查看: 2736|回复: 15
收起左侧

[病毒样本] 9个

[复制链接]
mofunzone
发表于 2007-4-3 07:10:13 | 显示全部楼层 |阅读模式
antivir没报的一个运行后搞定
Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\TDDOWNLOAD.rar'
C:\Documents and Settings\morgan\My Documents\
  TDDOWNLOAD.rar
    [0] Archive type: RAR
    --> w.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> barsetup.exe
        [DETECTION] Is the Trojan horse TR/Dldr.QQhelper.DB
        [WARNING]   Infected files in archives cannot be repaired!
    --> cm.exe
        [DETECTION] Is the Trojan horse TR/Agent.20480.26
        [WARNING]   Infected files in archives cannot be repaired!
    --> cx.exe
    --> dm.exe
        [DETECTION] Is the Trojan horse TR/Drob.QQHe.FT.3.B
        [WARNING]   Infected files in archives cannot be repaired!
    --> m.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> q.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> qq.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> r.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
蓝色牛仔裤
发表于 2007-4-3 08:50:15 | 显示全部楼层
beta蜘蛛全搞定!!少见...呵呵~~

barsetup.exe;C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD;Trojan.Click.origin;;
cm.exe;C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD;Trojan.DownLoader.origin;;
data002\data002;C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD\cx.exe\data002;Adware.Borlander.origin;;
data002\data004;C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD\cx.exe\data002;Adware.Borlander.origin;;
data002\data005;C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD\cx.exe\data002;Adware.Borlander;;
data002;C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD\cx.exe;Archive contains infected objects;;
cx.exe;C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD;Archive contains infected objects;;
dm.exe;C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD;Trojan.DownLoader.19274;;
m.exe;C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD;Trojan.PWS.Soul;;
q.exe;C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD;BINARYRES;;
qq.exe;C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD;Trojan.DownLoader.17951;;
r.exe;C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD;BINARYRES;;
w.exe;C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD;BINARYRES;;
soul20010
发表于 2007-4-3 08:56:56 | 显示全部楼层
FS7.0扫描
Result: 5 malware found
Trojan-Downloader.Win32.QQHelper.vp (virus)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\TDDOWNLOAD.rar\cm.exe
AdWare.Win32.Boran.ae (adware)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\TDDOWNLOAD.rar\cx.exe
AdWare.Win32.WSearch.j (adware)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\TDDOWNLOAD.rar\dm.exe
Trojan-PSW.Win32.OnLineGames.kw (virus)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\TDDOWNLOAD.rar\m.exe
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\TDDOWNLOAD.rar\r.exe
运行应该还有。。。
欠妳緈諨
发表于 2007-4-3 11:29:23 | 显示全部楼层
金山才杀了2个
jlennon
头像被屏蔽
发表于 2007-4-3 12:18:51 | 显示全部楼层
Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-4-1
Start time: 2007-4-3 12:18
Engine(s): KAV engine (AVK 17.3690), BD-Engine (BD 17.2421)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: barsetup.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: Trojan.Muldrop.BX (BD-Engine)
Object: cm.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: Trojan-Downloader.Win32.QQHelper.vp (KAV engine), DeepScan:Generic.Dld.ADL.9E73E13B (BD-Engine)
Object: data0002
        In archive: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD\cx.exe
        Status: Virus detected
        Virus: not-a-virus:AdWare.Win32.Boran.ae (KAV engine)
Object: cx.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: not-a-virus:AdWare.Win32.Boran.ae (KAV engine)
Object: dm.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: not-a-virus:AdWare.Win32.WSearch.j (KAV engine), Trojan.Dropper.Agent.JM (BD-Engine)
Object: m.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.kw (KAV engine), Dropped:Trojan.PWS.Lmir.CP (BD-Engine)
Object: q.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.es (KAV engine), Generic.Malware.SdldgPWS.938F210A (BD-Engine)
Object: qq.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: Generic.Malware.Sdld!!.52D463C9 (BD-Engine)
Object: r.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.kw (KAV engine), Generic.Malware.SdldPWS.EE6A885F (BD-Engine)
Object: w.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: Generic.Malware.SdldgPWS.18F18A30 (BD-Engine)
Analysis complete: 2007-4-3 12:18
    9 files checked
    9 infected files detected
    0 suspected files detected
Nblock
发表于 2007-4-3 12:32:36 | 显示全部楼层
barsetup.exe要等待  

