Norton 2010捕捉的

显示全部楼层 · 发表于 2009-7-1 19:53:37

在虚拟机跑Norton 2010，试毒，测SONAR，Norton时不时地提示威胁（应该是提示是否运行一个中度可疑的程序），还显示了地址（看来此功能是为了防御未知挂马的），摸索出来一大堆毒
提示的是hxxp://122.224.4.142/fuck/A28.exe
剩下的是
hxxp://122.224.4.142/fuck/A01.exe
hxxp://122.224.4.142/fuck/A02.exe
hxxp://122.224.4.142/fuck/A03.exe
hxxp://122.224.4.142/fuck/A04.exe
hxxp://122.224.4.142/fuck/A05.exe
hxxp://122.224.4.142/fuck/A06.exe
hxxp://122.224.4.142/fuck/A07.exe
hxxp://122.224.4.142/fuck/A08.exe
hxxp://122.224.4.142/fuck/A09.exe
......
直到hxxp://122.224.4.142/fuck/A34.exe
还有hxxp://122.224.4.142/****/***.exe
***和****忘了
其中一个***为st

望Hunters能帮我找找

P.S.:Fuck是个不好的字眼儿，如果想学纯正英语千万别用，学美语也最好不要用

[ 本帖最后由 gzy_hao 于 2009-7-1 20:03 编辑 ]

显示全部楼层 · 发表于 2009-7-1 19:59:22

DR.WEB清空
A01.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12116;Deleted.;
A02.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12116;Deleted.;
A03.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12059;Deleted.;
A04.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12056;Deleted.;
A05.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12116;Deleted.;
A06.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12056;Deleted.;
A07.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12058;Deleted.;
A08.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12056;Deleted.;
A09.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12035;Deleted.;
A10.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12056;Deleted.;
A11.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12035;Deleted.;
A12.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12035;Deleted.;
A13.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12059;Deleted.;
A14.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12056;Deleted.;
A15.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12082;Deleted.;
A16.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12056;Deleted.;
A17.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12116;Deleted.;
A18.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12056;Deleted.;
A19.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12082;Deleted.;
A20.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12056;Deleted.;
A21.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12056;Deleted.;
A22.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12059;Deleted.;
A23.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.11706;Deleted.;
A24.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12056;Deleted.;
A25.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Gamania.19056;Deleted.;
A26.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12035;Deleted.;
A27.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12056;Deleted.;
A28.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12058;Deleted.;
A29.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12056;Deleted.;
A30.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12057;Deleted.;
A31.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12082;Deleted.;
A32.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12082;Deleted.;
A33.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12056;Deleted.;
A34.exe;C:\Documents and Settings\all\桌面\a;Trojan.PWS.Wsgame.12059;Deleted.;

显示全部楼层 · 发表于 2009-7-1 21:08:08

McAfee 清空。。

显示全部楼层 · 发表于 2009-7-1 21:11:36

瑞星2010全杀死

显示全部楼层 · 发表于 2009-7-1 21:13:17

IK 清空

显示全部楼层 · 发表于 2009-7-1 21:18:04

All files killed by KIS 2009

[ 本帖最后由 sam.to 于 2009-7-1 21:20 编辑 ]

显示全部楼层 · 发表于 2009-7-1 21:22:30

没下载完，就被小A给河蟹了。

显示全部楼层 · 发表于 2009-7-1 21:25:49

KIS 9.0 Kill
2009-7-1 21:24:43 检测到: Trojan-GameThief.Win32.Magania.biht 不存在 http://bbs.kafan.cn/attachment.p ... //PE_Patch.UPX//UPX 启发式分析计算的威胁级别值较高
2009-7-1 21:24:43 拒绝: Trojan-GameThief.Win32.Magania.biht 不存在 http://bbs.kafan.cn/attachment.p ... //PE_Patch.UPX//UPX 启发式分析计算的威胁级别值较高

显示全部楼层 · 发表于 2009-7-1 21:39:05

红伞全灭
comodo留了4个

显示全部楼层 · 发表于 2009-7-1 23:05:15

已检测：木马程序 Trojan-GameThief.Win32.Magania.biht 文件：D:\My Documents\桌面\test\a\A31.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.bfws 文件：D:\My Documents\桌面\test\a\A32.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.bfrp 文件：D:\My Documents\桌面\test\a\A33.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.bful 文件：D:\My Documents\桌面\test\a\A34.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.biht 文件：D:\My Documents\桌面\test\a\A01.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.bjrz 文件：D:\My Documents\桌面\test\a\A02.exe
已检测：木马程序 Trojan-GameThief.Win32.Magania.bful 文件：D:\My Documents\桌面\test\a\A03.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.bfrp 文件：D:\My Documents\桌面\test\a\A04.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.bijf 文件：D:\My Documents\桌面\test\a\A05.exe
已检测：木马程序 Trojan-GameThief.Win32.Magania.bfrp 文件：D:\My Documents\桌面\test\a\A06.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.bfrp 文件：D:\My Documents\桌面\test\a\A07.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.bfrp 文件：D:\My Documents\桌面\test\a\A08.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.bfdq 文件：D:\My Documents\桌面\test\a\A09.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.bfrp 文件：D:\My Documents\桌面\test\a\A10.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.bfdq 文件：D:\My Documents\桌面\test\a\A11.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.bfdq 文件：D:\My Documents\桌面\test\a\A12.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.bful 文件：D:\My Documents\桌面\test\a\A13.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.bfrp 文件：D:\My Documents\桌面\test\a\A14.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.bhxj 文件：D:\My Documents\桌面\test\a\A15.exe
已检测：木马程序 Trojan-GameThief.Win32.Magania.bfrp 文件：D:\My Documents\桌面\test\a\A16.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.biht 文件：D:\My Documents\桌面\test\a\A17.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.bfrp 文件：D:\My Documents\桌面\test\a\A18.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.biht 文件：D:\My Documents\桌面\test\a\A19.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.bfrp 文件：D:\My Documents\桌面\test\a\A20.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.bfrp 文件：D:\My Documents\桌面\test\a\A21.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.bful 文件：D:\My Documents\桌面\test\a\A22.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-PSW.Win32.LdPinch.afvp 文件：D:\My Documents\桌面\test\a\A23.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.bfrp 文件：D:\My Documents\桌面\test\a\A24.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.bfsy 文件：D:\My Documents\桌面\test\a\A25.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.bfdq 文件：D:\My Documents\桌面\test\a\A26.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.bfrp 文件：D:\My Documents\桌面\test\a\A27.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.bfrp 文件：D:\My Documents\桌面\test\a\A28.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.bfrp 文件：D:\My Documents\桌面\test\a\A29.exe//PE_Patch.UPX//UPX
已检测：木马程序 Trojan-GameThief.Win32.Magania.bjsc 文件：D:\My Documents\桌面\test\a\A30.exe
kav6.0 34个

[病毒样本] Norton 2010捕捉的

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

KAV6.0