查看: 4234|回复: 9
收起左侧

[病毒样本] 今天清理沙盘,一堆好玩的东东,大家扫扫吧

[复制链接]
mofunzone
发表于 2007-2-11 16:51:06 | 显示全部楼层 |阅读模式
都是antivir不能报的,已经上报了
肯定有你的不会报的
而且可能有些文件不是病毒,已经尽量删除了,temp文件和非exe和dll的基本都删光了
Thank you for your submission. Below you can see the current status of the uploaded files.



We received the following archive files:File ID         Filename         Size (Byte)        Result
204731         Temp.rar        2.572.302        OK


A listing of files contained inside archives alongside their results can be found below:File ID         Filename         Size (Byte)        Result
204732         116.exe         141.520         UNDER ANALYSIS
204733         Banner.dll         4.096         UNDER ANALYSIS
204734         cx1017.exe         242.850         UNDER ANALYSIS
204735         cx_1017.exe         144.391         UNDER ANALYSIS
204736         dodolook056.exe         179.323         UNDER ANALYSIS
204737         DoSSSetup.dll         81.920         UNDER ANALYSIS
204738         InetLoad.dll         18.944         UNDER ANALYSIS
204739         mms_953_1.exe         163.339         UNDER ANALYSIS
204740         mms_955_1.exe         163.346         UNDER ANALYSIS
204741         NetSetup001.exe         210.241         UNDER ANALYSIS
204742         setup(1).exe         219.167         UNDER ANALYSIS
204743         setup.exe         78.336         UNDER ANALYSIS
200697         System.dll         10.240         MALWARE
204744         temp.exe         163.346         UNDER ANALYSIS
204745         UUpdate.exe         200.704         UNDER ANALYSIS
204746         UUSEE_borl_Setup04.exe         141.260         UNDER ANALYSIS
204747         UUSEE_borl_Setup_04.exe         35.328         UNDER ANALYSIS
204748         MyDemo.dll         3.584         UNDER ANALYSIS
204749         TestRun.exe         43.520         UNDER ANALYSIS
204750         Deleteme.bat         176         UNDER ANALYSIS
204751         u264Dec.ax         94.208         UNDER ANALYSIS
204752         UUPlayer.exe         34.816         UNDER ANALYSIS
204753         bak_UUSEEAudioDec.ax         118.784         UNDER ANALYSIS
204754         uuseeload1.gif         14.953         UNDER ANALYSIS
204755         last_ver.ini         3.249         UNDER ANALYSIS
204751         u264Dec.ax         94.208         UNDER ANALYSIS
204752         UUPlayer.exe         34.816         UNDER ANALYSIS
204754         uuseeload1.gif         14.953         UNDER ANALYSIS
204756         vermini_x_hy.ini.uuuu.dat         27         UNDER ANALYSIS
204757         clientStat.dll         47.104         UNDER ANALYSIS
204758         IssueDown.dll         38.400         UNDER ANALYSIS
204759         UpState.exe         196.608         UNDER ANALYSIS
204760         zbox2.exe         212.992         UNDER ANALYSIS
204761         zBoxDll.dll         66.560         UNDER ANALYSIS



Please find a detailed report concerning each individual sample below: Filename        Result
116.exe         UNDER ANALYSIS


The file '116.exe' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
Banner.dll         UNDER ANALYSIS


The file 'Banner.dll' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
cx1017.exe         UNDER ANALYSIS


The file 'cx1017.exe' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
cx_1017.exe         UNDER ANALYSIS


The file 'cx_1017.exe' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
dodolook056.exe         UNDER ANALYSIS


The file 'dodolook056.exe' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
DoSSSetup.dll         UNDER ANALYSIS


The file 'DoSSSetup.dll' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
InetLoad.dll         UNDER ANALYSIS


The file 'InetLoad.dll' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
mms_953_1.exe         UNDER ANALYSIS


The file 'mms_953_1.exe' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
mms_955_1.exe         UNDER ANALYSIS


The file 'mms_955_1.exe' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
NetSetup001.exe         UNDER ANALYSIS


The file 'NetSetup001.exe' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
setup(1).exe         UNDER ANALYSIS


The file 'setup(1).exe' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
setup.exe         UNDER ANALYSIS


The file 'setup.exe' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
System.dll         MALWARE


The file 'System.dll' has been determined to be 'MALWARE'. Our analysts discovered that the file is a Trojan. In general this kind of programs contains harmful functionality called payload. Detection will be added to our virus definition file (VDF) with one of the next updates.
Filename        Result
temp.exe         UNDER ANALYSIS


The file 'temp.exe' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
UUpdate.exe         UNDER ANALYSIS


