多样本挂马综合包 - 第12次

HC303

第四次 红伞MISS ONE 上报。
Beginning disinfection:
G:\virus\7_6\1(1).exe
    [DETECTION] Contains a recognition pattern of the (harmful) BDS/Backdoor.Gen back-door program
    [NOTE]      The file was deleted!
G:\virus\7_6\82.exe
    [DETECTION] Is the TR/Rootkit.Gen Trojan
    [NOTE]      The file was deleted!
G:\virus\7_6\ie.exe
    [DETECTION] Is the TR/Dldr.Delphi.Gen Trojan
    [NOTE]      The file was deleted!
G:\virus\7_6\tan.exe
    [DETECTION] Is the TR/Dldr.Delphi.Gen Trojan
    [NOTE]      The file was deleted!
G:\virus\7_6\zy.exe
    [DETECTION] Is the TR/Crypt.NSPM.Gen Trojan
    [NOTE]      The file was deleted!

HC303

A2 KILL ALL
G:\virus\7_6\1(1).exe         detected: Trojan-Dropper.Win32.Dogrobot!IK
G:\virus\7_6\1.exe         detected: Trojan.Win32.StartPage!IK
G:\virus\7_6\82.exe         detected: Trojan-GameThief.Win32.Magania!IK
G:\virus\7_6\ie.exe         detected: Trojan-Downloader.Win32.Delf.aqt!IK
G:\virus\7_6\tan.exe         detected: Backdoor.Win32.Hupigon!IK
G:\virus\7_6\zy.exe         detected: MalwareScope.Trojan-PWS.Game!IK

a262020215

7_6.rar
费尔全查

F:\Sandbox\nieqi\DefaultBox\drive\E\7_6.rar>>1(1).exe        Trojan.Cap97521.jcmi        木马        还未处理
F:\Sandbox\nieqi\DefaultBox\drive\E\7_6.rar>>1.exe        Backdoor.Wuca.cq.orlp        后门        还未处理
F:\Sandbox\nieqi\DefaultBox\drive\E\7_6.rar>>82.exe        Trojan.Undef.gtr.juiw        木马        还未处理
F:\Sandbox\nieqi\DefaultBox\drive\E\7_6.rar>>ie.exe        TrojanDownloader.Delf.aqt.bqr        木马        还未处理
F:\Sandbox\nieqi\DefaultBox\drive\E\7_6.rar>>tan.exe        Trojan.Cap96314.xtws        木马        还未处理
F:\Sandbox\nieqi\DefaultBox\drive\E\7_6.rar>>zy.exe        IRC.Worm.Delf.q.pzic        病毒        还未处理

Dr.Web 5.0 没反映.呵呵难道真的只是名头大而已了

[ 本帖最后由 a262020215 于 2009-7-6 09:24 编辑 ]

angir

微点：Worm.Win32.Agent.rqu
Trojan.Win32.Genetik.nvi
Trojan-PSW.Win32.WOW.qei
Backdoor.Win32.Wuca.cg
Trojan-PSW.Win32.OnlineGames.eixe
Trojan-Dropper.Win32.Mudrop.aom

IllusionWing

Updated.

HC303

第五次 KILL ALL
Beginning disinfection:
G:\virus\7_6_2\b08.css
    [DETECTION] Contains a recognition pattern of the (harmful) BDS/Backdoor.Gen back-door program
    [NOTE]      The file was deleted!
G:\virus\7_6_2\me1.bin
    [DETECTION] Is the TR/Agent.33480.9 Trojan
    [NOTE]      The file was deleted!
G:\virus\7_6_2\WIN 9,0,115,0f.swf
    [DETECTION] Contains the SWF/Dldr.Agent.F.1 SWF virus
    [NOTE]      The file was deleted!
G:\virus\7_6_2\WIN 9,0,47,0f.swf
    [DETECTION] Contains the SWF/Dldr.Agent.F.1 SWF virus
    [NOTE]      The file was deleted!
G:\virus\7_6_2\WIN 9,0,64,0f.swf
    [DETECTION] Contains recognition pattern of the EXP/Flash.Gen exploit
    [NOTE]      The file was deleted!

987

C:\Documents and Settings\Administrator\My Documents\桌面\7_4.rar > RAR > a8.exe1 - Win32/Agent.PTG 特洛伊木马 - 是已删除对象的一部分
C:\Documents and Settings\Administrator\My Documents\桌面\7_4.rar > RAR > a9.exe1 - 可能是 Win32/Genetik 特洛伊木马 的变种 - 是已删除对象的一部分
C:\Documents and Settings\Administrator\My Documents\桌面\7_4.rar > RAR > L6.exe1 - Win32/PSW.WOW.DZI 特洛伊木马 的变种 - 是已删除对象的一部分
C:\Documents and Settings\Administrator\My Documents\桌面\7_4.rar > RAR > me.exe1 - 可能是 Win32/Genetik 特洛伊木马 的变种 - 是已删除对象的一部分
C:\Documents and Settings\Administrator\My Documents\桌面\7_4.rar > RAR > S16.exe1 - Win32/PSW.OnLineGames.NSU 特洛伊木马 的变种 - 是已删除对象的一部分
C:\Documents and Settings\Administrator\My Documents\桌面\7_4.rar > RAR > sb2.exe1 - Win32/Agent.NOV 特洛伊木马 - 是已删除对象的一部分
C:\Documents and Settings\Administrator\My Documents\桌面\7_4.rar > RAR > svchost.exe1 - 可能是 Win32/Genetik 特洛伊木马 的变种 - 是已删除对象的一部分

IllusionWing

updated

mofunzone

up to  7_6_3

IllusionWing

updated