cm.exe   cx.exe这两支 微点还未判断出有害行为

[ 本帖最后由 Nblock 于 2007-4-3 12:40 编辑 ]

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
The EQs
发表于 2007-4-3 13:55:26 | 显示全部楼层
Scan performed at: 2007-4-3 13:54:20
Scanning Log
NOD32 version 2164 (20070402) NT
Command line: C:\Documents and Settings\EQ2\桌面\TDDOWNLOAD
Operating memory - is OK

Date: 3.4.2007  Time: 13:54:24
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\TDDOWNLOAD\
C:\Documents and Settings\EQ2\桌面\TDDOWNLOAD\barsetup.exe - a variant of Win32/TrojanDownloader.QQHelper trojan
C:\Documents and Settings\EQ2\桌面\TDDOWNLOAD\dm.exe - Win32/Adware.WSearch application - quarantined - unable to clean - deleted
C:\Documents and Settings\EQ2\桌面\TDDOWNLOAD\m.exe - a variant of Win32/PSW.Agent.NDP trojan
C:\Documents and Settings\EQ2\桌面\TDDOWNLOAD\qq.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\TDDOWNLOAD\r.exe - a variant of Win32/PSW.Agent.NDF trojan
C:\Documents and Settings\EQ2\桌面\TDDOWNLOAD\w.exe - a variant of Win32/PSW.Agent.NCC trojan
Number of scanned files: 9
Number of threats found: 6
Number of files cleaned: 6
Time of completion: 13:54:25 Total scanning time: 1 sec (00:00:01)

Notes:
[7] File is probably infected with an unknown virus.
solcroft
发表于 2007-4-3 14:04:56 | 显示全部楼层
其他的微点既然报了,我们来看看Cyberhawk对微点漏杀得cm.exe和cx.exe有什么看法。

cx.exe在Program Files文件夹里生产了.dll文件后试图用rundll32.exe来调用,被Cyberhawk捕个正着


cm.exe执行后过了不久试图连网,也还是被Cyberhawk弊了


[ 本帖最后由 solcroft 于 2007-4-3 15:36 编辑 ]

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
soul20010
发表于 2007-4-3 14:39:03 | 显示全部楼层
FS7.0又多发现了一个
Result: 6 malware found
Trojan-Downloader.Win32.QQHelper.vp (virus)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\TDDOWNLOAD.rar\cm.exe
AdWare.Win32.Boran.ae (adware)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\TDDOWNLOAD.rar\cx.exe
AdWare.Win32.WSearch.j (adware)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\TDDOWNLOAD.rar\dm.exe
Trojan-PSW.Win32.OnLineGames.kw (virus)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\TDDOWNLOAD.rar\m.exe
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\TDDOWNLOAD.rar\r.exe
Trojan-PSW.Win32.OnLineGames.es (virus)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\TDDOWNLOAD.rar\q.exe
小邪邪
发表于 2007-4-3 15:36:53 | 显示全部楼层

MCAFEE

Adware-PigSearch (Adware)
PWS-LegMir.gen.b (特洛伊)
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-3-29 19:36 , Processed in 0.134591 second(s), 18 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究,不得将上述内容用于商业或者其他非法用途,否则产生的一切后果自负,本站信息来自网络,版权争议问题与本站无关,您必须在下载后的24小时之内从您的电脑中彻底删除上述信息,如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表