The file 'UUpdate.exe' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
UUSEE_borl_Setup04.exe         UNDER ANALYSIS


The file 'UUSEE_borl_Setup04.exe' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
UUSEE_borl_Setup_04.exe         UNDER ANALYSIS


The file 'UUSEE_borl_Setup_04.exe' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
MyDemo.dll         UNDER ANALYSIS


The file 'MyDemo.dll' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
TestRun.exe         UNDER ANALYSIS


The file 'TestRun.exe' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
Deleteme.bat         UNDER ANALYSIS


The file 'Deleteme.bat' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
u264Dec.ax         UNDER ANALYSIS


The file 'u264Dec.ax' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
UUPlayer.exe         UNDER ANALYSIS


The file 'UUPlayer.exe' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
bak_UUSEEAudioDec.ax         UNDER ANALYSIS


The file 'bak_UUSEEAudioDec.ax' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
uuseeload1.gif         UNDER ANALYSIS


The file 'uuseeload1.gif' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
last_ver.ini         UNDER ANALYSIS


The file 'last_ver.ini' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
u264Dec.ax         UNDER ANALYSIS


The file 'u264Dec.ax' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
UUPlayer.exe         UNDER ANALYSIS


The file 'UUPlayer.exe' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
uuseeload1.gif         UNDER ANALYSIS


The file 'uuseeload1.gif' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
vermini_x_hy.ini.uuuu.dat         UNDER ANALYSIS


The file 'vermini_x_hy.ini.uuuu.dat' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
clientStat.dll         UNDER ANALYSIS


The file 'clientStat.dll' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
IssueDown.dll         UNDER ANALYSIS


The file 'IssueDown.dll' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
UpState.exe         UNDER ANALYSIS


The file 'UpState.exe' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
zbox2.exe         UNDER ANALYSIS


The file 'zbox2.exe' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
zBoxDll.dll         UNDER ANALYSIS


The file 'zBoxDll.dll' has been determined to be 'UNDER ANALYSIS'.

Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
kp2006
头像被屏蔽
发表于 2007-2-11 16:58:21 | 显示全部楼层
金山报4 kv不报 nod32报2 pcc不报

信息 2007-02-11 17:07:07 金山毒霸主程序 启动   
信息 2007-02-11 17:07:07 金山毒霸主程序启动查毒过程,查毒方式:命令行查毒   
病毒 2007-02-11 17:07:16 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\TEMP\TEMP\dodolook056.exe Win32.Troj.Dropper.ba.179323 清除成功
风险程序 2007-02-11 17:07:18 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\TEMP\TEMP\cx_1017.exe Win32.Adware.Boran.z.144391 隔离成功
风险程序 2007-02-11 17:07:19 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\TEMP\TEMP\DoSSSetup.dll Win32.RiskWare.AcpiDisk.sx.81920 隔离成功
风险程序 2007-02-11 17:07:19 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\TEMP\TEMP\setup(1).exe Win32.Adware.BHO.av.219167 隔离成功
信息 2007-02-11 17:07:19 金山毒霸主程序查毒过程结束,查毒方式:命令行查毒   
信息 2007-02-11 17:07:19 您此次查毒共查了内存模块0个,磁盘引导扇区0个,文件27个   
信息 2007-02-11 17:07:19 您此次查毒共查出4个病毒以及危险代码   
信息 2007-02-11 17:07:19 您此次查毒清除了4个病毒

nod32

C:\Documents and Settings\Administrator\桌面\Temp.rar >>RAR >>Temp\setup(1).exe >>NSIS >>ad1087.exe >>NSIS >>cpush.dll - Win32/Adware.BHO.AV 应用程序

C:\Documents and Settings\Administrator\桌面\Temp.rar >>RAR >>Temp\temp.exe >>NSIS >>mms_955.exe >>NSIS >>invison.exe - probably a variant of Win32/Adware.Boran 应用程序

[ 本帖最后由 kp2006 于 2007-2-11 17:14 编辑 ]
mofunzone
 楼主| 发表于 2007-2-11 16:59:27 | 显示全部楼层
看来国内的反病毒软件在查杀本土病毒还是有一些优势的
希望antivir什么时候在中国做病毒收集实验室。。
zxy900906
发表于 2007-2-11 16:59:37 | 显示全部楼层
反病毒专家 AntiVirusKit 2007 扫描病毒日志记录
版本
双引擎反病毒签名 2/11/2007
开始时间: 2/11/2007 16:58
引擎: KAV 引擎 (OTZ..怪蜀黍..), AVST 引擎 (( ̄▽ ̄)b..小loli..囧..)
高启发式: 打开
压缩文件: 打开
系统区域: 打开

