MD5:1_.ii * 刚刚搞到的样本

lovecho

　密码virus　后面.exe

[ 本帖最后由 lovecho 于 2007-6-21 15:55 编辑 ]

The EQs

还加密了。。。。

小邪邪

咖啡启发木马

mofunzone

被改了的upack，nod都识别不出来了
Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\1_'
C:\Documents and Settings\Administrator\My Documents\1_\
  1_.ii
      [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
      [WARNING]   The file was ignored!

扫描日志
NOD32版本 2340 (20070620) NT
命令行： C:\Documents and Settings\Administrator\My  ?
?Documents\1_
正在检查NOD32.EXE文件的CRC：状态正常
D:\Eset\nod32.exe - 是正常的
扫描系统内存中：没有进行 (选项已关闭)
扫描MBR及引导区中：没有进行 (选项已关闭)
日期： 21.6.2007  时间：01:02:50
已关闭反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\ ?
?Administrator\My Documents\1_\
C:\Documents and Settings\Administrator\My Documents\1_\ ?
?1_.ii - 是正常的
已扫描的文件数目：1
已发现的病毒数目：0
完成时间： 01:02:50 总扫描时间：0 秒 (00:00:00)


[Scan path] C:\Documents and Settings\Administrator\My Documents\1_
>C:\Documents and Settings\Administrator\My Documents\1_\1_.ii infected with Trojan.DownLoader.24280

wangjay1980

detected: virus Worm.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\1_.rar/1_.ii//UPack

blueline

下载器,下载的样本请上报

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\down.rar'
C:\Documents and Settings\Administrator\My Documents\
  down.rar
    [0] Archive type: RAR
    --> 5.exe
        [DETECTION] Is the Trojan horse TR/PSW.Onlinegames.AYD.110
        [WARNING]   Infected files in archives cannot be repaired!
    --> 6.exe
        [DETECTION] Is the Trojan horse TR/Agent.22016.B
        [WARNING]   Infected files in archives cannot be repaired!
    --> 7.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> internat.exe
        [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
        [WARNING]   Infected files in archives cannot be repaired!
    --> 1.exe
    --> 2.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> 3.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.WH.44
        [WARNING]   Infected files in archives cannot be repaired!
    --> 4.exe
        [WARNING]   The file was ignored!


End of the scan: 2007年6月21日  01:16
Used time: 00:08 min

The scan has been done completely.

      0 Scanning directories
      9 Files were scanned
      6 viruses and/or unwanted programs were found
      2 classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      7 Warnings
      0 Notes
      0 Hidden objects were found

扫描日志
NOD32版本 2340 (20070620) NT
命令行： C:\Documents and Settings\Administrator\My  ?
?Documents\down.rar
正在检查NOD32.EXE文件的CRC：状态正常
D:\Eset\nod32.exe - 是正常的
扫描系统内存中：没有进行 (选项已关闭)
扫描MBR及引导区中：没有进行 (选项已关闭)
日期： 21.6.2007  时间：01:16:38
已关闭反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\ ?
?Administrator\My Documents\down.rar
C:\Documents and Settings\Administrator\My Documents\down. ?
?rar >>RAR >>5.exe - Win32/Agent.NIK 木马的变种
C:\Documents and Settings\Administrator\My Documents\down. ?
?rar >>RAR >>6.exe - Win32/Agent.NIK 木马的变种
C:\Documents and Settings\Administrator\My Documents\down. ?
?rar >>RAR >>7.exe - 是正常的
C:\Documents and Settings\Administrator\My Documents\down. ?
?rar >>RAR >>internat.exe - 是正常的
C:\Documents and Settings\Administrator\My Documents\down. ?
?rar >>RAR >>1.exe - Win32/Agent.NIK 木马的变种
C:\Documents and Settings\Administrator\My Documents\down. ?
?rar >>RAR >>2.exe - 是正常的
C:\Documents and Settings\Administrator\My Documents\down. ?
?rar >>RAR >>3.exe - 是正常的
C:\Documents and Settings\Administrator\My Documents\down. ?
?rar >>RAR >>4.exe - 是正常的
已扫描的文件数目：8
已发现的病毒数目：3
完成时间： 01:16:41 总扫描时间：3 秒 (00:00:03)



[Scan path] C:\Documents and Settings\Administrator\My Documents\down.rar
>C:\Documents and Settings\Administrator\My Documents\down.rar\5.exe infected with Trojan.Havedo
>C:\Documents and Settings\Administrator\My Documents\down.rar\6.exe infected with Trojan.Havedo
>>C:\Documents and Settings\Administrator\My Documents\down.rar\7.exe probably infected with MULDROP.Trojan
>>C:\Documents and Settings\Administrator\My Documents\down.rar\internat.exe infected with Trojan.DownLoader.24280
>C:\Documents and Settings\Administrator\My Documents\down.rar\1.exe infected with Trojan.Havedo
>>C:\Documents and Settings\Administrator\My Documents\down.rar\2.exe probably infected with MULDROP.Trojan
>>C:\Documents and Settings\Administrator\My Documents\down.rar\3.exe infected with Trojan.PWS.Wsgame
>C:\Documents and Settings\Administrator\My Documents\down.rar\4.exe - Ok
C:\Documents and Settings\Administrator\My Documents\down.rar - archive contains infected objects

傻猪猪米走鸡

下载物nod报3！

红心王子

斧头KV干掉

a256886572008

運行1_.exe，發現下列行為，被EQ-Secure RC2攔截！
---------------
2007-06-21 18:15:14    运行应用程序      操作:允许
进程路径:C:\windows\Explorer.EXE
文件路径:D:\桌面\virus\1_\1_.exe
规则:应用程序规则->系統程序->%windir%\Explorer.EXE


2007-06-21 18:15:14    创建文件      操作:阻止
进程路径:D:\桌面\virus\1_\1_.exe
文件路径:C:\windows\system\internat.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-21 18:15:14    创建文件      操作:阻止
进程路径:D:\桌面\virus\1_\1_.exe
文件路径:C:\windows\system\internat.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-21 18:15:14    创建文件      操作:阻止
进程路径:D:\桌面\virus\1_\1_.exe
文件路径:C:\windows\system\internat.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-21 18:15:14    创建文件      操作:阻止
进程路径:D:\桌面\virus\1_\1_.exe
文件路径:D:\桌面\virus\1_\1_.exe.bat
规则:所有程序规则->2.1.5组：限制部份高危格式文件和文件夹的操作->*.bat

----------------------------------------
1.他會在C:\windows\system\產生
   internat.exe
2.他會在他旁邊產生1_.exe.bat