一支卡巴扫描不报

zxkf

htp://www.souxse.cn/xuik.exe

连网


下载
htp://www.souxse.cn/xui/0.exe
htp://www.souxse.cn/xui/1.exe
htp://www.souxse.cn/xui/2.exe
htp://www.souxse.cn/xui/4.exe
htp://www.souxse.cn/xui/5.exe
htp://www.souxse.cn/xui/6.exe
htp://www.souxse.cn/xui/7.exe
htp://www.souxse.cn/xui/.8exe
htp://www.souxse.cn/xui/.9exe
htp://www.souxse.cn/xui/.10exe
htp://www.souxse.cn/xui/.11exe
htp://www.souxse.cn/xui/.12exe
htp://www.souxse.cn/xui/.13exe
htp://www.souxse.cn/xui/.14exe


RUN了其中一支














Events
------
Time Name Event
---- ---- -----
2007-5-23 9:07:58 C:\Documents and Settings\zhangxiang\Local Settings\Temp\LYLOADER.EXE Intrusive process: C:\Documents and Settings\zhangxiang\Local Settings\Temp\LYLOADER.EXE Process ID (PID): 1840 Attempt of process intrusion: C:\WINDOWS\system32\services.exe Process ID (PID): 1072
2007-5-23 9:07:58 C:\Documents and Settings\zhangxiang\Local Settings\Temp\LYLOADER.EXE Attempt to terminate process
2007-5-23 9:08:43 C:\Documents and Settings\zhangxiang\Local Settings\Temp\LYLOADER.EXE Attempt to terminate process: successfully
2007-5-23 9:09:06 \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run Rollback
2007-5-23 9:09:06 \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Rollback
2007-5-23 9:09:06 C:\WINDOWS\system32\REGKEY.hiv Rollback: not found
2007-5-23 9:09:10 C:\WINDOWS\system32\MSDEG32.DLL Rollback
2007-5-23 9:09:13 C:\DOCUME~1\ZHANGX~1\LOCALS~1\Temp\MSDEG32.DLL Rollback
2007-5-23 9:09:15 C:\WINDOWS\system32\LYMANGR.DLL Rollback
2007-5-23 9:09:17 C:\DOCUME~1\ZHANGX~1\LOCALS~1\Temp\LYMANGR.DLL Rollback
2007-5-23 9:09:18 C:\WINDOWS\system32\LYLOADER.EXE Rollback
2007-5-23 9:09:18 C:\Privilege.dat Rollback: not found
2007-5-23 9:09:22 D:\YB\0.exe Rollback
2007-5-23 9:07:58 C:\Documents and Settings\zhangxiang\Local Settings\Temp\LYLOADER.EXE Rollback completed

Registry
--------
Time Application Key name Value name Data Data type Operation type Status
---- ----------- -------- ---------- ---- --------- -------------- ------
2007-5-23 9:06:33 C:\Documents and Settings\zhangxiang\Local Settings\Temp\LYLOADER.EXE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run C:\WINDOWS\system32\REGKEY.hi  No value type  detected
2007-5-23 9:06:33 C:\Documents and Settings\zhangxiang\Local Settings\Temp\LYLOADER.EXE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run C:\WINDOWS\system32\REGKEY.hi  No value type  blocked
2007-5-23 9:07:42 C:\Documents and Settings\zhangxiang\Local Settings\Temp\LYLOADER.EXE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run C:\WINDOWS\system32\REGKEY.hi  No value type  detected
2007-5-23 9:07:42 C:\Documents and Settings\zhangxiang\Local Settings\Temp\LYLOADER.EXE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run C:\WINDOWS\system32\REGKEY.hi  No value type  blocked

[ 本帖最后由 zxkf 于 2007-5-23 22:37 编辑 ]

miller239

漏两个。。

miller239

样本传上来。。

solcroft

mofunzone

感觉好像看到过的样子，新免杀？

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\virus.rar'
C:\Documents and Settings\morgan\My Documents\
  virus.rar
    [0] Archive type: RAR
    --> virus\0.exe
        [DETECTION] Is the Trojan horse TR/Agent.nma.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> virus\1.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> virus\2.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.UF
        [WARNING]   Infected files in archives cannot be repaired!
    --> virus\3.exe
        [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> virus\4.exe
        [DETECTION] Is the Trojan horse TR/PCK.NSAnti.N.64
        [WARNING]   Infected files in archives cannot be repaired!
    --> virus\5.exe
        [DETECTION] Is the Trojan horse TR/Agent.22016.B
        [WARNING]   Infected files in archives cannot be repaired!
    --> virus\6.exe
        [DETECTION] Contains suspicious code HEUR/Crypted
        [WARNING]   Infected files in archives cannot be repaired!
    --> virus\7.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> virus\xuik.exe
        [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!


End of the scan: 2007年5月22日  19:09
Used time: 00:09 min

The scan has been done completely.