扫描系统区域...
扫描所选择的目录和文件...
对象: Temp/116.exe data0004
        在压缩档案里: C:\Documents and Settings\user\桌面\Temp.rar
狀態: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.Cinmus.j (KAV 引擎)
对象: Temp/cx1017.exe/stream/data0001 data0002
        在压缩档案里: C:\Documents and Settings\user\桌面\Temp.rar
狀態: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.Boran.z (KAV 引擎)
对象: Temp/cx_1017.exe data0002
        在压缩档案里: C:\Documents and Settings\user\桌面\Temp.rar
狀態: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.Boran.z (KAV 引擎)
对象: Temp/dodolook056.exe/data0003 data0004
        在压缩档案里: C:\Documents and Settings\user\桌面\Temp.rar
狀態: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.Cinmus.j (KAV 引擎)
对象: Temp/setup(1).exe/stream/data0002/stream data0001
        在压缩档案里: C:\Documents and Settings\user\桌面\Temp.rar
狀態: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.BHO.av (KAV 引擎)
对象: Temp/setup(1).exe/stream data0003
        在压缩档案里: C:\Documents and Settings\user\桌面\Temp.rar
狀態: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.WSearch.j (KAV 引擎)
对象: Temp/temp.exe/stream data0001
        在压缩档案里: C:\Documents and Settings\user\桌面\Temp.rar
狀態: 已发现病毒
        病毒: Trojan-Downloader.Win32.Agent.bcd (KAV 引擎)
对象: Temp/temp.exe/stream/data0003 data0002
        在压缩档案里: C:\Documents and Settings\user\桌面\Temp.rar
狀態: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.Boran.z (KAV 引擎)
对象: Temp\cx1017.exe=>(NSIS o) lzma_solid_nsis0002
        在压缩档案里: C:\Documents and Settings\user\桌面\Temp.rar
狀態: 已发现病毒
        病毒: Trojan.Agent.AHD (AVST 引擎)
对象: Temp\setup(1).exe=>(NSIS o) lzma_solid_nsis0001
        在压缩档案里: C:\Documents and Settings\user\桌面\Temp.rar
狀態: 已发现病毒
        病毒: Trojan.Agent.AHD (AVST 引擎)
对象: Temp\setup(1).exe=>(NSIS o)=>lzma_solid_nsis0002=>(NSIS o) lzma_solid_nsis0001
        在压缩档案里: C:\Documents and Settings\user\桌面\Temp.rar
狀態: 已发现病毒
        病毒: Trojan.Sogou.A (AVST 引擎)
对象: Temp\setup(1).exe=>(NSIS o) lzma_solid_nsis0003
        在压缩档案里: C:\Documents and Settings\user\桌面\Temp.rar
狀態: 已发现病毒
        病毒: Adware.Wsearch.Q (AVST 引擎)
对象: Temp.rar
        路径: C:\Documents and Settings\user\桌面
狀態: 文件移入隔离区
        病毒: not-a-virus:AdWare.Win32.Cinmus.j (2x), not-a-virus:AdWare.Win32.Boran.z (3x), not-a-virus:AdWare.Win32.BHO.av, not-a-virus:AdWare.Win32.WSearch.j, Trojan-Downloader.Win32.Agent.bcd (KAV 引擎), Trojan.Agent.AHD (2x), Trojan.Sogou.A, Adware.Wsearch.Q (AVST 引擎)
扫描完成: 2/11/2007 16:58
    已检查 2 个文件
    已发现 1 个染毒文件
    发现 0 个可疑文件

第2包没报..
hsjj2005
发表于 2007-2-11 17:34:43 | 显示全部楼层
微点:

广告软件名称:AdWare.Win32.Cinmus.at
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TWIEX8\TEMP\116.EXE
是广告软件!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Spy.Win32.Neweb.i
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TWIEX8\TEMP\CX1017.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
hsjj2005
发表于 2007-2-11 17:35:47 | 显示全部楼层
费尔静态扫描如图。

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
lm737475
发表于 2007-2-11 21:34:13 | 显示全部楼层
avast没有反应
yitp
发表于 2007-2-12 00:53:37 | 显示全部楼层
驱逐舰都搞定

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
yitp
发表于 2007-2-12 00:54:19 | 显示全部楼层
驱逐舰都搞定

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
yinxuchina
发表于 2007-2-14 03:37:37 | 显示全部楼层
都是广告程序,金山就只有杀点广告程序
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-3-28 18:27 , Processed in 0.111968 second(s), 18 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究,不得将上述内容用于商业或者其他非法用途,否则产生的一切后果自负,本站信息来自网络,版权争议问题与本站无关,您必须在下载后的24小时之内从您的电脑中彻底删除上述信息,如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表