[凝逸.扫描]30 MD5[3A1D74 E93E20 e93e20 7B88F5 442507 7b88f5 442507 2CC51A

qqq000@qq.com

[凝逸.扫描记录]
MD5[3A1D74 E93E20 e93e20 7B88F5 442507 7b88f5 442507 2CC51A 87E2F3 C9A4BA E8B16D 1DC12F 94BE96 E4BC92 12AA2D 0A478E 88BEBF 9AA2EC A9D63B 2cc51a 87e2f3 c9a4ba e8b16d 1dc12f 94be96 e4bc92 12aa2d 0a478e 88bebf 9aa2ec ]
f:\未知\1\3A1D74_skypeclient.exe,木马
f:\未知\1\E93E20_skypeclient_unpacked.exe,木马
f:\未知\1\e93e20_skypeclient_unpacked.exe,木马
f:\未知\1\ccc\7B88F5_lgbpd.exe,木马
f:\未知\1\ccc\442507_stdrun1.exe,木马
f:\未知\1\ccc\7b88f5_lgbpd.exe,木马
f:\未知\1\ccc\442507_stdrun1.exe,木马
f:\未知\1\sssss件\2CC51A_windds32.dll,木马
f:\未知\1\sssss件\87E2F3_mosou.dll,木马
f:\未知\1\sssss件\C9A4BA_nwizqjsj.dll,木马
f:\未知\1\sssss件\E8B16D_nwiztlbb.dll,木马
f:\未知\1\sssss件\1DC12F_winform.dll,木马
f:\未知\1\sssss件\94BE96_ztinetzt.dll,木马
f:\未知\1\sssss件\E4BC92_msdebug.dll,木马
f:\未知\1\sssss件\12AA2D_wanpacket.dll,木马
f:\未知\1\sssss件\0A478E_wpcap.dll,木马
f:\未知\1\sssss件\88BEBF_netsrvcs.dll,木马
f:\未知\1\sssss件\9AA2EC_nwizwmgjs.dll,木马
f:\未知\1\sssss件\A9D63B_nwizzhuxians.dll,木马
f:\未知\1\sssss件\2cc51a_windds32.dll,木马
f:\未知\1\sssss件\87e2f3_mosou.dll,木马
f:\未知\1\sssss件\c9a4ba_nwizqjsj.dll,木马
f:\未知\1\sssss件\e8b16d_nwiztlbb.dll,木马
f:\未知\1\sssss件\1dc12f_winform.dll,木马
f:\未知\1\sssss件\94be96_ztinetzt.dll,木马
f:\未知\1\sssss件\e4bc92_msdebug.dll,木马
f:\未知\1\sssss件\12aa2d_wanpacket.dll,木马
f:\未知\1\sssss件\0a478e_wpcap.dll,木马
f:\未知\1\sssss件\88bebf_netsrvcs.dll,木马
f:\未知\1\sssss件\9aa2ec_nwizwmgjs.dll,木马
感染:30/文件:30
扫描完成|文件:30|耗时:2002

wangjay1980

deleted: Trojan program Trojan-Downloader.Win32.VB.awj        File: C:\Documents and Settings\Owner\×ÀÃæ\1\ccc\442507_stdrun1.exe//data0005
deleted: Trojan program Trojan-Proxy.Win32.Small.du        File: C:\Documents and Settings\Owner\×ÀÃæ\1\sssss¼þ\2CC51A_windds32.dll//PE_Patch.PECompact//PecBundle//PECompact
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.sl        File: C:\Documents and Settings\Owner\×ÀÃæ\1\sssss¼þ\87E2F3_mosou.dll
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.xg        File: C:\Documents and Settings\Owner\×ÀÃæ\1\sssss¼þ\E8B16D_nwiztlbb.dll
deleted: Trojan program Trojan-Downloader.Win32.Obfuscated.n        File: C:\Documents and Settings\Owner\×ÀÃæ\1\sssss¼þ\E4BC92_msdebug.dll
deleted: Trojan program Trojan-Proxy.Win32.Small.du        File: C:\Documents and Settings\Owner\×ÀÃæ\1\sssss¼þ\88BEBF_netsrvcs.dll
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.up        File: C:\Documents and Settings\Owner\×ÀÃæ\1\sssss¼þ\9AA2EC_nwizwmgjs.dll