      0 Scanning directories
     10 Files were scanned
      9 viruses and/or unwanted programs were found
      3 classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     -2 Files not concerned
      1 Archives were scanned
     10 Warnings
      0 Notes
      0 Hidden objects were found

扫描日志
NOD32版本 2279 (20070521) NT
命令行： C:\Documents and Settings\morgan\My Documents\ ?
?virus.rar
正在检查NOD32.EXE文件的CRC：状态正常
D:\Eset\nod32.exe - 是正常的
扫描系统内存中：没有进行 (选项已关闭)
扫描MBR及引导区中：没有进行 (选项已关闭)
日期： 22.5.2007  时间：19:10:19
已关闭反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\ ?
?morgan\My Documents\virus.rar
C:\Documents and Settings\morgan\My Documents\virus.rar  ?
?>>RAR >>virus\0.exe - 可能是 Win32/PSW.Agent.NEC 木马  ?
?的一个变种
C:\Documents and Settings\morgan\My Documents\virus.rar  ?
?>>RAR >>virus\1.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\virus.rar  ?
?>>RAR >>virus\2.exe - Win32/PSW.Agent.NEW 木马的变种
C:\Documents and Settings\morgan\My Documents\virus.rar  ?
?>>RAR >>virus\3.exe - 未查明的 NewHeur_PE 病毒 [7]
C:\Documents and Settings\morgan\My Documents\virus.rar  ?
?>>RAR >>virus\4.exe - Win32/Pacex.Gen 病毒
C:\Documents and Settings\morgan\My Documents\virus.rar  ?
?>>RAR >>virus\5.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\virus.rar  ?
?>>RAR >>virus\6.exe - Win32/Agent.NEO 木马的变种
C:\Documents and Settings\morgan\My Documents\virus.rar  ?
?>>RAR >>virus\7.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\virus.rar  ?
?>>RAR >>virus\xuik.exe - Win32/Agent.AJ 蠕虫
已扫描的文件数目：10
已发现的病毒数目：6
活动的病毒数目：1
完成时间： 19:10:45 总扫描时间：26 秒 (00:00:26)
注意：
[7] 该文件可能感染上未知病毒。


[Scan path] C:\Documents and Settings\morgan\My Documents\virus.rar
>>>C:\Documents and Settings\morgan\My Documents\virus.rar\virus\0.exe is an adware program Adware.Casino.origin
>>C:\Documents and Settings\morgan\My Documents\virus.rar\virus\1.exe probably infected with MULDROP.Trojan
>>C:\Documents and Settings\morgan\My Documents\virus.rar\virus\2.exe probably infected with MULDROP.Trojan
>>C:\Documents and Settings\morgan\My Documents\virus.rar\virus\3.exe - Ok
>>C:\Documents and Settings\morgan\My Documents\virus.rar\virus\4.exe infected with Trojan.PWS.Poptang
>>>C:\Documents and Settings\morgan\My Documents\virus.rar\virus\5.exe - Ok
>>C:\Documents and Settings\morgan\My Documents\virus.rar\virus\6.exe probably infected with BACKDOOR.Trojan
>>C:\Documents and Settings\morgan\My Documents\virus.rar\virus\7.exe probably infected with MULDROP.Trojan
>>C:\Documents and Settings\morgan\My Documents\virus.rar\virus\xuik.exe - Ok
C:\Documents and Settings\morgan\My Documents\virus.rar - archive contains infected objects

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 11
Infected objects found: 1
Objects with modifications found: 0
Suspicious objects found: 4
Adware programs found: 1
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 106 Kb/s
Scan time: 00:00:03

miller239

卡6只报两个，最近两天卡巴还真惨。。。
免杀都是一包包的。。

glacier

样本下不下来
一点，然后BD就不停地报警，然后说这个页面有毒，拦截了

bridgewr

微点通吃

gwg829

MS下完了　还有0 1 2 3 4 在

119TR



Hello,

0.exe_ - Trojan-PSW.Win32.OnLineGames.nn,
1.exe_ - Trojan-PSW.Win32.OnLineGames.es,
3.exe_ - Trojan-PSW.Win32.OnLineGames.es

New malicious software was found in these files. Detection will be
included in the next update. Thank you for your help.

2.exe_ - Trojan-PSW.Win32.OnLineGames.uf,
4.exe_ - Packed.Win32.NSAnti.n

These files are already detected. Please update your antivirus bases.

Please quote all when answering.

--
Best regards, Roman Gavrilchenko
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: virus.rar

[ 本帖最后由 gwg829 于 2007-5-23 12:24 编辑 ]

wangjay1980

detected: Trojan program Trojan-PSW.Win32.OnLineGames.nn        File: C:\Documents and Settings\Owner\×ÀÃæ\virus.rar/virus\0.exe//LYLOADER.EXE//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.es        File: C:\Documents and Settings\Owner\×ÀÃæ\virus.rar/virus\1.exe//UPXDND.DLL
detected: Trojan program Trojan-PSW.Win32.OnLineGames.uf        File: C:\Documents and Settings\Owner\×ÀÃæ\virus.rar/virus\2.exe//PE_Patch//UPack
detected: virus Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\virus.rar/virus\3.exe//PE_Patch.AvSpoof//BeRo
detected: virus Packed.Win32.NSAnti.n        File: C:\Documents and Settings\Owner\×ÀÃæ\virus.rar/virus\4.exe
detected: virus Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\virus.rar/virus\6.exe
detected: virus Invader (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\virus.rar/virus\7.exe