查看: 3896|回复: 21
收起左侧

[病毒样本] 病毒包,过费尔

[复制链接]
solcroft
发表于 2007-4-2 10:18:05 | 显示全部楼层 |阅读模式
右键扫描不报,但执行时都被拦截了,个个都保证是有效样本

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
The EQs
发表于 2007-4-2 10:19:05 | 显示全部楼层
Scan performed at: 2007-4-2 10:19:10
Scanning Log
NOD32 version 2161 (20070401) NT
Command line: C:\Documents and Settings\EQ2\桌面\foto.zip
Operating memory - is OK

Date: 2.4.2007  Time: 10:19:14
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\foto.zip
C:\Documents and Settings\EQ2\桌面\foto.zip ?ZIP ?foto.exe - Win32/Wigon.S trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\foto.zip ?ZIP ?dvdsvideos1186.exe ?NSIS ?00.exe ?RAR ?01.exe - Incorrect file checksum (CRC), the file is probably password protected.
C:\Documents and Settings\EQ2\桌面\foto.zip ?ZIP ?dvdsvideos1186.exe ?NSIS ?00.exe ?RAR ?02.exe - Incorrect file checksum (CRC), the file is probably password protected.
C:\Documents and Settings\EQ2\桌面\foto.zip ?ZIP ?LinkShare.exe - Win32/LowZones.DR trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\foto.zip ?ZIP ?loader.exe - probably a variant of Win32/TrojanDownloader.Small.NFP trojan
C:\Documents and Settings\EQ2\桌面\foto.zip ?ZIP ?skydown.exe - Win32/TrojanDownloader.Agent.NJH trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\foto.zip ?ZIP ?a002.exe - probably a variant of Win32/PSW.Legendmir.AYK trojan
C:\Documents and Settings\EQ2\桌面\foto.zip ?ZIP ?a0021.exe - Win32/TrojanDropper.Small.AUQ trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\foto.zip ?ZIP ?a003.exe - Win32/PSW.Legendmir.AYK trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\foto.zip ?ZIP ?a0031.exe - Win32/PSW.Legendmir.AYK trojan - was a part of the deleted object
Number of scanned files: 14
Number of threats found: 8
Number of files cleaned: 1
Time of completion: 10:19:15 Total scanning time: 1 sec (00:00:01)
The EQs
发表于 2007-4-2 10:20:37 | 显示全部楼层
最后留下一个文件说有密码保护。。。。。。
mofunzone
发表于 2007-4-2 10:23:57 | 显示全部楼层
Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\foto.zip'
C:\Documents and Settings\morgan\My Documents\
  foto.zip
    [0] Archive type: ZIP
    --> foto.exe
        [DETECTION] Is the Trojan horse TR/Rootkit.AU
        [WARNING]   Infected files in archives cannot be repaired!
    --> dvdsvideos1186.exe
    --> LinkShare.exe
        [DETECTION] Is the Trojan horse TR/QLowZones.35
        [WARNING]   Infected files in archives cannot be repaired!
    --> loader.exe
        [DETECTION] Is the Trojan horse TR/Agent.4608.67
        [WARNING]   Infected files in archives cannot be repaired!
    --> skydown.exe
        [DETECTION] Is the Trojan horse TR/Hijack.Explor.1360
        [WARNING]   Infected files in archives cannot be repaired!
    --> a002.exe
        [DETECTION] Is the Trojan horse TR/PSW.Lmir.bgo
        [WARNING]   Infected files in archives cannot be repaired!
    --> a0021.exe
        [DETECTION] Is the Trojan horse TR/Drop.Small.auq
        [WARNING]   Infected files in archives cannot be repaired!
    --> a003.exe
        [DETECTION] Is the Trojan horse TR/PSW.Lmir.bey.2
        [WARNING]   Infected files in archives cannot be repaired!
    --> a0031.exe
        [DETECTION] Is the Trojan horse TR/PSW.Lmir.bey.2
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!


