今天新入马马+(庆祝下【凝逸反毒】病毒样本过万)

qqq000@qq.com

今天新入马马+(庆祝下【凝逸反毒】病毒样本过万)




----------
              [凝逸反毒] (http://hi.baidu.com/503165656)
       [凝逸.扫描病毒引擎-日志]       2007.5.31 15:27:53
文件:F:\070531\070531\1(3).exe | 感染:BackDoor.Pigeon.2685 [25>2007_e30d34_0139.axx]3
操作:删除文件
文件:F:\070531\070531\1(2).exe | 感染:worm.win32.delf.cc [119>2007_e30d34_0139.axx]3
操作:删除文件
文件:F:\070531\070531\1(1).exe | 感染:worm.win32.delf.cc [117>2007_e30d34_0139.axx]3
操作:删除文件

扫描完成|病毒:3 文件:3|耗时:1312
----------

qqq000@qq.com

[凝逸.病毒库引擎]
版本2.0
病毒库引擎初始化
初始化完成.用时=671
[xkx]
xp1=2870
xp2=729
[pxk]
ls=0
[更新]
上次更新=
文件数量=42
病毒总数=10064
C病毒数量=5

[病毒库列表]
2007_41ad60_0042.axx | 病毒数:42
2007_e30d34_0139.axx | 病毒数:139
2007_1283389_0100.axx | 病毒数:100
2007_193713_0145.axx | 病毒数:145
2007_215412_0002.axx | 病毒数:2
2007_185554_0194.axx | 病毒数:194
2007_150748_0103.axx | 病毒数:103
2007_184901_0213.axx | 病毒数:213
2007_204215_0008.axx | 病毒数:8
2007_170318_0034.axx | 病毒数:34
2007_162136_0064.axx | 病毒数:64
2007_114522_0072.axx | 病毒数:72
2007_190113_0003.axx | 病毒数:3
2007_46231375_0100.axx | 病毒数:100
2007_111436_3291.axx | 病毒数:3291
2007_185021_0222.axx | 病毒数:222
2007_210218_0260.axx | 病毒数:260
2007_164820_0159.axx | 病毒数:159
2007_2803399_0100.axx | 病毒数:100
2007_2803399_0004.axx | 病毒数:4
2007_195722_0114.axx | 病毒数:114
2007_150246_0098.axx | 病毒数:98
2007_101300_0053.axx | 病毒数:53
2007_163123_0395.axx | 病毒数:395
2007_140030_0305.axx | 病毒数:305
2007_225538_0316.axx | 病毒数:316
2007_185324_0202.axx | 病毒数:202
2007_000113_1391.axx | 病毒数:1391
2007_111943_0103.axx | 病毒数:103
2007_123631_0091.axx | 病毒数:91
2007_221120_0149.axx | 病毒数:149
2007_180609_0190.axx | 病毒数:190
2007_114522_0083.axx | 病毒数:83
2007_132257_0259.axx | 病毒数:259
2007_212418_0219.axx | 病毒数:219
2007_122325_0120.axx | 病毒数:120
2007_150350_0225.axx | 病毒数:225
2007_111219_0114.axx | 病毒数:114
2007_200911_0053.axx | 病毒数:53
2007_215840_0112.axx | 病毒数:112
2007_144854_0214.axx | 病毒数:214
2007_281500000_0003.axx | 病毒数:3

C病毒组初始化成功
[C病毒列表]
威金
熊猫烧香
MS鼠标零日漏洞
TR.Drop.Agent
熊貓燒香2

[感染病毒库]
数量=102
熊猫烧香
维金
ARP病毒
艾伲
番茄花园
感染PE尾
Trojan.PWS.Lineage
Win32.HLLW.Wace
BackDoor.Beizhu

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\070531'
C:\Documents and Settings\morgan\My Documents\070531\
  1(1).exe
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
      [INFO]      The file was deleted!
  1(2).exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [INFO]      The file was deleted!
  1(3).exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.QG
      [INFO]      The file was deleted!
  barhelp24.0.dll
      [DETECTION] Contains signature of the Ad- or Spyware ADSPY/IEBar.N
      [INFO]      The file was deleted!
  BDGuard.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.AK
      [INFO]      The file was deleted!
  friend.exe
    [0] Archive type: CAB (Microsoft)
    --> lsdialer.exe
        [DETECTION] Contains signature of the dial-up program DIAL/000181
        [WARNING]   Infected files in archives cannot be repaired!
        [1] Archive type: RAR SFX (self extracting)
        --> dialer.ini
        --> terms.txt
        --> dialer.exe
            [DETECTION] Contains signature of the dial-up program DIAL/Generic
            [WARNING]   Infected files in archives cannot be repaired!
    --> lsdialer.inf
        [INFO]      The file was deleted!
  iebar23.0.dll
      [DETECTION] Contains signature of the Ad- or Spyware ADSPY/Iebar.M.1
      [INFO]      The file was deleted!
  npptools.dll
  regkey.hiv
      [DETECTION] Is the Trojan horse TR/PSW.Onlinegames.AVH
      [INFO]      The file was deleted!
  setup.exe
  VPACKET.VXD
  wanpacket.dll
  winio.dll
  winio.sys
  winio.vxd
  wpcap.dll
C:\Documents and Settings\morgan\My Documents\070531\07525\
  vpacket.vxd
C:\Documents and Settings\morgan\My Documents\070531\Trojan-Spy.Win32.Delf.uy\
  sysinfo2.dll
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was deleted!


End of the scan: 2007年5月31日  00:38
Used time: 00:08 min

The scan has been done completely.

