9个毒

troika

呵呵

金剑

风暴胜者V2 测试版本(http://www.v0day.com)
_________您的安全是我们的责任_______________
载入病毒库…进行整理…分配内存…可以使用
蜜罐检测:正常 OK!
===============================================
   ___________病毒查杀结果__________________

===============================================
2007年5月20日18时36分26秒 开始查杀C:\Documents and Settings\root\桌面\virus\Downlo11ads
  未知的可疑率60%的文件(启发)C:\Documents and Settings\root\桌面\virus\Downlo11ads\222.exe 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\root\桌面\virus\Downlo11ads\222.exe 操作:阻止运行
  未知的可疑率60%的文件(启发)C:\Documents and Settings\root\桌面\virus\Downlo11ads\lh.exe 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\root\桌面\virus\Downlo11ads\lh.exe 操作:阻止运行
  未知的可疑率80%的文件(启发)C:\Documents and Settings\root\桌面\virus\Downlo11ads\RAVWM.EXE 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\root\桌面\virus\Downlo11ads\RAVWM.EXE 操作:阻止运行
C:\Documents and Settings\root\桌面\virus\Downlo11ads\winlog0n.exe 为可疑文件
=========================================
_________文件性质分析结果________________
"带壳"仅指文件性质,仅供专业人员分析使用。

C:\Documents and Settings\root\桌面\virus\Downlo11ads\help[1].exe 带壳文件:UPX加壳
C:\Documents and Settings\root\桌面\virus\Downlo11ads\muma.exe 带壳文件:UPX加壳
C:\Documents and Settings\root\桌面\virus\Downlo11ads\qq.exe 带壳文件:UPX加壳
C:\Documents and Settings\root\桌面\virus\Downlo11ads\RAVWM.EXE 带壳文件:UPX加壳
-----------------------------------------
2007年5月20日18时36分28秒收起线程…100% 查杀完毕！
扫描文件：9查杀病毒：5

[ 本帖最后由 金剑 于 2007-5-20 18:36 编辑 ]

风野胤

通杀

shenrenrenren

deleted: Trojan program Backdoor.Win32.Hupigon.pv File: C:\TDDOWNLOAD\222.exe
quarantined: virus Downloader (modification) File: C:\TDDOWNLOAD\help[1].exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.fq File: C:\TDDOWNLOAD\iexpl0re.exe//PE_Patch//UPack//LGSY0.DLL//UPX
deleted: Trojan program Trojan-PSW.Win32.QQRob.ik File: C:\TDDOWNLOAD\muma.exe//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-PSW.Win32.Agent.lg File: C:\TDDOWNLOAD\RAVWM.EXE//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.rw File: C:\TDDOWNLOAD\winlog0n.exe

伯夷叔齐

红伞漏了一个.

D:\病毒木马样本\Downloads2.part1.rar
  [0] Archive type: RAR
  --> avp.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> 222.exe
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
  --> help[1].exe
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
  --> iexpl0re.exe
      [DETECTION] Is the Trojan horse TR/Agent.34708.B
  --> lh.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSAnti.Gen
  --> muma.exe
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Hupigon.bwk.10 Backdoor server programs
      [WARNING]   The file was ignored!

End of the scan: 2007年5月20日  18:36
Used time: 00:19 min
The scan has been done completely.
      0 Scanning directories
     12 Files were scanned
      8 viruses and/or unwanted programs were found
      0 classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      4 Files not concerned
      2 Archives were scanned
      2 Warnings
      0 Notes

miller239

红伞全杀的。。

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\Downloads.rar'
C:\Documents and Settings\Administrator\桌面\
  Downloads.rar
    [0] Archive type: RAR
    --> Downloads\222.exe
        [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
        [WARNING]   Infected files in archives cannot be repaired!
    --> Downloads\avp.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> Downloads\help[1].exe
        [DETECTION] Contains signature of the dropper DR/Delphi.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> Downloads\iexpl0re.exe
        [DETECTION] Is the Trojan horse TR/Agent.34708.B
        [WARNING]   Infected files in archives cannot be repaired!
    --> Downloads\lh.exe
        [DETECTION] Is the Trojan horse TR/Crypt.NSAnti.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> Downloads\muma.exe
        [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Hupigon.bwk.10 Backdoor server programs
        [WARNING]   Infected files in archives cannot be repaired!
    --> Downloads\qq.exe
        [DETECTION] Is the Trojan horse TR/Drop.QQPa.WP.1.A
        [WARNING]   Infected files in archives cannot be repaired!
    --> Downloads\RAVWM.EXE
        [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> Downloads\winlog0n.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!


End of the scan: 2007年5月20日  19:09
Used time: 00:09 min

The scan has been done completely.

      0 Scanning directories
     10 Files were scanned
      9 viruses and/or unwanted programs were found
      0 classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      9 Warnings
      0 Notes
      0 Hidden objects were found

tracydk

Starting the file scan:

Begin scan in 'F:\样本\Downloads.part2.rar'
F:\样本\Downloads.part2.rar
  [0] Archive type: RAR
  --> RAVWM.EXE
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> winlog0n.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [INFO]      The file was deleted!
Begin scan in 'F:\样本\Downloads.part1.rar'
F:\样本\Downloads.part1.rar
  [0] Archive type: RAR
  --> avp.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> 222.exe
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
  --> help[1].exe
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
  --> iexpl0re.exe
      [DETECTION] Is the Trojan horse TR/Agent.34708.B
  --> lh.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSAnti.Gen
  --> muma.exe
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Hupigon.bwk.10 Backdoor server programs
      [INFO]      The file was deleted!

a81502097

卡巴启发不报,...天呀..!卡巴只杀3个.~快晕了~~

wangjay1980

你会用吗
detected: Trojan program Backdoor.Win32.Hupigon.pv        File: E:\Ñù±¾\н¨Îļþ¼Ð\222.exe
detected: virus Downloader (modification)        File: E:\Ñù±¾\н¨Îļþ¼Ð\help[1].exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.fq        File: E:\Ñù±¾\н¨Îļþ¼Ð\iexpl0re.exe//PE_Patch//UPack//LGSY0.DLL//UPX
detected: Trojan program Trojan-PSW.Win32.QQRob.ik        File: E:\Ñù±¾\н¨Îļþ¼Ð\muma.exe//PE_Patch.UPX//UPX
detected: Trojan program Trojan-PSW.Win32.Agent.lg        File: E:\Ñù±¾\н¨Îļþ¼Ð\RAVWM.EXE//FSG
detected: Trojan program Trojan-PSW.Win32.OnLineGames.rw        File: E:\Ñù±¾\н¨Îļþ¼Ð\winlog0n.exe

kp2006

卡吧7报了6个 报5个已知1个启发

主动防御报3个风险

侵入进程:
D:\Documents and Settings\Administrator\桌面\Downloads[1]\avp.exe
进程 ID (PID): 2460
进程侵入企图:
D:\WINDOWS\Explorer.EXE
进程 ID (PID): 1896

侵入进程:
D:\Documents and Settings\Administrator\桌面\Downloads[1]\lh.exe
进程 ID (PID): 3560
进程侵入企图:
\\?\D:\WINDOWS\system32\winlogon.exe
进程 ID (PID): 788

侵入进程:
D:\Documents and Settings\Administrator\桌面\Downloads[1]\qq.exe
进程 ID (PID): 2700
进程侵入企图:
D:\WINDOWS\Explorer.EXE
进程 ID (PID): 1896

报9个

[ 本帖最后由 kp2006 于 2007-5-20 19:47 编辑 ]