End of the scan: 2007年4月1日  19:23
Used time: 00:14 min

The scan has been done completely.

      0 Scanning directories
     10 Files were scanned
      8 viruses and/or unwanted programs were found
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      1 Archives were scanned
      9 Warnings
      0 Notes
solcroft
 楼主| 发表于 2007-4-2 10:24:30 | 显示全部楼层

回复 #3 EQ2 的帖子

是Zlob变种,执行时会自动解压

[ 本帖最后由 solcroft 于 2007-4-2 11:57 编辑 ]
剑指七星
发表于 2007-4-2 10:26:32 | 显示全部楼层
已检测到: 木马程序 Trojan-Dropper.Win32.Small.avu        URL: http:/bbs.kafan.cn/attachment.php?aid=50651\foto.exe
soul20010
发表于 2007-4-2 10:42:51 | 显示全部楼层
FS7.0拦截了九次。。。
The EQs
发表于 2007-4-2 10:45:35 | 显示全部楼层
最后一个文件运行后杀了生成物
Time        Module        Object        Name        Threat        Action        User        Information
2007-4-2 10:44:32        AMON        file        C:\Documents and Settings\EQ2\桌面\foto\a0031.exe        Win32/PSW.Legendmir.AYK trojan        quarantined - deleted - error while cleaning - operation unavailable for this type of object        KASPERSK-F13F4E\EQ2        Event occurred on a newly created file. The file was moved to quarantine. You may close this window.
2007-4-2 10:44:32        AMON        file        C:\Documents and Settings\EQ2\桌面\foto\a003.exe        Win32/PSW.Legendmir.AYK trojan        quarantined - deleted - error while cleaning - operation unavailable for this type of object        KASPERSK-F13F4E\EQ2        Event occurred on a newly created file. The file was moved to quarantine. You may close this window.
2007-4-2 10:44:32        AMON        file        C:\Documents and Settings\EQ2\桌面\foto\a0021.exe        Win32/TrojanDropper.Small.AUQ trojan        quarantined - deleted - error while cleaning - operation unavailable for this type of object        KASPERSK-F13F4E\EQ2        Event occurred on a newly created file. The file was moved to quarantine. You may close this window.
2007-4-2 10:44:32        AMON        file        C:\Documents and Settings\EQ2\桌面\foto\skydown.exe        Win32/TrojanDownloader.Agent.NJH trojan        quarantined - deleted - error while cleaning - operation unavailable for this type of object        KASPERSK-F13F4E\EQ2        Event occurred on a new file created by the application: D:\Program Files\WinRAR\WinRAR.exe. The file was moved to quarantine. You may close this window.
2007-4-2 10:44:32        AMON        file        C:\Documents and Settings\EQ2\桌面\foto\LinkShare.exe        Win32/LowZones.DR trojan        quarantined - deleted - error while cleaning - operation unavailable for this type of object        KASPERSK-F13F4E\EQ2        Event occurred on a new file created by the application: D:\Program Files\WinRAR\WinRAR.exe. The file was moved to quarantine. You may close this window.
2007-4-2 10:44:31        AMON        file        C:\Documents and Settings\EQ2\桌面\foto\foto.exe        Win32/Wigon.S trojan        quarantined - deleted - error while cleaning - operation unavailable for this type of object        KASPERSK-F13F4E\EQ2        Event occurred on a new file created by the application: D:\Program Files\WinRAR\WinRAR.exe. The file was moved to quarantine. You may close this window.
The EQs
发表于 2007-4-2 10:46:53 | 显示全部楼层
nod32截到这个

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
The EQs
发表于 2007-4-2 10:56:05 | 显示全部楼层
貌似nod32截到的那个很多都不报。。。。。
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-3-28 20:46 , Processed in 0.132551 second(s), 18 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究,不得将上述内容用于商业或者其他非法用途,否则产生的一切后果自负,本站信息来自网络,版权争议问题与本站无关,您必须在下载后的24小时之内从您的电脑中彻底删除上述信息,如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表