qqfzl.com样本，exe文件包1[MD5: 5FC51A 7889E5 8286B2 2DD7C0 58B8A3 3728AF BCA8AC]

allenhippo

一共7个文件

[ 本帖最后由 allenhippo 于 2007-6-9 14:35 编辑 ]

The EQs

Scan performed at: 2007-6-9 14:32:14
Scanning Log
NOD32 version 2320 (20070609) NT
Command line: C:\Documents and Settings\EQ2\桌面\virus.rar
Operating memory - is OK

Date: 9.6.2007  Time: 14:32:19
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\virus.rar
C:\Documents and Settings\EQ2\桌面\virus.rar ?RAR ?10.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\virus.rar ?RAR ?11.exe - probably a variant of Win32/PSW.QQPass.VD trojan
C:\Documents and Settings\EQ2\桌面\virus.rar ?RAR ?7.exe ?RAR ?systemm.exe - Win32/Agent.NEK trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\virus.rar ?RAR ?down[1].exe - Win32/Delf.BS worm - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\virus.rar ?RAR ?mhso.exe - Win32/Pacex.Gen virus
C:\Documents and Settings\EQ2\桌面\virus.rar ?RAR ?mydata.exe - a variant of Win32/PSW.Agent.NEW trojan
Number of scanned files: 12
Number of threats found: 6
Number of files cleaned: 1
Time of completion: 14:32:20 Total scanning time: 1 sec (00:00:01)

Notes:
[7] File is probably infected with an unknown virus.

红心王子

费尔

promised

Demo mode
Command line options:
/r=susp.rpt /ha=3 /collect_suspects /nc /af+ /ar+ /bt- /mr- /ml+ /rw+ /as-
Ctrl-C will terminate program execution

*:
C:\
C:\ABC\virus.rar:<RAR>\10.exe : infected BackDoor.Twin
C:\ABC\virus.rar:<RAR>\11.exe : is suspected of Trojan-Spy.Delf.13
C:\ABC\virus.rar:<RAR>\7.exe:<RAR>\systemm.exe : infected Trojan.Sniff
C:\ABC\virus.rar:<RAR>\down[1].exe : infected Win32.HLLW.Autoruner
C:\ABC\virus.rar:<RAR>\mydata.exe : infected Trojan-PSW.Win32.OnLineGames.qw
Program execution terminated by user


Directories       : 4       Files in archives:      Files on disks:
Archives:                   - total       : 12      - total       : 24
- scanned         : 2       -  scanned    : 12      - scanned     : 23
- contain viruses : 2       -  infected   : 5       - infected    : 1
- deleted         : 0       -  suspicious : 1       - suspicious  : 0

Startup    : 14:33:45 09-06-2007
End        : 14:33:50 09-06-2007
Total time : 00:00:05
终止批处理操作吗(Y/N)?

taihuxian

BitDefender

This web page has been blocked by BitDefender Antivirus Real-time Protection!

The blocked web page included objects that were either infected or likely to be infected with a virus. Your system has NOT been infected.

Trojan.PWS.OnlineGames.AUP
GenPack:Win32.Worm.Delf.NCS
Backdoor.Agent.ALH
Generic.PWStealer.56D124F2
Trojan.PWS.Lmir.AII

rasis

virus.rar
  [0] Archive type: RAR
  --> 10.exe
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
  --> 11.exe
      [DETECTION] Is the Trojan horse TR/PSW.Steal.30823.1
  --> 15.exe
      [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
  --> 7.exe
      [DETECTION] Contains signature of the dropper DR/Agent.alh.1
      [1] Archive type: RAR SFX (self extracting)
      --> systemm.exe
          [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Agent.alh Backdoor server programs
  --> down[1].exe
      [DETECTION] Is the Trojan horse TR/Dldr.Delf.bkz
  --> mhso.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> mydata.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.UF.57

kp2006

挂王avast!报三下 杀两个

wangjay1980

detected: Trojan program Trojan-Downloader.Win32.Small.czl        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\virus.rar/10.exe//NSPack
detected: virus Virus.Win32.AutoRun.bp        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\virus.rar/11.exe//UPX
detected: Trojan program Backdoor.Win32.Agent.alh        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\virus.rar/7.exe//data.rar/systemm.exe//UPack
detected: Trojan program Trojan-Downloader.Win32.Delf.bkz        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\virus.rar/down[1].exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.qw        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\virus.rar/mydata.exe//PE_Patch//UPack

1688388728

virus

tracydk