[病毒样本] 10X

显示全部楼层 · 发表于 2009-7-14 21:20:23

[Found downloader] <W32/Downloader.C.gen!Eldorado (not disinfectable, generic)> C:\Test\10\10\1.exe
[Quarantined] C:\Test\10\10\1.exe
[Found possible security risk] <W32/Heuristic-210!Eldorado (not disinfectable)> C:\Test\10\10\别不信.exe->(NSPack)->(PE_Patch)
[Quarantined] C:\Test\10\10\别不信.exe->(NSPack)->(PE_Patch)
[Found possible security risk] <W32/Heuristic-210!Eldorado (not disinfectable)> C:\Test\10\10\木马啊.exe->(NSPack)->(PE_Patch)
[Quarantined] C:\Test\10\10\木马啊.exe->(NSPack)->(PE_Patch)
[Found security risk] <W32/Agent.CM.gen!Eldorado (not disinfectable, generic)> C:\Test\10\10\爱Q大盗 9.0.exe
[Quarantined] C:\Test\10\10\爱Q大盗 9.0.exe
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\Test\10\10\蜗牛官网.exe
[Quarantined] C:\Test\10\10\蜗牛官网.exe
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\Test\10\10\蜗牛透视.exe
[Quarantined] C:\Test\10\10\蜗牛透视.exe

---------------------------------------------------------------------
Scan ended: 2009-7-14, 21:19:39
Duration: 0:00:28

Scan result:

Scanned files:    10
Infected objects:    6
Disinfected objects:    0
Quarantined files:    6
---------------------------------------------------------------------

显示全部楼层 · 发表于 2009-7-14 21:24:47

全是Eldorado

Object: 1.exe
Path: D:\TDDownload\10
Status: Virus, file deleted
Virus: Trojan.Inject.GO (Engine A)
Object: aion0704.exe
Path: D:\TDDownload\10
Status: Virus, file deleted
Virus: Trojan.Generic.1618713 (Engine A)
Object: mydll.dll
Path: D:\TDDownload\10
Status: Virus, file deleted
Virus: Gen:Trojan.Heur.GM.0004460100 (Engine A)
Object: 别不信.exe
Path: D:\TDDownload\10
Status: Virus, file deleted
Virus: Trojan.Generic.221125 (Engine A)
Object: 外挂最新版过测试.exe
Path: D:\TDDownload\10
Status: Virus, file deleted
Virus: GenPack:Generic.Rincux2.D762BDEE (Engine A)
Object: 木马啊.exe
Path: D:\TDDownload\10
Status: Virus, file deleted
Virus: Trojan.Generic.216496 (Engine A)
Object: 爱Q大盗 9.0.exe
Path: D:\TDDownload\10
Status: Virus, file deleted
Virus: Trojan.Generic.1431448 (Engine A)
Object: 蜗牛官网.exe
Path: D:\TDDownload\10
Status: Virus, file deleted
Virus: Generic.Malware.SBE!.F8849BE0 (Engine A)
Object: 蜗牛透视.exe
Path: D:\TDDownload\10
Status: Virus, file deleted
Virus: Backdoor.Generic.45890 (Engine A)

显示全部楼层 · 发表于 2009-7-14 22:33:30

2009/7/14 22:30:23 已删除恶意程序 Constructor.Win32.IMG-ANI.c G:\Temp\Virus\10\10\木马啊.exe//NSPack
2009/7/14 22:30:23 已删除恶意程序 Constructor.Win32.IMG-ANI.b G:\Temp\Virus\10\10\别不信.exe//NSPack
2009/7/14 22:30:24 已删除木马程序 Backdoor.Win32.Prosti.at G:\Temp\Virus\10\10\蜗牛透视.exe//UPack
2009/7/14 22:30:23 已删除木马程序 Backdoor.Win32.Prosti.at G:\Temp\Virus\10\10\蜗牛官网.exe//UPack
2009/7/14 22:30:24 已删除木马程序 Trojan.Win32.Agent2.edf G:\Temp\Virus\10\10\爱Q大盗 9.0.exe
2009/7/14 22:30:23 已删除木马程序 Backdoor.Win32.Hupigon.hhdu G:\Temp\Virus\10\10\外挂最新版过测试.exe
2009/7/14 22:30:24 已删除木马程序 Backdoor.Win32.Small.hpm G:\Temp\Virus\10\10\aion0704.exe
2009/7/14 22:30:52 已隔离病毒 HEUR:Trojan.Win32.Generic G:\Temp\Virus\10\10\1.exe

