来一包

显示全部楼层 · 发表于 2007-5-7 13:59:15

Starting the file scan:

Begin scan in 'F:\样本\XXX.part2.rar'
F:\样本\XXX.part2.rar
  [0] Archive type: RAR
  --> wm[1].exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [INFO]    The file was deleted!
Begin scan in 'F:\样本\XXX.part1.rar'
F:\样本\XXX.part1.rar
  [0] Archive type: RAR
  --> wow[1].exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> zt[1].exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> cmdbcs.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> crasos.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> iexp10re.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> LgSy0.dll
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> LgSy1.dll
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> mh[1].exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> Msxo0.dll
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> Msxo1.dll
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> qjzo0.dll
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> tru11.tmp
   [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> tru13.tmp
   [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> tru14.tmp
   [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> tru15.tmp
   [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> tru17.tmp
   [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> tx[1].exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-5-7 14:11:49

detected: virus Invader (modification)       File: E:\Ñù±¾\wow[1].exe
detected: virus Invader (modification)       File: E:\Ñù±¾\zt[1].exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.ms       File: E:\Ñù±¾\cmdbcs.dll
detected: virus Invader (modification)       File: E:\Ñù±¾\crasos.exe
detected: virus Invader (modification)       File: E:\Ñù±¾\iexp10re.exe
detected: virus Trojan.Generic (modification)       File: E:\Ñù±¾\LgSy0.dll
detected: virus Trojan.Generic (modification)       File: E:\Ñù±¾\LgSy1.dll
detected: virus Invader (modification)       File: E:\Ñù±¾\mh[1].exe
detected: virus Trojan.Generic (modification)       File: E:\Ñù±¾\Msxo0.dll
detected: virus Trojan.Generic (modification)       File: E:\Ñù±¾\Msxo1.dll
detected: virus Trojan.Generic (modification)       File: E:\Ñù±¾\qjzo0.dll
detected: virus Trojan.Generic (modification)       File: E:\Ñù±¾\tru11.tmp
detected: virus Trojan.Generic (modification)       File: E:\Ñù±¾\tru13.tmp
detected: virus Trojan.Generic (modification)       File: E:\Ñù±¾\tru14.tmp
detected: virus Trojan.Generic (modification)       File: E:\Ñù±¾\tru15.tmp
detected: virus Trojan.Generic (modification)       File: E:\Ñù±¾\tru17.tmp
detected: Trojan program Trojan-PSW.Win32.OnLineGames.ms       File: E:\Ñù±¾\tx[1].exe\CMDBCS.DLL
detected: virus Invader (modification)       File: E:\Ñù±¾\wl[1].exe
detected: virus Invader (modification)       File: E:\Ñù±¾\wm[1].exe

卡巴全杀

[ 本帖最后由 wangjay1980 于 2007-5-7 14:13 编辑 ]

显示全部楼层 · 发表于 2007-5-7 14:13:05

显示全部楼层 · 发表于 2007-5-7 14:15:11

卡巴厉害，17个启发，2个已知

显示全部楼层 · 发表于 2007-5-7 14:29:47

AVAST19个已知

显示全部楼层 · 发表于 2007-5-7 14:58:31

风暴胜者V2 测试版本(http://www.v0day.com)
_________您的安全是我们的责任_______________
载入病毒库…进行整理…分配内存…可以使用
蜜罐检测:正常 OK!

