恶性病毒样本一个

显示全部楼层 · 发表于 2007-5-6 07:05:12

注意：解压之后，千万别运行，样本基本全是恶意插件和病毒，大部分
都清除不掉，运行了可别后悔啊。

显示全部楼层 · 发表于 2007-5-6 07:11:15

Scan performed at: 2007-5-6 7:11:24
Scanning Log
NOD32 version 2244 (20070505) NT
Command line: C:\Documents and Settings\EQ2\桌面\恶性病毒.rar
Operating memory - is OK

Date: 6.5.2007 Time: 07:11:28
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\恶性病毒.rar
C:\Documents and Settings\EQ2\桌面\恶性病毒.rar ?RAR ?样本不要执行\ck3.exe.exe - probably a variant of Win32/Spy.Delf.PG trojan
C:\Documents and Settings\EQ2\桌面\恶性病毒.rar ?RAR ?样本不要执行\IEXPLORE.Dat - probably a variant of Win32/Spy.Delf.PG trojan
C:\Documents and Settings\EQ2\桌面\恶性病毒.rar ?RAR ?样本不要执行\IEXPLORE.Sys - probably a variant of Win32/Spy.Delf.PG trojan
C:\Documents and Settings\EQ2\桌面\恶性病毒.rar ?RAR ?样本不要执行\ldmedia4.dll - Win32/PSW.Maran trojan - was a part of the deleted object
Number of scanned files: 10
Number of threats found: 4
Number of files cleaned: 1
Time of completion: 07:11:29 Total scanning time: 1 sec (00:00:01)

显示全部楼层 · 发表于 2007-5-6 07:21:54

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-5-4
Start time: 2007-5-6 7:21
Engine(s): KAV engine (AVK 17.5061), BD-Engine (BD 17.4685)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: c8.exe.exe
Path: C:\Documents and Settings\Administrator\桌面\恶性病毒\样本不要执行
Status: Move file into quarantine
Virus: Trojan-Spy.Win32.Delf.pg (KAV engine), Generic.Malware.Sdld.ED19FC42 (BD-Engine)
Object: ck3.exe.exe
Path: C:\Documents and Settings\Administrator\桌面\恶性病毒\样本不要执行
Status: Move file into quarantine
Virus: Trojan.PWS.Qqpass.PK (BD-Engine)
Object: IEXPLORE.win
Path: C:\Documents and Settings\Administrator\桌面\恶性病毒\样本不要执行
Status: Move file into quarantine
Virus: Trojan-Spy.Win32.Delf.pg (KAV engine), Trojan.PWS.Delf.ICX (BD-Engine)
Object: ldmedia4.dll
Path: C:\Documents and Settings\Administrator\桌面\恶性病毒\样本不要执行
Status: Move file into quarantine
Virus: Trojan-PSW.Win32.Maran.dk (KAV engine), Trojan.PWS.Maran.AY (BD-Engine)
Object: soundmid3.dll
Path: C:\Documents and Settings\Administrator\桌面\恶性病毒\样本不要执行
Status: Move file into quarantine
Virus: Generic.PWS.Maran.56333EA3 (BD-Engine)
Analysis complete: 2007-5-6 7:21
9 files checked
5 infected files detected
0 suspected files detected

显示全部楼层 · 发表于 2007-5-6 07:22:24

LZ发的全部都是发过的。。。郁闷ing

显示全部楼层 · 发表于 2007-5-6 07:27:49

Starting the file scan:

Begin scan in 'F:\样本\恶性病毒.rar'
F:\样本\恶性病毒.rar
  [0] Archive type: RAR
  --> Ñù±¾²»ÒªÖ´ÐÐ\c8.exe.exe
   [DETECTION] Contains signature of the dropper DR/Delphi.Gen
  --> Ñù±¾²»ÒªÖ´ÐÐ\ck3.exe.exe
   [DETECTION] Contains signature of the dropper DR/Delphi.Gen
  --> Ñù±¾²»ÒªÖ´ÐÐ\shua.exe.exe
   [DETECTION] Contains suspicious code HEUR/Crypted
  --> Ñù±¾²»ÒªÖ´ÐÐ\IEXPLORE.Dat
   [DETECTION] Contains suspicious code HEUR/Malware
  --> Ñù±¾²»ÒªÖ´ÐÐ\IEXPLORE.win
   [DETECTION] Contains suspicious code HEUR/Malware
  --> Ñù±¾²»ÒªÖ´ÐÐ\IEXPLORE.Sys
   [DETECTION] Contains suspicious code HEUR/Malware
  --> Ñù±¾²»ÒªÖ´ÐÐ\ldmedia4.dll
   [DETECTION] Is the Trojan horse TR/Drop.Maran.C.3
  --> Ñù±¾²»ÒªÖ´ÐÐ\soundmid3.dll
   [DETECTION] Is the Trojan horse TR/Drop.Maran.C.3
  --> Ñù±¾²»ÒªÖ´ÐÐ\lsass.exe
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-5-6 08:53:35

卡巴不给下

显示全部楼层 · 发表于 2007-5-6 08:56:40

驱逐舰杀

显示全部楼层 · 发表于 2007-5-6 11:03:31

风暴胜者V2 测试版本(http://www.v0day.com)
_________您的安全是我们的责任_______________
载入病毒库…进行整理…分配内存…可以使用

===============================================
___________病毒查杀结果__________________

===============================================

2007年5月6日11时3分2秒开始查杀C:\Documents and Settings\Administrator\桌面\0705\yan\23232\t\恶性病毒
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\0705\yan\23232\t\恶性病毒\样本不要执行\c8.exe.exe 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\0705\yan\23232\t\恶性病毒\样本不要执行\ck3.exe.exe 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\0705\yan\23232\t\恶性病毒\样本不要执行\shua.exe.exe 操作:阻止运行
C:\Documents and Settings\Administrator\桌面\0705\yan\23232\t\恶性病毒\样本不要执行\lsass.exe 为可疑文件
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\0705\yan\23232\t\恶性病毒\样本不要执行\ldmedia4.dll 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\0705\yan\23232\t\恶性病毒\样本不要执行\soundmid3.dll 操作:阻止运行
=========================================

_________文件性质分析结果________________
"带壳"仅指文件性质,仅供专业人员分析使用。

C:\Documents and Settings\Administrator\桌面\0705\yan\23232\t\恶性病毒\样本不要执行\c8.exe.exe 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\0705\yan\23232\t\恶性病毒\样本不要执行\ck3.exe.exe 带壳文件:UPX加壳
-----------------------------------------

2007年5月6日11时3分3秒收起线程…100% 查杀完毕！
扫描文件：6查杀病毒：6

显示全部楼层 · 发表于 2007-5-6 11:21:31

驱逐舰不让下

显示全部楼层 · 发表于 2007-5-6 11:24:22

费尔杀6个

[病毒样本] 恶性病毒样本一个

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源