1L:1x & 2L:27x

幸福的猪猪

在沙盘运行，弹出一个提示框，说什么文件损坏。QQ也随之退出，重新启动QQ……

帮忙看看是不是死的病毒样本！

kaba，avira miss，to kill！

[ 本帖最后由 幸福的猪猪 于 2009-6-3 09:07 编辑 ]

幸福的猪猪

再上报27x（木马群提取而来）

kaba miss 6x，to kill ！

avira kill all！

[ 本帖最后由 幸福的猪猪 于 2009-6-3 09:13 编辑 ]

HC303

The file 'qqxwwg.exe' has been determined to be 'UNDER ANALYSIS'.

悠柚

D:\TDDownload\TDDownload\cb.exe         已检测: Trojan-PWS.Win32.LdPinch!IK
D:\TDDownload\TDDownload\dh3.exe         已检测: Trojan-PWS.Win32.LdPinch!IK
D:\TDDownload\TDDownload\dnf.exe         已检测: Trojan-PWS.Win32.LdPinch!IK
D:\TDDownload\TDDownload\jz.exe         已检测: Trojan-PWS.Win32.LdPinch!IK
D:\TDDownload\TDDownload\mh.exe         已检测: Trojan-PWS.Win32.LdPinch!IK
D:\TDDownload\TDDownload\my.exe         已检测: Trojan-PWS.Win32.LdPinch!IK
D:\TDDownload\TDDownload\tx2.exe         已检测: Trojan-PWS.Win32.LdPinch!IK
D:\TDDownload\TDDownload\wl.exe         已检测: Trojan-PWS.Win32.LdPinch!IK
D:\TDDownload\TDDownload\xx1.exe         已检测: Trojan-PWS.Win32.LdPinch!IK
D:\TDDownload\TDDownload\xx10.exe         已检测: Trojan-PWS.Win32.LdPinch!IK
D:\TDDownload\TDDownload\xx11.exe         已检测: Trojan-PWS.Win32.LdPinch!IK
D:\TDDownload\TDDownload\xx12.exe         已检测: Trojan-PWS.Win32.LdPinch!IK
D:\TDDownload\TDDownload\xx13.exe         已检测: Trojan-PWS.Win32.LdPinch!IK
D:\TDDownload\TDDownload\xx14.exe         已检测: Trojan-PWS.Win32.LdPinch!IK
D:\TDDownload\TDDownload\xx15.exe         已检测: Trojan-PWS.Win32.LdPinch!IK
D:\TDDownload\TDDownload\xx16.exe         已检测: Trojan-PWS.Win32.LdPinch!IK
D:\TDDownload\TDDownload\xx17.exe         已检测: Trojan-PWS.Win32.LdPinch!IK
D:\TDDownload\TDDownload\xx18.exe         已检测: Trojan-PWS.Win32.LdPinch!IK
D:\TDDownload\TDDownload\xx19.exe         已检测: Trojan-GameThief.Win32.Nilage!IK
D:\TDDownload\TDDownload\xx2.exe         已检测: Trojan-Dropper.OnLineGames!IK
D:\TDDownload\TDDownload\xx3.exe         已检测: Trojan-PWS.Win32.LdPinch!IK
D:\TDDownload\TDDownload\xx4.exe         已检测: Trojan-PWS.Win32.LdPinch!IK
D:\TDDownload\TDDownload\xx5.exe         已检测: Trojan-PWS.Win32.LdPinch!IK
D:\TDDownload\TDDownload\xx6.exe         已检测: Trojan-Downloader.Agent.pmd.2!IK
D:\TDDownload\TDDownload\xx7.exe         已检测: Trojan-PWS.Win32.LdPinch!IK
D:\TDDownload\TDDownload\xx8.exe         已检测: Trojan-PWS.Win32.LdPinch!IK
D:\TDDownload\TDDownload\xx9.exe         已检测: Trojan-PWS.Win32.LdPinch!IK

328397663

有时候在沙盘里运行,还不如在影子系统里运行,,只不过收集起来比较麻烦.