===============================================
___________病毒查杀结果__________________

===============================================

2007年5月7日14时58分22秒开始查杀C:\Documents and Settings\Administrator\桌面\XXX
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\XXX\mh[1].exe 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\XXX\tru11.tmp 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\XXX\tru13.tmp 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\XXX\tru14.tmp 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\XXX\tru15.tmp 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\XXX\tru17.tmp 操作:阻止运行
=========================================

_________文件性质分析结果________________
"带壳"仅指文件性质,仅供专业人员分析使用。

C:\Documents and Settings\Administrator\桌面\XXX\wow[1].exe 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\XXX\zt[1].exe 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\XXX\crasos.exe 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\XXX\iexp10re.exe 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\XXX\mh[1].exe 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\XXX\tx[1].exe 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\XXX\wl[1].exe 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\XXX\wm[1].exe 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\XXX\LgSy0.dll 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\XXX\LgSy1.dll 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\XXX\Msxo0.dll 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\XXX\Msxo1.dll 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\XXX\qjzo0.dll 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\XXX\tru11.tmp 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\XXX\tru13.tmp 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\XXX\tru14.tmp 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\XXX\tru15.tmp 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\XXX\tru17.tmp 带壳文件:UPX加壳
-----------------------------------------

2007年5月7日14时58分25秒收起线程…100% 查杀完毕！
扫描文件：19查杀病毒：6

靠……

显示全部楼层 · 发表于 2007-5-7 15:25:38

vba
F:\XXX[1].part1.rar:<RAR>\wow[1].exe : infected MalwareScope.Worm.Viking.3
F:\XXX[1].part1.rar:<RAR>\zt[1].exe : infected MalwareScope.Worm.Viking.3
F:\XXX[1].part1.rar:<RAR>\crasos.exe : infected MalwareScope.Worm.Viking.3
F:\XXX[1].part1.rar:<RAR>\iexp10re.exe : infected MalwareScope.Worm.Viking.3
F:\XXX[1].part1.rar:<RAR>\LgSy0.dll : infected MalwareScope.Worm.Viking.3
F:\XXX[1].part1.rar:<RAR>\LgSy1.dll : infected MalwareScope.Worm.Viking.3
F:\XXX[1].part1.rar:<RAR>\mh[1].exe : infected MalwareScope.Worm.Viking.3
F:\XXX[1].part1.rar:<RAR>\Msxo0.dll : infected MalwareScope.Worm.Viking.3
F:\XXX[1].part1.rar:<RAR>\Msxo1.dll : infected MalwareScope.Worm.Viking.3
F:\XXX[1].part1.rar:<RAR>\qjzo0.dll : infected MalwareScope.Worm.Viking.3
F:\XXX[1].part1.rar:<RAR>\tru11.tmp : infected Backdoor.Win32.Hupigon.esd
F:\XXX[1].part1.rar:<RAR>\tru13.tmp : infected Backdoor.Win32.Hupigon.esd
F:\XXX[1].part1.rar:<RAR>\tru14.tmp : infected Backdoor.Win32.Hupigon.esd
F:\XXX[1].part1.rar:<RAR>\tru15.tmp : infected Backdoor.Win32.Hupigon.esd
F:\XXX[1].part1.rar:<RAR>\tru17.tmp : infected Backdoor.Win32.Hupigon.esd
F:\XXX[1].part1.rar:<RAR>\tx[1].exe : infected MalwareScope.Worm.Viking.3

显示全部楼层 · 发表于 2007-5-7 17:06:21

驱逐舰全挂

显示全部楼层 · 发表于 2007-5-8 17:04:38

木马名称:Trojan.Win32.Mnless.aq
程序:
I:\TEST\070507\15\XXX[1]\TRU11.TMP
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan.Win32.Mnless.aq
程序:
I:\TEST\070507\15\XXX[1]\TRU13.TMP
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan.Win32.Mnless.aq
程序:
I:\TEST\070507\15\XXX[1]\TRU14.TMP
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan.Win32.Mnless.aq
程序:
I:\TEST\070507\15\XXX[1]\TRU15.TMP
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan.Win32.Mnless.aq
程序:
I:\TEST\070507\15\XXX[1]\TRU17.TMP
是木马程序!
已成功阻止其运行,是否要删除此文件?

剩下的是dll 不能跑了

[病毒样本] 来一包

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

微点拦

本帖子中包含更多资源