请高手研究一下这几个病毒

显示全部楼层 · 发表于 2009-7-9 13:17:01

请高手研究一下这几个病毒
貌似不一般

显示全部楼层 · 发表于 2009-7-9 13:20:06

IKARUS - T3SCAN V1.32.10.0 (WIN32)
      T3 V1.01.64
      Copyright (c) 2006 - 2009 by Ikarus Software.
      All rights reserved.

Signature-database from 9.7.2009 04:18:19 (Build: 73003)

e:\dudu.rar:dudu\1.exe - Signature 'Trojan-Dropper.Agent' found
e:\dudu.rar:dudu\ctfmen.exe - Signature 'Trojan-GameThief.Win32.Nilage' found
e:\dudu.rar:dudu\a.exe - Signature 'Trojan-Dropper.Agent' found
e:\dudu.rar:dudu\EDU6732432.exe - Signature 'Trojan-GameThief.Win32.OnLineGames' found
e:\dudu.rar:dudu\SGCQexe.exe - Signature 'Trojan-GameThief.Win32.OnLineGames' found
e:\dudu.rar - Signature 'Trojan-GameThief.Win32.OnLineGames' found

      7 Files scanned
      (1 Archiv with 7 files)
      6 Signatures found
      0 Suspect code-parts found
      Used time: 0:01.718

显示全部楼层 · 发表于 2009-7-9 13:21:17

显示全部楼层 · 发表于 2009-7-9 13:23:35

E:\Documents and Settings\Administrator\Application Data\srck\srck.exe E:\RECYCLER\S-1-5-21-839522115-1214440339-1801674531-500\De5356.exe\00027460.EXE New Malware.aq (特洛伊)
2009-7-9 13:22:07 已删除 CHINA-F81B63002\Administrator E:\Program Files\7-Zip\7zFM.exe E:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7zE12F.tmp\dudu\1.exe StartPage-HR (特洛伊)
2009-7-9 13:22:07 已删除 CHINA-F81B63002\Administrator E:\Program Files\7-Zip\7zFM.exe E:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7zE12F.tmp\dudu\ctfmen.exe\ctfmen.exe Generic VB.z (特洛伊)
2009-7-9 13:22:07 已删除 CHINA-F81B63002\Administrator E:\Program Files\7-Zip\7zFM.exe E:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7zE12F.tmp\dudu\a.exe StartPage-HR (特洛伊)
2009-7-9 13:22:07 已删除 CHINA-F81B63002\Administrator E:\Program Files\7-Zip\7zFM.exe E:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7zE12F.tmp\dudu\EDU6732432.exe PWS-Mmorpg!bg (特洛伊)
2009-7-9 13:22:07 已删除 CHINA-F81B63002\Administrator E:\Program Files\7-Zip\7zFM.exe E:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7zE12F.tmp\dudu\SGCQexe.exe PWS-Mmorpg!bf (特洛伊)

显示全部楼层 · 发表于 2009-7-9 13:24:14

1.exe - 可能是 Win32/AutoRun.KillAV.A 蠕虫的变种
ctfmen.exe - Win32/VB.NZV 特洛伊木马的变种
a.exe - 可能是 Win32/AutoRun.KillAV.A 蠕虫的变种
EDU6732432.exe - 可能是 Win32/Genetik 特洛伊木马的变种
SGCQexe.exe - Win32/PSW.OnLineGames.OIX 特洛伊木马

显示全部楼层 · 发表于 2009-7-9 13:24:44

扫描结果 : 97%的杀软(37/38)报告发现病毒基本都是入库的。。

显示全部楼层 · 发表于 2009-7-9 13:26:55

McAfee 已自动阻止和删除特洛伊木马程序。

关于此特洛伊木马程序
已检测到: StartPage-HR (特洛伊木马程序), StartPage-HR (特洛伊木马程序)
位置: C:\Documents and Settings\Administrator\桌面\新建文件夹\dudu\dudu\1.exe

关于此特洛伊木马程序
已检测到: Artemis!229E3C9A6765 (特洛伊木马程序), Artemis!229E3C9A6765 (特洛伊木马程序)
位置: C:\Documents and Settings\Administrator\桌面\新建文件夹\dudu\dudu\ctfmen.exe

关于此特洛伊木马程序
已检测到: StartPage-HR (特洛伊木马程序), StartPage-HR (特洛伊木马程序)
位置: C:\Documents and Settings\Administrator\桌面\新建文件夹\dudu\dudu\a.exe

关于此特洛伊木马程序
已检测到: PWS-Mmorpg!bg (特洛伊木马程序), PWS-Mmorpg!bg (特洛伊木马程序)
位置: C:\Documents and Settings\Administrator\桌面\新建文件夹\dudu\dudu\EDU6732432.exe

关于此特洛伊木马程序
已检测到: PWS-Mmorpg!bf (特洛伊木马程序), PWS-Mmorpg!bf (特洛伊木马程序)
位置: C:\Documents and Settings\Administrator\桌面\新建文件夹\dudu\dudu\SGCQexe.exe

显示全部楼层 · 发表于 2009-7-9 13:36:21

Starting the file scan:

Begin scan in 'C:\Users\Administrator\Desktop\dudu'
C:\Users\Administrator\Desktop\dudu\dudu\1.exe
[DETECTION] Is the TR/Crypt.FKM.Gen Trojan
[NOTE]    The file was deleted!
C:\Users\Administrator\Desktop\dudu\dudu\a.exe
[DETECTION] Is the TR/Crypt.FKM.Gen Trojan
[NOTE]    The file was deleted!
C:\Users\Administrator\Desktop\dudu\dudu\ctfmen.exe
[DETECTION] Is the TR/Crypt.FKM.Gen Trojan
[NOTE]    The file was deleted!
C:\Users\Administrator\Desktop\dudu\dudu\EDU6732432.exe
[NOTE]    The file was deleted!
--> Object
   [DETECTION] Is the TR/Agent.37416 Trojan
C:\Users\Administrator\Desktop\dudu\dudu\SGCQexe.exe
[DETECTION] Is the TR/Crypt.ULPM.Gen Trojan
[NOTE]    The file was deleted!

End of the scan: 2009年7月8日  22:36
Used time: 00:03 Minute(s)

The scan has been done completely.

   2 Scanned directories
   7 Files were scanned
   5 Viruses and/or unwanted programs were found
   0 Files were classified as suspicious
   5 files were deleted
   0 Viruses and unwanted programs were repaired
   0 Files were moved to quarantine
   0 Files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   0 Archives were scanned
   0 Warnings
   5 Notes

显示全部楼层 · 发表于 2009-7-9 14:24:09

小红伞留下两个
放到PF目录下运行
嗯，截图如下·

显示全部楼层 · 发表于 2009-7-9 14:43:23

瑞星2010

[病毒样本] 请高手研究一下这几个病毒

本帖子中包含更多资源

0字节的可以忽略！

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源