kingmuro

2009-06-03 11:13:48        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\cb.exe\[UPX]" file.  
2009-06-03 11:13:52        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\cb.exe\[Embedded_Ix#1a10]\[UPX]" file.  
2009-06-03 11:13:52        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\dh3.exe\[UPX]" file.  
2009-06-03 11:13:52        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\dh3.exe\[Embedded_Ix#2210]\[UPX]" file.  
2009-06-03 11:13:52        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\dnf.exe\[UPX]" file.  
2009-06-03 11:13:52        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\dnf.exe\[Embedded_Ix#1a10]\[UPX]" file.  
2009-06-03 11:13:52        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\jz.exe\[UPX]" file.  
2009-06-03 11:13:52        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\jz.exe\[Embedded_Ix#1a10]\[UPX]" file.  
2009-06-03 11:13:52        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\mh.exe\[UPX]" file.  
2009-06-03 11:13:52        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\mh.exe\[Embedded_Ix#1a10]\[UPX]" file.  
2009-06-03 11:13:52        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\my.exe\[UPX]" file.  
2009-06-03 11:13:52        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\my.exe\[Embedded_Ix#1a10]\[UPX]" file.  
2009-06-03 11:13:52        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\tx2.exe\[UPX]" file.  
2009-06-03 11:13:52        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\tx2.exe\[Embedded_Ix#2210]\[UPX]" file.  
2009-06-03 11:13:52        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\wl.exe\[UPX]" file.  
2009-06-03 11:13:52        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\wl.exe\[Embedded_Ix#2210]" file.  
2009-06-03 11:13:52        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx1.exe\[UPX]" file.  
2009-06-03 11:13:52        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx1.exe\[Embedded_Ix#1a10]\[UPX]" file.  
2009-06-03 11:13:52        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx10.exe\[UPX]" file.  
2009-06-03 11:13:52        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx10.exe\[Embedded_Ix#2210]\[UPX]" file.  
2009-06-03 11:13:52        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx11.exe\[UPX]" file.  
2009-06-03 11:13:52        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx11.exe\[Embedded_Ix#1a10]\[UPX]" file.  
2009-06-03 11:13:52        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx12.exe\[UPX]" file.  
2009-06-03 11:13:52        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx12.exe\[Embedded_Ix#1a10]\[UPX]" file.  
2009-06-03 11:13:52        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx13.exe\[UPX]" file.  
2009-06-03 11:13:52        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx13.exe\[Embedded_Ix#1a10]\[UPX]" file.  
2009-06-03 11:13:53        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx14.exe\[UPX]" file.  
2009-06-03 11:13:53        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx14.exe\[Embedded_Ix#1a10]\[UPX]" file.  
2009-06-03 11:13:53        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx15.exe\[UPX]" file.  
2009-06-03 11:13:53        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx15.exe\[Embedded_Ix#2210]\[UPX]" file.  
2009-06-03 11:13:53        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx16.exe\[UPX]" file.  
2009-06-03 11:13:53        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx16.exe\[Embedded_Ix#1a10]\[UPX]" file.  
2009-06-03 11:13:53        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx17.exe\[UPX]" file.  
2009-06-03 11:13:53        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx17.exe\[Embedded_Ix#1a10]\[UPX]" file.  
2009-06-03 11:13:53        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx18.exe\[UPX]" file.  
2009-06-03 11:13:53        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx18.exe\[Embedded_Ix#1a10]\[UPX]" file.  
2009-06-03 11:13:53        gxf        1776        Sign of "Win32:Spyware-gen [Trj]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx19.exe\[ASPack]\[Embedded_R#1869c]" file.  
2009-06-03 11:13:53        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx3.exe\[UPX]" file.  
2009-06-03 11:13:53        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx3.exe\[Embedded_Ix#1a10]\[UPX]" file.  
2009-06-03 11:13:53        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx4.exe\[UPX]" file.  
2009-06-03 11:13:53        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx4.exe\[Embedded_Ix#2210]\[UPX]" file.  
2009-06-03 11:13:53        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx5.exe\[UPX]" file.  
2009-06-03 11:13:53        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx5.exe\[Embedded_Ix#2210]\[UPX]" file.  
2009-06-03 11:13:53        gxf        1776        Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx6.exe" file.  
2009-06-03 11:13:53        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx7.exe\[UPX]" file.  
2009-06-03 11:13:53        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx7.exe\[Embedded_Ix#1a10]\[UPX]" file.  
2009-06-03 11:13:53        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx8.exe\[UPX]" file.  
2009-06-03 11:13:53        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx8.exe\[Embedded_Ix#2210]\[UPX]" file.  
2009-06-03 11:13:53        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx9.exe\[UPX]" file.  
2009-06-03 11:13:53        gxf        1776        Sign of "Win32:Agent-ACMH [Drp]" has been found in "C:\Documents and Settings\gxf\桌面\110\27x\TDDownload\xx9.exe\[Embedded_Ix#1a10]\[UPX]" file.

kingmuro

蜘蛛杀

HC303

The file 'qqxwwg.exe' has been determined to be 'MALWARE',Our analysts named the threat TR/Dldr.Agent.cebk

sam.to

卡巴清空

yulhun

a variant of Win32/TrojanDownloader.Agent.BZVA trojan
ZIP > TDDownload/qqxwwg.exe a variant of Win32/TrojanDownloader.Agent.BZVA trojan
nod32