5个

显示全部楼层 · 发表于 2007-11-25 19:40:30

Start of the scan: 2007年11月25日  19:40

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\1125.rar'
C:\Documents and Settings\Administrator\桌面\1125.rar
  [0] Archive type: RAR
  --> mj.exe
   [DETECTION] Is the Trojan horse TR/Spy.Agent.AJB.3
  --> 12.exe
   [DETECTION] Is the Trojan horse TR/Dldr.VB.bqd
  --> 1.exe
   [DETECTION] Is the Trojan horse TR/PSW.Online.agb.2
  --> my0616.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> f2b4657b5568d072.exe
   [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
   [INFO]    The file was moved to '477b5f5a.qua'!

End of the scan: 2007年11月25日  19:40
Used time: 00:03 min

The scan has been done completely.

   0 Scanning directories
   6 Files were scanned
   5 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   1 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-11-25 19:41:03

C:\Documents and Settings\Don johnson\桌面\1125.rar » RAR » mj.exe - Win32/PSW.Gamer.NAB trojan
C:\Documents and Settings\Don johnson\桌面\1125.rar » RAR » 12.exe - probably a variant of Win32/TrojanDownloader.VB trojan
C:\Documents and Settings\Don johnson\桌面\1125.rar » RAR » 1.exe - Win32/PSW.Agent.NEC trojan
C:\Documents and Settings\Don johnson\桌面\1125.rar » RAR » my0616.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Don johnson\桌面\1125.rar » RAR » f2b4657b5568d072.exe - a variant of Win32/TrojanDownloader.Flux trojan

显示全部楼层 · 发表于 2007-11-25 19:42:04

Starting the file scan:

Begin scan in 'E:\1125.rar'
E:\1125.rar
  [0] Archive type: RAR
  --> mj.exe
   [DETECTION] Is the Trojan horse TR/Spy.Agent.AJB.3
  --> 12.exe
   [DETECTION] Is the Trojan horse TR/Dldr.VB.bqd
  --> 1.exe
   [DETECTION] Is the Trojan horse TR/PSW.Online.agb.2
  --> my0616.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> f2b4657b5568d072.exe
   [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-11-25 19:43:11

C:\1125.rar\mj.exe\data001 - infected with Trojan.PWS.Gamania.5364
C:\1125.rar\mj.exe\data002 - infected with Trojan.PWS.Gamania.5364
C:\1125.rar\12.exe - infected with Trojan.DownLoader.36883
C:\1125.rar\1.exe - infected with Trojan.MulDrop.9561
C:\1125.rar\my0616.exe - infected with Trojan.PWS.Wsgame.origin

Archive contains 5 infected items

DRWEB 4.44 漏掉一个f2b4657b5568d072.exe

[ 本帖最后由 wangfeng66 于 2007-11-25 19:45 编辑 ]

显示全部楼层 · 发表于 2007-11-25 19:44:17

MicroVita AntiSpyware 100 C
_____________________________________________

         风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]
               http://221.10.254.214/
----------------------------------------------
开始扫描……

正在检查启动……
[C:\Documents and Settings\Administrator\桌面\Virus\1125\mj.exe]
                  …………发现Spy！报告:[8] HOOK者
文件信息:  大小:13824  MD5:d49c552087c24f83e183b3550ea32b3d

[C:\Documents and Settings\Administrator\桌面\Virus\1125\my0616.exe]
                  …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:15315  MD5:5d762a472f7970f21764b7b093d7f00a

[C:\Documents and Settings\Administrator\桌面\Virus\1125\f2b4657b5568d072.exe]
                  …………发现Spy！报告:[1] Win32.Nop pdata
文件信息:  大小:18487  MD5:b007a748bf82f30b7cee69bc668ec8ab

文件数:5 病毒数:3  比重:0.6
OK  扫描完毕！

  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎
[2] 文件特征码引擎
[1] 文件启发式引擎

显示全部楼层 · 发表于 2007-11-25 19:45:57

FS砍了四个，另外一个被NOD抢杀了……

显示全部楼层 · 发表于 2007-11-25 19:49:24

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.GameOnline.pt
病毒： Trojan.DL.Win32.VB.xee
病毒： Dropper.Win32.XYOnline.v
病毒： Trojan.PSW.Win32.GameOnline.apa

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.19.62

显示全部楼层 · 发表于 2007-11-25 19:52:48

C:\ABC\1125.rar:\mj.exe - 特征码 'Trojan-PWS.Win32.Gamer.h' 被发现
C:\ABC\1125.rar:\12.exe - 特征码 'Trojan-Downloader.Win32.VB.bqd' 被发现
C:\ABC\1125.rar:\1.exe - 特征码 'Trojan-PWS.Win32.OnLineGames.hqi' 被发现
C:\ABC\1125.rar:\my0616.exe - 特征码 'Trojan-Spy.Win32.Agent.hz' 被发现
C:\ABC\1125.rar:\f2b4657b5568d072.exe - 特征码 'Trojan-PWS.Win32.Agent.BU' 被发现
[Found possible security risk] <W32/Heuristic-KPP!Eldorado (not disinfectable)> C:\ABC\1125.rar->mj.exe
[Found downloader] <W32/Downldr2.AIMO (exact, not disinfectable)> C:\ABC\1125.rar->12.exe
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\ABC\1125.rar->1.exe->(embedded)->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\ABC\1125.rar->my0616.exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (not disinfectable)> C:\ABC\1125.rar->f2b4657b5568d072.exe->(NSPack)->(PE_Patch)

显示全部楼层 · 发表于 2007-11-25 19:53:15

已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hqi 檔案: C:\Documents and Settings\kato9096\桌面\161857\1.exe
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.VB.bqd 檔案: C:\Documents and Settings\kato9096\桌面\161857\12.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.Gamer.h 檔案: C:\Documents and Settings\kato9096\桌面\161857\mj.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ipf 檔案: C:\Documents and Settings\kato9096\桌面\161857\my0616.exe//UPack

一个不报，已上报

[病毒样本] 5个

本帖子中包含更多资源

7/4