显示全部楼层 · 发表于 2009-7-14 22:44:00

显示全部楼层 · 发表于 2009-7-15 00:03:12

Begin scan in 'G:\10.rar'
G:\10.rar
  [0] Archive type: RAR
--> 1.exe
   [DETECTION] Contains a recognition pattern of the (harmful) BDS/Hupigon.Gen back-door program
--> aion0704.exe
   [DETECTION] Contains a recognition pattern of the (harmful) BDS/Hupigon.Gen back-door program
--> ﾰﾮQﾴ￳ﾵ￁ 9.0.exe
   [DETECTION] Is the TR/Dropper.Gen Trojan
--> ﾱ￰ﾲﾻ￐ￅ.exe
   --> Object
      [DETECTION] Contains recognition pattern of the EXP/IMG-Ani.K.2.A exploit
--> ￄﾾￂ￭ﾰﾡ.exe
   [DETECTION] Is the TR/Crypt.NSPM.Gen Trojan
--> ￍ￢ﾹￒￗ￮￐ￂﾰ￦ﾹ

显示全部楼层 · 发表于 2009-7-15 00:19:14

to kl,ll

显示全部楼层 · 发表于 2009-7-15 00:24:50

IKARUS - T3SCAN V1.32.10.0 (WIN32)
      T3 V1.01.64
      Copyright (c) 2006 - 2009 by Ikarus Software.
      All rights reserved.

Signature-database from 14.7.2009 16:01:19 (Build: 73035)

e:\10\外挂最新版过测试.exe - Signature 'Trojan-Downloader.Win32.Small' found
e:\10\蜗牛官网.exe - Signature 'Backdoor.Win32.Prosti.cr' found
e:\10\蜗牛透视.exe - Signature 'Backdoor.Win32.Prosti.cr' found
e:\10\爱Q大盗 9.0.exe - Signature 'Virus.Win32.Agent.COH' found
e:\10\aion0704.exe - Signature 'Backdoor.Win32.Hupigon' found
e:\10\mydll.dll - Signature 'Gen.Trojan' found
e:\10\完整版.exe - Signature 'Virus.Win32.Atraps.CK' found
e:\10\别不信.exe - Signature 'Trojan-Dropper.Delf' found
e:\10\木马啊.exe - Signature 'Backdoor.Win32.Hupigon' found
e:\10\1.exe - Signature 'Backdoor.Win32.Hupigon' found

      10 Files scanned
      (0 Archives with 0 files)
      10 Signatures found
      0 Suspect code-parts found
      Used time: 0:01.156

显示全部楼层 · 发表于 2009-7-15 00:29:34

DR.WEB
1.exe;C:\Documents and Settings\all\桌面\10;BackDoor.Beizhu.2360;Deleted.;
aion0704.exe;C:\Documents and Settings\all\桌面\10;BackDoor.Pigeon.22242;Deleted.;
木啊~1.EXE;C:\Documents and Settings\all\桌面\10;Trojan.PWS.Qqpass.1740;Deleted.;
牛官网~1.EXE;C:\Documents and Settings\all\桌面\10;BackDoor.Rejoice;Deleted.;
牛透~1.EXE;C:\Documents and Settings\all\桌面\10;BackDoor.Rejoice;Deleted.;

显示全部楼层 · 发表于 2009-7-15 01:57:42

C:\Documents and Settings\Administrator\桌面\10\10\1.exe - 可能是 Win32/Hupigon 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\10\10\爱Q大盗 9.0.exe - Win32/FlyStudio.NFV 特洛伊木马
C:\Documents and Settings\Administrator\桌面\10\10\蜗牛官网.exe - Win32/TrojanDropper.Delf.VX 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\10\10\蜗牛透视.exe - Win32/TrojanDropper.Delf.VX 特洛伊木马的变种

[病毒样本] 10X

本帖子中包含更多资源

F-PROT 4.4.4

回复 2楼 allinwonderi 的帖子

本帖子中包含更多资源