样本包

显示全部楼层 · 发表于 2007-4-8 23:28:12

不知道里面有没有死的

大家测试下~~`

显示全部楼层 · 发表于 2007-4-8 23:31:03

Scan performed at: 2007-4-8 23:31:15
Scanning Log
NOD32 version 2173 (20070407) NT
Command line: C:\Documents and Settings\EQ2\桌面\桌面.rar
Operating memory - is OK

Date: 8.4.2007 Time: 23:31:20
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\桌面.rar
C:\Documents and Settings\EQ2\桌面\桌面.rar ?RAR ?mppds.exe - a variant of Win32/PSW.Agent.NCC trojan
C:\Documents and Settings\EQ2\桌面\桌面.rar ?RAR ?upxdnd.exe - a variant of Win32/PSW.Agent.NDF trojan
C:\Documents and Settings\EQ2\桌面\桌面.rar ?RAR ?cmdbcsa.exe - a variant of Win32/PSW.Agent.NCC trojan
C:\Documents and Settings\EQ2\桌面\桌面.rar ?RAR ?cmdbcsa.dll - probably a variant of Win32/PSW.Agent.NCC trojan
C:\Documents and Settings\EQ2\桌面\桌面.rar ?RAR ?ie.exe - Win32/Pacex.Gen virus
C:\Documents and Settings\EQ2\桌面\桌面.rar ?RAR ?RAVWM.EXE - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\桌面.rar ?RAR ?LgSy1.dll - Win32/Pacex.Gen virus
C:\Documents and Settings\EQ2\桌面\桌面.rar ?RAR ?upxdnd.dll - a variant of Win32/PSW.Agent.NDF trojan
Number of scanned files: 15
Number of threats found: 8
Number of files cleaned: 1
Time of completion: 23:31:20 Total scanning time: 0 sec (00:00:00)

Notes:
[7] File is probably infected with an unknown virus.

显示全部楼层 · 发表于 2007-4-8 23:32:49

又是dll。。。。唉。。。。

显示全部楼层 · 发表于 2007-4-8 23:35:41

估计是程序释放出来的~~~

显示全部楼层 · 发表于 2007-4-8 23:36:00

羞愧

===========================
-----------------------------SCAN REPORT-----------------------------
F-PROT Antivirus for Windows

Antivirus Scanning Engine version number: 4.3.1
Virus signature file from: 2007-4-5, 2:50

Scan name: [Custom Scan]
Path to scan: C:\Documents and Settings\Administrator\桌面\桌面.rar

Normal scan
Also scan: Inside subfolders, Compressed files, Streams

Scan started: 2007-4-8, 23:35:03
---------------------------------------------------------------------

[Found possible virus] <W32/Bongler-based (not disinfectable)> C:\Documents and Settings\Administrator\桌面\桌面.rar->upxdnd.dll
[Contains infected objects] C:\Documents and Settings\Administrator\桌面\桌面.rar
[Quarantined] C:\Documents and Settings\Administrator\桌面\桌面.rar->wsttrs.dll

---------------------------------------------------------------------
Scan ended: 2007-4-8, 23:35:05
Duration: 0:00:02

Scan result:

Scanned files:    1
Infected objects:    1
Disinfected objects:    0
Quarantined files:    1
---------------------------------------------------------------------

显示全部楼层 · 发表于 2007-4-8 23:39:09

avast!报6个

显示全部楼层 · 发表于 2007-4-9 01:39:21

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\��.rar'
C:\Documents and Settings\morgan\My Documents\
  ��.rar
[0] Archive type: RAR
--> mppds.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
--> upxdnd.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
--> mppds.dll
--> cmdbcsa.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
--> cmdbcsa.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
--> ie.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> permil.dll
--> RAVWM.EXE
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> dbfini.dll
--> RAVWM.dll
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> LgSy1.dll
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> wsttrs.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
--> upxdnd.dll
--> wsttrs.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

End of the scan: 2007年4月8日  10:39
Used time: 00:09 min

The scan has been done completely.

   0 Scanning directories
   15 Files were scanned
   10 viruses and/or unwanted programs were found
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   5 Files not concerned
   1 Archives were scanned
   11 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-4-9 02:59:10

北京江民新科技术有限公司

扫描引擎 10.00.600
病毒库日期 2007-04-08
更新日期 2007-04-09

扫描目标 C:\Documents and Settings\yinxu\My Documents\桌面.rar

开始时间 2007-04-09 02:58:29

在 C:\Documents and Settings\yinxu\My Documents\桌面.rar->mppds.exe 中发现 Trojan/PSW.GamePass.egt 病毒, 已删除
在 C:\Documents and Settings\yinxu\My Documents\桌面.rar->mppds.dll 中发现 Trojan/PSW.OnLineGames.zn 病毒, 已删除
在 C:\Documents and Settings\yinxu\My Documents\桌面.rar->ie.exe 中发现 Trojan/PSW.GamePass.eob 病毒, 已删除
在 C:\Documents and Settings\yinxu\My Documents\桌面.rar->RAVWM.EXE 中发现 TrojanDownloader.Delf.avc 病毒, 已删除
在 C:\Documents and Settings\yinxu\My Documents\桌面.rar->RAVWM.dll 中发现 Trojan/PSW.GamePass.eiw 病毒, 已删除
正常结束。

扫描结果:
               文件数 :15                               病毒体 :5
               删除 :5                                  解毒 :0
扫描速度(千字节/秒) :0                               扫描时间 :00:00:00

显示全部楼层 · 发表于 2007-4-9 05:16:11

红伞10个,全杀了????

Starting the file scan:

Begin scan in 'C:\Documents and Settings\FEAR\My Documents\桌面.rar'
C:\Documents and Settings\FEAR\My Documents\桌面.rar
  [0] Archive type: RAR
  --> mppds.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> upxdnd.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> cmdbcsa.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> cmdbcsa.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> ie.exe
   [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> RAVWM.EXE
   [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> RAVWM.dll
   [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> LgSy1.dll
   [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> wsttrs.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> wsttrs.dll
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    The file was moved to '4647f2ba.qua'!

[病毒样本] 样本包

本帖子中包含更多资源

回复 #3 EQ2 的帖子

本帖子中包含更多资源