查看: 4136|回复: 23
收起左侧

[病毒样本] BLOGCN新鲜样本

[复制链接]
[桃党]星辰
发表于 2007-4-27 10:26:18 | 显示全部楼层 |阅读模式

BLOGCN的BBS里挂的马
KAV不杀
顺便通知以下

  1. HTTP://BBS.BLOGCN.COM
复制代码

目前带马

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
mofunzone
发表于 2007-4-27 10:31:58 | 显示全部楼层
File:         rav.com
Status:         INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5         38ea2e3e16772e7ccb07f67f2efeb90d
Packers detected:         UPACK

Scanner results
Scan taken on 27 Apr 2007 02:31:03 (GMT)
A-Squared         Found nothing
AntiVir         Found HEUR/Crypted
ArcaVir         Found nothing
Avast         Found nothing
AVG Antivirus         Found Downloader.Small.55.BK
BitDefender         Found Generic.Malware.dld!!.2D49D777
ClamAV         Found Trojan.Downloader.Small-580
Dr.Web         Found DLOADER.Trojan (probable variant)
F-Prot Antivirus         Found Possibly a new variant of W32/CrazyCrunch-based!Maximus
F-Secure Anti-Virus         Found nothing
Fortinet         Found nothing
Kaspersky Anti-Virus         Found nothing
NOD32         Found probably a variant of Win32/TrojanDownloader.Small.BCZ (probable variant)
Norman Virus Control         Found W32/Suspicious_U.gen
Panda Antivirus         Found nothing
Rising Antivirus         Found nothing
VirusBuster         Found Packed/Upack
VBA32         Found Win32.Trojan.Downloader (http://...) (probable variant)
金剑
头像被屏蔽
发表于 2007-4-27 10:32:47 | 显示全部楼层
風暴勝者V2繁體版本(http: //www.v0day.com)
_________您的安全是我們的責任_______________
載入病毒庫…進行整理…分配內存…可以使用



===============================================
   ___________病毒查杀结果__________________


===============================================

2007年4月27日10时32分42秒 開始查殺C:\Documents and Settings\Administrator\桌面\新建文件夹\rav
  未知的木馬病毒(啟發) C:\Documents and Settings\Administrator\桌面\新建文件夹\rav\rav.com 操作:阻止運行
=========================================

_________文件性质分析结果________________
"带壳"仅指文件性质,仅供专业人员分析使用。


-----------------------------------------

2007年4月27日10时32分42秒收起線程…100%查殺完畢!
掃描文件: 1查殺病毒: 1
mofunzone
发表于 2007-4-27 10:41:38 | 显示全部楼层
生成物12个,看有几个杀全的,雨伞杀了一半。。

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\smss.exe'
C:\Documents and Settings\morgan\My Documents\
  smss.exe
Begin scan in 'C:\Documents and Settings\morgan\My Documents\rundl32.exe'
C:\Documents and Settings\morgan\My Documents\
  rundl32.exe
Begin scan in 'C:\Documents and Settings\morgan\My Documents\DATA0000.EXE'
C:\Documents and Settings\morgan\My Documents\
  DATA0000.EXE
      [DETECTION] Is the Trojan horse TR/Drop.Delf.aom
      [INFO]      The file was deleted!
Begin scan in 'C:\Documents and Settings\morgan\My Documents\DATA0001.EXE'
C:\Documents and Settings\morgan\My Documents\
  DATA0001.EXE
Begin scan in 'C:\Documents and Settings\morgan\My Documents\sb.exe'
C:\Documents and Settings\morgan\My Documents\
  sb.exe
      [DETECTION] Is the Trojan horse TR/Drop.Delf.aom
      [INFO]      The file was deleted!
Begin scan in 'C:\Documents and Settings\morgan\My Documents\svchost.exe'
C:\Documents and Settings\morgan\My Documents\
  svchost.exe
Begin scan in 'C:\Documents and Settings\morgan\My Documents\new.exe'
C:\Documents and Settings\morgan\My Documents\
  new.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLin.ARI.86
      [INFO]      The file was deleted!
Begin scan in 'C:\Documents and Settings\morgan\My Documents\ri.exe'
C:\Documents and Settings\morgan\My Documents\
  ri.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was deleted!
Begin scan in 'C:\Documents and Settings\morgan\My Documents\1[3].gif'
C:\Documents and Settings\morgan\My Documents\
  1[3].gif
Begin scan in 'C:\Documents and Settings\morgan\My Documents\mppds.exe'
C:\Documents and Settings\morgan\My Documents\
  mppds.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLin.ARI.86
      [INFO]      The file was deleted!
Begin scan in 'C:\Documents and Settings\morgan\My Documents\mppds.dll'
C:\Documents and Settings\morgan\My Documents\
  mppds.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnLin.ARI.86
      [INFO]      The file was deleted!
Begin scan in 'C:\Documents and Settings\morgan\My Documents\npf.sys'
C:\Documents and Settings\morgan\My Documents\
  npf.sys


End of the scan: 2017年4月26日  19:38
Used time: 00:09 min

The scan has been done completely.

      0 Scanning directories
     12 Files were scanned
      6 viruses and/or unwanted programs were found
      0 classified as suspicious:
      6 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      6 Files not concerned
      0 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
soul20010
发表于 2007-4-27 10:41:57 | 显示全部楼层
rav.rar
  [0] Archive type: RAR
  --> rav.com
      [DETECTION] Contains suspicious code HEUR/Crypted
      [INFO]      The file was moved to '46a76316.qua'!


End of the scan: 2007年4月27日  10:40
Used time: 00:06 min

The scan has been done completely.

      0 Scanning directories
      3 Files were scanned
      1 viruses and/or unwanted programs were found
      1 classified as suspicious:
      0 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found
mofunzone
发表于 2007-4-27 10:49:16 | 显示全部楼层
突然发现这病毒把我电脑的时间改成2017年了
[桃党]星辰
 楼主| 发表于 2007-4-27 10:51:09 | 显示全部楼层
现在流行向前改了?
wangjay1980
发表于 2007-4-27 10:55:05 | 显示全部楼层
卡巴启发

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
红心王子
发表于 2007-4-27 10:55:40 | 显示全部楼层
过了KIS621
wangjay1980
发表于 2007-4-27 11:00:53 | 显示全部楼层
衍生物杀了10个
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-3-29 03:07 , Processed in 0.136445 second(s), 18 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究,不得将上述内容用于商业或者其他非法用途,否则产生的一切后果自负,本站信息来自网络,版权争议问题与本站无关,您必须在下载后的24小时之内从您的电脑中彻底删除上述信息,如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表