[MD5: 03DBCF 098BE7]

tonger2003

promised

酝屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯图
License expired
License #000000119 Valid till 2006-12-31
Demo mode
Command line options:
/r=susp.rpt /ha=3 /collect_suspects /nc /af+ /ar+ /bt- /mr- /ml+ /rw+ /as-
Ctrl-C will terminate program execution

*:
C:\
C:\ABC\样本.rar:<RAR>\c.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\ABC\样本.rar:<RAR>\a.exe : is suspected of Downloader.Small.160
Program execution terminated by user


Directories       : 3       Files in archives:      Files on disks:
Archives:                   - total       : 2       - total       : 19
- scanned         : 1       -  scanned    : 2       - scanned     : 19
- contain viruses : 1       -  infected   : 1       - infected    : 1
- deleted         : 0       -  suspicious : 1       - suspicious  : 0

Startup    : 11:21:59 23-06-2007
End        : 11:22:03 23-06-2007
Total time : 00:00:04
终止批处理操作吗(Y/N)?

mofunzone

终于来了个像样的样本

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\样本.rar'
C:\Documents and Settings\Administrator\My Documents\
  样本.rar
    [0] Archive type: RAR
    --> c.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> a.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGam.QW
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!

The EQs

Scan performed at: 2007-6-23 11:22:04
Scanning Log
NOD32 version 2346 (20070622) NT
Command line: C:\Documents and Settings\EQ2\桌面\样本
Operating memory - is OK

Date: 23.6.2007  Time: 11:22:08
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\样本\
C:\Documents and Settings\EQ2\桌面\样本\a.exe - a variant of Win32/PSW.Agent.NEW trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 11:22:08 Total scanning time: 0 sec (00:00:00)

mofunzone

[Scan path] C:\Documents and Settings\Administrator\My Documents\样本.rar
>>C:\Documents and Settings\Administrator\My Documents\样本.rar\c.exe probably infected with MULDROP.Trojan
>>C:\Documents and Settings\Administrator\My Documents\样本.rar\a.exe infected with Trojan.PWS.Wsgame
C:\Documents and Settings\Administrator\My Documents\样本.rar - archive contains infected objects

aerbeisi

修改时间，Trojan generic无论怎么改都逃不出主动防御。

detected: riskware Trojan.generic Running process: c.exe
detected: riskware Trojan.generic Running process: a.exe

[ 本帖最后由 aerbeisi 于 2007-6-23 11:20 编辑 ]

Whkroran

detected: virus Invader (modification)        URL: http://bbs.kafan.cn/attachment.php?aid=91632//c.exe

tracydk

电影结束了

对象: a.exe
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\样本.rar
        Status: 已发现病毒
        病毒: Trojan.PWS.OnlineGames.AUP (BD 引擎)
对象: 样本.rar
        路径: C:\Documents and Settings\wangcheng\桌面
        Status: 已发现病毒
        病毒: Trojan.PWS.OnlineGames.AUP (BD 引擎)
扫描完成: 2007-6-23 11:32
    已检查 1 个文件
    已发现 1 个染毒文件
    发现 0 个可疑文件

红心王子

费尔报启发