wangjay1980

其余上报

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\1'
C:\Documents and Settings\Administrator\My Documents\1\
  3A1D74_skypeclient.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!
  E93E20_skypeclient_unpacked.exe
C:\Documents and Settings\Administrator\My Documents\1\ccc\
  442507_stdrun1.exe
      [DETECTION] Contains signature of the dropper DR/Dldr.VB.awj.5
      [WARNING]   The file was ignored!
  7B88F5_lgbpd.exe
C:\Documents and Settings\Administrator\My Documents\1\sssss件\
  0A478E_wpcap.dll
  12AA2D_wanpacket.dll
  1DC12F_winform.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!
  2CC51A_windds32.dll
      [DETECTION] Is the Trojan horse TR/PSW.Onlinegames.AYD.51
      [WARNING]   The file was ignored!
  87E2F3_mosou.dll
  88BEBF_netsrvcs.dll
      [DETECTION] Is the Trojan horse TR/Agent.22016.B
      [WARNING]   The file was ignored!
  94BE96_ztinetzt.dll
  9AA2EC_nwizwmgjs.dll
      [DETECTION] Is the Trojan horse TR/Agent.10752.49
      [WARNING]   The file was ignored!
  A9D63B_nwizzhuxians.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!
  C9A4BA_nwizqjsj.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!
  E4BC92_msdebug.dll
      [DETECTION] Is the Trojan horse TR/Agent.22016.B
      [WARNING]   The file was ignored!
  E8B16D_nwiztlbb.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!

hj5abc

EXE部分..
F:\Samples\1[1]\1\ccc\442507_stdrun1.exe ?NSIS ?o05PrEz1083.exe - a variant of Win32/TrojanDownloader.VB.AW trojan - was a part of the deleted object

DLL部分..
Scanned disks, folders and files: F:\Samples\1[1]\1\sssss件\
F:\Samples\1[1]\1\sssss件\2CC51A_windds32.dll - a variant of Win32/Agent.NIK trojan
F:\Samples\1[1]\1\sssss件\88BEBF_netsrvcs.dll - a variant of Win32/Agent.NIK trojan
F:\Samples\1[1]\1\sssss件\E4BC92_msdebug.dll - a variant of Win32/Agent.NIK trojan

傻猪猪米走鸡

nod报3！

taihuxian

Virus: Trojan-Downloader.Win32.VB.awj

Virus found while downloading Web content.

Address: bbs.kafan.cn

Virus: Trojan-Proxy.Win32.Small.du (2x), Trojan-PSW.Win32.OnLineGames.sl, Trojan-PSW.Win32.OnLineGames.xg, Trojan-Downloader.Win32.Obfuscated.n, Trojan-PSW.Win32.OnLineGames.up

Virus found while downloading Web content.

Address: bbs.kafan.cn

promised

*:
C:\
...AA2D_wanpacket.dll : is suspected of Trojan-PSW.Game.30 (paranoid heuristics)
C:\ABC\1[1]\1\...\1DC12F_winform.dll : infected MalwareScope.Trojan-PSW.Game.12
C:\ABC\1[1]\1\sssss件\87E2F3_mosou.dll : is suspected of Downloader.Small.160
C:\ABC\1[1]\1\sssss件\88BEBF_netsrvcs.dll : infected Trojan-Proxy.Win32.Small.du
C:\ABC\1[1]\1\sssss件\94BE96_ztinetzt.dll : is suspected of Downloader.Small.160
C:\ABC\1[1]\1\...\9AA2EC_nwizwmgjs.dll : is suspected of Downloader.Small.160
C:\ABC\1[1]\1\...\A9D63B_nwizzhuxians.dll : is suspected of Downloader.Small.160
C:\ABC\1[1]\1\sssss件\C9A4BA_nwizqjsj.dll : is suspected of Downloader.Small.160
C:\ABC\1[1]\1\sssss件\E8B16D_nwiztlbb.dll : is suspected of Downloader.Small.160
Program execution terminated by user


Directories       : 7       Files in archives:      Files on disks:
Archives:                   - total       : 0       - total       : 35
- scanned         : 0       -  scanned    : 0       - scanned     : 35
- contain viruses : 0       -  infected   : 0       - infected    : 2
- deleted         : 0       -  suspicious : 0       - suspicious  : 7

Startup    : 18:14:22 18-06-2007
End        : 18:14:27 18-06-2007
Total time : 00:00:05
终止批处理操作吗(Y/N)?

idiedd

这么多PART，有何用？ CRAP!