5月7日收集到的集合包！

pyic

样本位置：http://www.damipan.com/file/10nSRQ4.html

Sebastian

Starting the file scan:

Begin scan in 'D:\kafan\111.exe'
D:\kafan\111.exe
    [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '4a336b86.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2(1).exe'
D:\kafan\2(1).exe
    --> Object
      [DETECTION] Is the TR/Killav.PN Trojan
    [NOTE]      A backup was created as '4a336b7d.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2.exe'
D:\kafan\2.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '4a676b83.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\219.exe'
D:\kafan\219.exe
    [DETECTION] Contains recognition pattern of the ADSPY/Agent.161262 adware or spyware
    [NOTE]      A backup was created as '4a3b6b87.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\360Safe.exe'
D:\kafan\360Safe.exe
    [DETECTION] Is the TR/StartPage.doc Trojan
    [NOTE]      A backup was created as '4a326b8c.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\a2.exe'
D:\kafan\a2.exe
    [DETECTION] Is the TR/Obfuscated.KU.447 Trojan
    --> ProgramFilesDir/15.exe
      [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '4a306b88.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\b.exe'
D:\kafan\b.exe
    [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [NOTE]      A backup was created as '4a676b84.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\BB-Player.exe'
D:\kafan\BB-Player.exe
    [DETECTION] Is the TR/Crypt.CFI.Gen Trojan
    [NOTE]      A backup was created as '4a2f6b98.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\Edog.exe'
D:\kafan\Edog.exe
    [DETECTION] Is the TR/Downloader.Gen Trojan
    [NOTE]      A backup was created as '4a716bba.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\IEBar.exe'
D:\kafan\IEBar.exe
    [DETECTION] Contains recognition pattern of the DR/BaiduBar.DI.2 dropper
    --> [ProgramFilesDir]/baidu/bar/BDBar_tmp/BaiduBar.dll
      [DETECTION] Contains recognition pattern of the ADSPY/BaiduBar.DI adware or spyware
    [NOTE]      A backup was created as '4a446b9c.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\ktv14.exe'
D:\kafan\ktv14.exe
    [DETECTION] Is the TR/Hijacker.Gen Trojan
    [NOTE]      A backup was created as '4a786bcc.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\L7.exe'
D:\kafan\L7.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '4a306b8f.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\L9.exe'
D:\kafan\L9.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '4a306b91.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\m2.exe'
D:\kafan\m2.exe
    [DETECTION] Is the TR/Hijacker.Gen Trojan
    [NOTE]      A backup was created as '4a306b8b.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\ok.exe'
D:\kafan\ok.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '4a306bc5.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\out.exe'
D:\kafan\out.exe
    [DETECTION] Is the TR/Hijacker.Gen Trojan
    [NOTE]      A backup was created as '4a766bcf.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\setup(1).exe'
D:\kafan\setup(1).exe
    [DETECTION] Is the TR/Dldr.Small.4346738AP Trojan
    [NOTE]      A backup was created as '4a766bbf.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\setup.exe'
Begin scan in 'D:\kafan\update.exe'
Begin scan in 'D:\kafan\xiao7.exe'
D:\kafan\xiao7.exe
    [DETECTION] Is the TR/Downloader.Gen Trojan
    [NOTE]      A backup was created as '4a636bc5.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\xxx(2).exe'
D:\kafan\xxx(2).exe
    [DETECTION] Is the TR/Click.AK.20 Trojan
    [NOTE]      A backup was created as '4a7a6bd5.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\xxx(3).exe'
D:\kafan\xxx(3).exe
    [DETECTION] Is the TR/Click.AK.20 Trojan
    [NOTE]      A backup was created as '4b0de526.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\xxx.exe'
D:\kafan\xxx.exe
    [DETECTION] Is the TR/Click.AK.20 Trojan
    [NOTE]      A backup was created as '4a7a6bd7.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!


End of the scan: 2009年5月7日  13:02
Used time: 00:09 Minute(s)

The scan has been done completely.

      0 Scanned directories
     33 Files were scanned
     23 Viruses and/or unwanted programs were found
      0 Files were classified as suspicious
     21 files were deleted
      0 Viruses and unwanted programs were repaired
     21 Files were moved to quarantine
      0 Files were renamed
      0 Files cannot be scanned
     10 Files not concerned
      4 Archives were scanned
      0 Warnings
     21 Notes

Jungle

速度好慢


nod32...发现十五个...

aerbeisi

"E:\hunzabag.rar:\2(1).exe";"Trojan horse KillAV.AAG";"Infected"
"E:\hunzabag.rar:\ktv14.exe";"Trojan horse PSW.Generic7.GHN";"Infected"
"E:\hunzabag.rar:\L7.exe";"Trojan horse PSW.Generic7.FID";"Infected"
"E:\hunzabag.rar:\L9.exe";"Virus identified Win32/Cryptor";"Infected"
"E:\hunzabag.rar:\360Safe.exe";"Trojan horse Startpage.DYQ";"Infected"
"E:\hunzabag.rar:\BB-Player.exe";"Trojan horse Downloader.Generic8.AEQI";"Infected"
"E:\hunzabag.rar:\ok.exe";"Trojan horse Dropper.Generic.AMHT";"Infected"
"E:\hunzabag.rar:\setup(1).exe";"Trojan horse Downloader.Generic8.AFNE";"Infected"
"E:\hunzabag.rar:\xiao7.exe";"Virus found Downloader.Rozena";"Infected"
"E:\hunzabag.rar:\219.exe";"Adware Generic4.CRC";"Potentially dangerous object"
"E:\hunzabag.rar:\a2.exe";"Adware Generic4.BFF.dropper";"Potentially dangerous object"
"E:\hunzabag.rar:\IEBar.exe";"Adware Generic2.VPP";"Potentially dangerous object"
"E:\hunzabag.rar:\setup.exe";"Adware Generic4.BGS";"Potentially dangerous object"
"E:\hunzabag.rar:\111.exe";"Runtime packed nspack";""
"E:\hunzabag.rar:\2.exe";"Runtime packed fsg";""
"E:\hunzabag.rar:\m2.exe";"Runtime packed upack";""

