6个样本

lomo

小红伞扫描一个U盘，发现一些老货色，有个是伪装成一张图片的EXE。

Begin scan in 'I:\' <KINGSTON>
I:\sxs.exe
    [DETECTION] Is the TR/PSW.QQpass.LR.1 Trojan
    [NOTE]      A backup was created as '4b20b8fa.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
I:\RavMon.exe
    [DETECTION] Is the TR/Agent.Abt.3 Trojan
    [NOTE]      A backup was created as '4b23b8e4.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
I:\Recycled.exe
    [DETECTION] Is the TR/Agent.1252319 Trojan
    [NOTE]      A backup was created as '4b10b8ea.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
I:\EXPLORER.EXE
    [DETECTION] Contains recognition pattern of the W32/VB.BU Windows virus
    [NOTE]      A backup was created as '4afdb8de.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
I:\wsctf.exe
    [DETECTION] Is the TR/VB.HM Trojan
    [NOTE]      A backup was created as '4b10b8f9.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
I:\XX\2008年文件\新建文件夹\申请QQ工具.rar
  [0] Archive type: RAR
    --> freeQQ.exe
      [DETECTION] Contains a recognition pattern of the (harmful) BDS/Pcclient.jzj.1 back-door program
    [NOTE]      A backup was created as '4aff44de.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!

从隔离中恢复到桌面想发到样本区。因为开着监控做压缩包会出错，所以暂时关闭小红伞监控。

实机被感染。进程中多了跟病毒名字一样的东西。

  Module is infected -> 'C:\WINDOWS\system32\XP-CCFED4B2.EXE'
  Module is infected -> 'C:\WINDOWS\system32\EXPLORER.EXE'

WINDOWS下也有了。

C:\WINDOWS\system32\XP-CCFED4B2.EXE
    [DETECTION] Is the TR/Agent.1252319 Trojan
    [NOTE]      A backup was created as '4adabe75.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\WINDOWS\system32\EXPLORER.EXE
    [DETECTION] Contains recognition pattern of the W32/VB.BU Windows virus
    [NOTE]      A backup was created as '4afdbe7d.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!

[ 本帖最后由 lomo 于 2009-9-14 14:29 编辑 ]

失落的手链

瑞星2010

lomo

RX2010还不错哦。
不过U盘主人的机子上装的貌似就是RX，不过可能不是2010。

欠妳緈諨

C:\Documents and Settings\Administrator\桌面\Recycled[1]\Recycled.exe - Win32/FlyStudio.NCG 特洛伊木马
C:\Documents and Settings\Administrator\桌面\Recycled[1]\virus\EXPLORER.EXE - Win32/VB.NHZ 蠕虫
C:\Documents and Settings\Administrator\桌面\Recycled[1]\virus\RavMon.exe - Win32/Agent.NAV 蠕虫
C:\Documents and Settings\Administrator\桌面\Recycled[1]\virus\sxs.exe - Win32/PSW.QQPass.JF 特洛伊木马
C:\Documents and Settings\Administrator\桌面\Recycled[1]\virus\wsctf.exe - Win32/VB.NIH 蠕虫
C:\Documents and Settings\Administrator\桌面\Recycled[1]\virus\申请QQ工具.rar > RAR > freeQQ.exe - 可能是 Win32/PcClient 特洛伊木马 的变种

ljinchao2008

我的KAV2010在第一个压缩包里检测出5个威胁,但第二个、第三个没有检测出来。

sam.to

to ll(missed 1)

lomo

第二、第三是一个样本，大于1M，所以弄了俩压缩包。

黑衣~魂

drweb
EXPLORER.EXE - infected with BackDoor.Generic.1451
\wsctf.exe - infected with Win32.HLLW.Wtc
\RavMon.exe - infected with Win32.HLLW.Cent
\sxs.exe - infected with Trojan.PWS.Qqpass.182
Recycled.exe - infected with Win32.HLLW.Autoruner.2855

wangyunxi80

第二、三虽然是一个样本，红伞对解压的两个都报，但扫描压缩包不报。

benq80282

Avira AntiVir
virus.rar
  [0] Archive type: RAR
    --> virus\￉￪ￇ￫QQﾹﾤﾾ￟.rar
      [1] Archive type: RAR
      --> freeQQ.exe
        [DETECTION] Contains a recognition pattern of the (harmful) BDS/Pcclient.jzj.1 back-door program
    --> virus\EXPLORER.EXE
      [DETECTION] Contains recognition pattern of the W32/VB.BU Windows virus
    --> virus\wsctf.exe
      [DETECTION] Is the TR/VB.HM Trojan
    --> virus\RavMon.exe
      [DETECTION] Is the TR/Agent.Abt.3 Trojan
    --> virus\sxs.exe
      [DETECTION] Is the TR/PSW.QQpass.LR.1 Trojan
    [NOTE]      A backup was created as '4b203243.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!


Recycled.part1.rar  
Recycled.part2.rar
偵測不到毒!! 很失望................