      3 Scanning directories
     23 Files were scanned
     10 viruses and/or unwanted programs were found
      0 classified as suspicious:
      9 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     13 Files not concerned
      2 Archives were scanned
      2 Warnings
      0 Notes
      0 Hidden objects were found

wangjay1980

deleted: Trojan program Trojan-PSW.Win32.OnLineGames.qg        File: C:\Documents and Settings\Owner\×ÀÃæ\070531.rar/1(3).exe
deleted: virus Virus.Win32.AutoRun.p        File: C:\Documents and Settings\Owner\×ÀÃæ\070531.rar/1(1).exe//UPX
deleted: Trojan program Trojan-Spy.Win32.Delf.uy        File: C:\Documents and Settings\Owner\×ÀÃæ\¿ÉÄÜ1.rar/Trojan-Spy.Win32.Delf.uy\sysinfo2.dll//ASPack
deleted: adware not-a-virus:AdWare.Win32.Iebar.h        File: C:\Documents and Settings\Owner\×ÀÃæ\¿ÉÄÜ2.rar/barhelp24.0.dll
deleted: adware not-a-virus:AdWare.Win32.Iebar.m        File: C:\Documents and Settings\Owner\×ÀÃæ\¿ÉÄÜ2.rar/iebar23.0.dll
deleted: pornware not-a-virus:Porn-Dialer.Win32.Generic        File: C:\Documents and Settings\Owner\×ÀÃæ\¿ÉÄÜ2.rar/friend.exe/lsdialer.exe/dialer.exe

红心王子

斧头KV发飙，费尔补助帮忙
费尔还识别出了广告程序，有待加强

扫描开始时间: 2007-5-31 16:49:53
扫描日志
NOD32 版本 2300 (20070531) NT
命令行: F:\070531.rar

日期: 2007年5月31日  时间: 16:49:54
反 Rookits 技术已启用。
已扫描磁盘、文件夹和文件: F:\070531.rar
F:\070531.rar ?RAR ?1(1).exe<病毒 - 可能是 Win32/PSW.Delf.NHI 木马 变种>
已扫描文件数量: 3
已发现病毒数量: 1
完成时间: 16:49:57 总共扫描时间: 3 秒 (00:00:03)

扫描开始时间: 2007-5-31 16:51:01
扫描日志
NOD32 版本 2300 (20070531) NT
命令行: F:\可能1.rar

日期: 2007年5月31日  时间: 16:51:02
反 Rookits 技术已启用。
已扫描磁盘、文件夹和文件: F:\可能1.rar
F:\可能1.rar ?RAR ?Trojan-Spy.Win32.Delf.uy\sysinfo2.dll<病毒 - Win32/Spy.Delf.UY 木马>
已扫描文件数量: 10
已发现病毒数量: 1
完成时间: 16:51:02 总共扫描时间: 0 秒 (00:00:00)

扫描开始时间: 2007-5-31 16:51:08
扫描日志
NOD32 版本 2300 (20070531) NT
命令行: F:\可能2.rar

日期: 2007年5月31日  时间: 16:51:09
反 Rookits 技术已启用。
已扫描磁盘、文件夹和文件: F:\可能2.rar
F:\可能2.rar ?RAR ?iebar23.0.dll<病毒 - Win32/Adware.Toolbar.IEBar 应用程序>
F:\可能2.rar ?RAR ?friend.exe ?CAB ?lsdialer.exe ?RAR ?dialer.exe<病毒 - Win32/Dialer.BillPrayer 应用程序 变种>
已扫描文件数量: 9
已发现病毒数量: 2
完成时间: 16:51:09 总共扫描时间: 0 秒 (00:00:00)

The EQs

Scan performed at: 2007-5-31 16:53:19
Scanning Log
NOD32 version 2300 (20070531) NT
Command line: C:\Documents and Settings\EQ2\桌面\桌面
Operating memory - is OK

Date: 31.5.2007  Time: 16:53:23
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\桌面\
C:\Documents and Settings\EQ2\桌面\桌面\1(1).exe - probably a variant of Win32/PSW.Delf.NHI trojan
C:\Documents and Settings\EQ2\桌面\桌面\friend.exe ?CAB ?lsdialer.exe ?RAR ?dialer.exe - a variant of Win32/Dialer.BillPrayer application - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\桌面\iebar23.0.dll - Win32/Adware.Toolbar.IEBar application - quarantined - unable to clean - deleted
C:\Documents and Settings\EQ2\桌面\桌面\Trojan-Spy.Win32.Delf.uy\sysinfo2.dll - Win32/Spy.Delf.UY trojan - quarantined - unable to clean - deleted
Number of scanned files: 23
Number of threats found: 4
Number of files cleaned: 4
Time of completion: 16:53:26 Total scanning time: 3 sec (00:00:03)

wangjay1980

Hello,

friend.exek, npptools.dll, wpcap.dll

No malicious code were found in these files.

Please quote all when answering.

--
Best regards, Vladimir Krylov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: ??2.zip

鼻耳盖子

其中一部分是dll,sys,vxd 这里没有办法测试
木马名称:Trojan-Spy.Win32.Delf.bwl
程序:
I:\TEST\070531\13\可能1\TROJAN-SPY.WIN32.DELF.UY\SYSINFO2.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

taihuxian

Virus: Trojan-PSW.Win32.OnLineGames.qg, Virus.Win32.AutoRun.p

Virus found while downloading Web content.

Address: bbs.kafan.cn


Virus: Trojan-Spy.Win32.Delf.uy

Virus found while downloading Web content.

Address: bbs.kafan.cn



Virus: not-a-virus:AdWare.Win32.Iebar.h, not-a-virus:AdWare.Win32.Iebar.m, not-a-virus:Porn-Dialer.Win32.Generic

Virus found while downloading Web content.

Address: bbs.kafan.cn