wenhepan

还没下完 就被nod给杀了

huangqian202

费尔扫描到14个！

wobushiscam

卡巴报12个

linkak

07:05:2009 14:05:22 SEARCHTASK "USER_DEFINED" started...
scan item: D:\virus\hunzabag
File scanned: D:\virus\hunzabag\111.exe - SIGNATURE FOUND "Trojan-Dropper.Agent"
File scanned: D:\virus\hunzabag\2(1).exe - SIGNATURE FOUND "Trojan.Win32.AntiAV"
File scanned: D:\virus\hunzabag\219.exe - SIGNATURE FOUND "not-a-virus:AdWare.Win32.Cinmus"
File scanned: D:\virus\hunzabag\360Safe.exe - SIGNATURE FOUND "Trojan.Win32.StartPage"
File scanned: D:\virus\hunzabag\b.exe - SIGNATURE FOUND "Packed.Win32.Klone.af"
File scanned: D:\virus\hunzabag\BB-Player.exe - SIGNATURE FOUND "Trojan.Win32.Agent"
File scanned: D:\virus\hunzabag\Edog.exe - SIGNATURE FOUND "Trojan-Downloader"
File scanned: D:\virus\hunzabag\IEBar.exe - SIGNATURE FOUND "not-a-virus.Win32.Application.Baidubar"
File scanned: D:\virus\hunzabag\ktv14.exe - SIGNATURE FOUND "Win32.SuspectCrc"
File scanned: D:\virus\hunzabag\L7.exe - SIGNATURE FOUND "Trojan-Dropper.Agent"
File scanned: D:\virus\hunzabag\L9.exe - SIGNATURE FOUND "Generic.PWS"
File scanned: D:\virus\hunzabag\m2.exe - SIGNATURE FOUND "Trojan-PWS.OnlineGames"
File scanned: D:\virus\hunzabag\ok.exe - SIGNATURE FOUND "Packed.Win32.Klone"
File scanned: D:\virus\hunzabag\out.exe - SIGNATURE FOUND "Trojan.Win32.AgentBypass"
File scanned: D:\virus\hunzabag\setup(1).exe - SIGNATURE FOUND "Backdoor.Win32.PcClient"
File scanned: D:\virus\hunzabag\setup.exe - SIGNATURE FOUND "Backdoor.Win32.PcClient"
File scanned: D:\virus\hunzabag\xiao7.exe - SIGNATURE FOUND "Trojan-Downloader.Win32.Small"
File scanned: D:\virus\hunzabag\xxx(2).exe - SIGNATURE FOUND "Trojan-Clicker.Win32.Delf.fb"
File scanned: D:\virus\hunzabag\xxx(3).exe - SIGNATURE FOUND "Trojan-Clicker.Win32.Delf.fb"
File scanned: D:\virus\hunzabag\xxx.exe - SIGNATURE FOUND "Trojan-Clicker.Win32.Delf.fb"
07:05:2009 14:05:23 SEARCHTASK "USER_DEFINED" FINISHED...
----------------------------------------------------
Directories scanned: 1
Files scanned: 23
Virus found: 20
----------------------------------------------------

will

在 hunzabag\2(1).exe 中发现 TrojanDownloader.Agent.bebh 病毒
在 hunzabag\2.exe 中发现 TrojanDropper.Agent.wnt 病毒
在 hunzabag\219.exe->$TEMP\$TEMP\108.exe->$[34]\$R0 中发现 Adware/Cinmus.bsh 病毒
在 hunzabag\360Safe.exe 中发现 Trojan/StartPage.bhc 病毒
在 hunzabag\a2.exe->$[32]\15.exe 中发现 Adware/BHO.le 病毒
在 hunzabag\b.exe 中发现 Heur:Worm/Autorun 病毒
在 hunzabag\BB-Player.exe 中发现 TrojanDownloader.Small.aksj 病毒
在 hunzabag\ktv14.exe 中发现 TrojanDownloader.Delf.ptt 病毒
在 hunzabag\L7.exe 中发现 Trojan/PSW.WOW.aef 病毒
在 hunzabag\L9.exe 中发现 Backdoor/Bifrose.leb 病毒
在 hunzabag\setup(1).exe 中发现 Backdoor/PcClient.dmf 病毒
在 hunzabag\xiao7.exe 中发现 TrojanDownloader.Agent.bguo 病毒

凝逸反毒

凝逸反毒  ok:0|毒:7|末知:15|23/23|每秒3个文件

e:\000下载\8000\hunzabag\a2.exe,virus
e:\000下载\8000\hunzabag\bb-player.exe,virus
e:\000下载\8000\hunzabag\ktv14.exe,virus
e:\000下载\8000\hunzabag\l7.exe,virus
e:\000下载\8000\hunzabag\xiao7.exe,virus
e:\000下载\8000\hunzabag\xxx(2).exe,virus
e:\000下载\8000\hunzabag\xxx(3).exe,virus
e:\000下载\8000\hunzabag\xxx.exe,virus