下载者的东西

显示全部楼层 · 发表于 2007-6-3 01:11:30

http://bbs.kafan.cn/viewthread.php?tid=92509&extra=page%3D1
这个帖子里的，wangjay1980提供的下载者

下载者下回来的木马病毒费尔一个也不杀，但依靠动态防御和病毒感染预警之阻止对可执行文件写操作成功拦截了这些东西。大家扫扫看

很多人以为费尔只是一个扫描器那么简单，附件1是wangjay1980提供的下载者附件2是下载回来的东西，多引擎扫描的是下载回来的东东，没扫描下载者。

A-Squared	Found nothing
AntiVir	Found TR/Crypt.NSPM.Gen
ArcaVir	Found nothing
Avast	Found nothing
AVG Antivirus	Found nothing
BitDefender	Found Trojan.PWS.OnLineGames.AXI, Trojan.PWS.OnLineGames.AXG, Trojan.PWS.OnLineGames.AXF, Trojan.PWS.OnLineGames.AXE
ClamAV	Found Trojan.Packed-51
Dr.Web	Found Trojan.PWS.Wsgame
F-Prot Antivirus	Found nothing
F-Secure Anti-Virus	Found nothing
Fortinet	Found nothing
Kaspersky Anti-Virus	Found nothing
NOD32	Found nothing
Norman Virus Control	Found nothing
Panda Antivirus	Found nothing
Rising Antivirus	Found nothing
VirusBuster	Found Trojan.OnlineGames.Gen!Pac.19, Trojan.Onlinegames.Gen!Pac.30
VBA32	Found Trojan-PSW.Win32.OnLineGames.tc

显示全部楼层 · 发表于 2007-6-3 02:39:52

显示全部楼层 · 发表于 2007-6-3 02:40:21

clamAV这个太明显了。。。

显示全部楼层 · 发表于 2007-6-3 02:42:04

原帖由 EQ2 于 2007-6-3 04:10 发表
clamAV这个太明显了。。。

看报毒名字分析病毒高手大显神通

显示全部楼层 · 发表于 2007-6-3 02:45:18

趋势也会用这个来报。。。。不过后门竟然跟了基因。。。。

显示全部楼层 · 发表于 2007-6-3 03:05:19

Starting the file scan:

Begin scan in 'D:\Documents and Settings\dell\桌面\新建文件夹.rar'
D:\Documents and Settings\dell\桌面\
D:\Documents and Settings\dell\桌面\新建文件夹.rar
  [0] Archive type: RAR
  --> svchost32.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [WARNING] Infected files in archives cannot be repaired!
  --> csrss.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [WARNING] Infected files in archives cannot be repaired!
  --> mmc.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [WARNING] Infected files in archives cannot be repaired!
  --> copypfh.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [WARNING] Infected files in archives cannot be repaired!
  --> conime.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [WARNING] Infected files in archives cannot be repaired!
  --> ctfmon.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [WARNING] Infected files in archives cannot be repaired!
  --> IEXPLORE.EXE
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [WARNING] Infected files in archives cannot be repaired!
  --> services.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [WARNING] Infected files in archives cannot be repaired!
  --> smss.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [WARNING] Infected files in archives cannot be repaired!
  --> spglsdr.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [WARNING] Infected files in archives cannot be repaired!
  --> srogm.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [WARNING] Infected files in archives cannot be repaired!
  --> stpgldk.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [WARNING] Infected files in archives cannot be repaired!
  --> svchost.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was successfully wiped!
   [INFO]    The file was deleted!

End of the scan: 2007年6月3日  02:59
Used time: 00:31 min

The scan has been done completely.

   0 Scanning directories
   14 Files were scanned
   13 viruses and/or unwanted programs were found

显示全部楼层 · 发表于 2007-6-3 03:07:10

Begin scan in 'D:\Documents and Settings\dell\桌面\2.zip'
D:\Documents and Settings\dell\桌面\
D:\Documents and Settings\dell\桌面\2.zip
  [0] Archive type: ZIP
  --> svchost.exe
   [DETECTION] Contains signature of the dropper DR/Delphi.Gen
   [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was successfully wiped!
   [INFO]    The file was deleted!

End of the scan: 2007年6月3日  03:06
Used time: 00:09 min

The scan has been done completely.

   0 Scanning directories
   3 Files were scanned
   1 viruses and/or unwanted programs were found

显示全部楼层 · 发表于 2007-6-3 03:09:26

请教一下，dropper DR 如何翻译

显示全部楼层 · 发表于 2007-6-3 06:28:42

Virus: Trojan-PSW.Win32.Nilage.apl

Virus found while downloading Web content.

Address: bbs.kafan.cn

Virus: Trojan-PSW.Win32.OnLineGames.vx

Virus found while downloading Web content.

Address: bbs.kafan.cn

显示全部楼层 · 发表于 2007-6-3 08:48:42

detected: Trojan program Trojan-Downloader.JS.Agent.gd File: C:\Documents and Settings\Owner\×ÀÃæ\2.zip/2.js
detected: virus Virus.Win32.AutoRun.p File: C:\Documents and Settings\Owner\×ÀÃæ\2.zip/svchost.exe//UPX

下载者的东西

本帖子中包含更多资源

本帖子中包含更多资源

这文件名一出，挂的应该挺多的，针对卡巴做的免杀也报它

本帖子中包含更多资源