4___2581893.exe
    [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [NOTE]      A backup was created as '4ad333aa.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___2760449.exe'
D:\kafan\2009-5-4___2760449.exe
    [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [NOTE]      A backup was created as '4a2ee0cb.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___1043383.exe'
D:\kafan\2009-5-4___1043383.exe
    [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [NOTE]      A backup was created as '4ad333ac.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___1072944.exe'
D:\kafan\2009-5-4___1072944.exe
    [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [NOTE]      A backup was created as '4a2ee0cd.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___1110965.exe'
D:\kafan\2009-5-4___1110965.exe
    [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [NOTE]      A backup was created as '4ad333ae.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___1112392.exe'
D:\kafan\2009-5-4___1112392.exe
    [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [NOTE]      A backup was created as '4a2ee0cf.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___113593.exe'
D:\kafan\2009-5-4___113593.exe
    [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [NOTE]      A backup was created as '4ad333b0.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___1137861.exe'
D:\kafan\2009-5-4___1137861.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '4a2ee0d1.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___1268390.exe'
D:\kafan\2009-5-4___1268390.exe
    [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [NOTE]      A backup was created as '4ad333b2.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___1361407.exe'
D:\kafan\2009-5-4___1361407.exe
    [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [NOTE]      A backup was created as '4a2ee0d3.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___1498072.exe'
D:\kafan\2009-5-4___1498072.exe
    [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [NOTE]      A backup was created as '4ad333b4.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___185484.exe'
D:\kafan\2009-5-4___185484.exe
    [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [NOTE]      A backup was created as '4a2ee0d5.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___2078033.exe'
D:\kafan\2009-5-4___2078033.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '4ad333b6.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___2433980.exe'
D:\kafan\2009-5-4___2433980.exe
    [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [NOTE]      A backup was created as '4a2ee0d7.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2009-5-4___272884.exe'
D:\kafan\2009-5-4___272884.exe
    [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [NOTE]      A backup was created as '4a2ee0d8.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!


End of the scan: 2009年5月4日  20:33
Used time: 00:03 Minute(s)

The scan has been done completely.

      0 Scanned directories
     38 Files were scanned
     36 Viruses and/or unwanted programs were found
      0 Files were classified as suspicious
     35 files were deleted
      0 Viruses and unwanted programs were repaired
     35 Files were moved to quarantine
      0 Files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      1 Archives were scanned
      0 Warnings
     35 Notes

凝逸反毒

凝逸反毒  ok:0|毒:26|末知:8|36/36|每秒4个文件

kingmuro

悠柚

AVG
"Infections"
"File";"Infection";"Result"
"D:\TDDownload\TDDownload\2009-5-4___1043383.exe";"Trojan horse PSW.OnlineGames3.COT";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___1072944.exe";"Trojan horse PSW.OnlineGames3.COY";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___1110965.exe";"Trojan horse PSW.OnlineGames3.COT";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___1112392.exe";"Trojan horse PSW.OnlineGames3.BXN";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___113593.exe";"Trojan horse PSW.OnlineGames3.COT";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___1137861.exe";"Virus identified Win32/Cryptor";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___1268390.exe";"Trojan horse PSW.OnlineGames3.CPQ";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___1270829.exe";"Trojan horse PSW.OnlineGames3.COT";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___1361407.exe";"Trojan horse Downloader.Zlob_r.FK";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___1410906.exe";"Trojan horse PSW.OnlineGames3.COY";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___1498072.exe";"Trojan horse PSW.Ldpinch.XVU";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___1525549.exe";"Trojan horse Clicker.YKN";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___1749507.exe";"Trojan horse BackDoor.Generic9.VNG";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___1831265.exe";"Virus identified Win32/Cryptor";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___185484.exe";"Trojan horse PSW.OnlineGames3.COT";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___2078033.exe";"Virus identified Win32/Cryptor";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___2341621.exe";"Trojan horse PSW.OnlineGames3.CPQ";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___2433980.exe";"Trojan horse PSW.OnlineGames3.CVI";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___2504209.exe";"Trojan horse PSW.OnlineGames3.CQI";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___2579008.exe";"Trojan horse BackDoor.Generic_r.GE";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___2581893.exe";"Trojan horse PSW.OnlineGames3.COY";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___272884.exe";"Trojan horse PSW.OnlineGames3.COY";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___2757214.exe";"Virus identified Worm/Generic.WLK";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___2760449.exe";"Trojan horse PSW.OnlineGames3.COY";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___440447.exe";"Trojan horse Downloader.Zlob_r.FK";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___445345.exe";"Virus identified Win32/Cryptor";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___656824.exe";"Trojan horse PSW.OnlineGames3.COT";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___67713.exe";"Trojan horse Downloader.Zlob_r.FK";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___71078.exe";"Trojan horse Agent2.EWI";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___773045.exe";"Trojan horse PSW.OnlineGames3.COT";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___793808.exe";"Trojan horse Downloader.Zlob_r.FK";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___845236.exe";"Trojan horse PSW.Generic7.FID";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___893262.exe";"Trojan horse PSW.OnlineGames3.COY";"Infected"
"D:\TDDownload\TDDownload\2009-5-4___960988.exe";"Trojan horse PSW.OnlineGames3.COT";"Infected"

"Spyware"
"File";"Infection";"Result"
"D:\TDDownload\TDDownload\2009-5-4___1534496.exe";"Adware Generic4.BFF.dropper";"Potentially dangerous object"
"D:\TDDownload\TDDownload\2009-5-4___1534496.exe:\$KA\15.exe";"Adware Generic4.BFF";"Potentially dangerous object"