5个，未添加NSANTI

绅博周幸

扫，卡巴全杀

mofunzone

antivir差一个，上报

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\5.rar'
C:\Documents and Settings\Administrator\My Documents\
  5.rar
    [0] Archive type: RAR
    --> softmuma.exe
        [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> WinForm.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ZC
        [WARNING]   Infected files in archives cannot be repaired!
    --> 6.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> 11.exe
    --> 13.exe
        [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.2
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!

freeboyoua

已检测到: 木马程序 Trojan-Downloader.Win32.Agent.bmp        URL: http://bbs.kafan.cn/attachment.php?aid=93260//softmuma.exe//FSG

mofunzone

已经侦测到了
Thank you for your submission. Below you can see the current status of the uploaded files.

A listing of files alongside their results can be found below:
File ID          Filename          Size (Byte)         Result
1004038          11.exe          30.96 KB          MALWARE


Please find a detailed report concerning each individual sample below:
Filename         Result
11.exe          MALWARE

The file '11.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/PSW.QQPass.XC. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 6.39.00.57.
Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.

mofunzone

扫描日志
NOD32版本 2354 (20070626) NT
命令行： C:\Documents and Settings\Administrator\My  ?
?Documents\5.rar
正在检查NOD32.EXE文件的CRC：状态正常
D:\Eset\nod32.exe - 是正常的
扫描系统内存中：没有进行 (选项已关闭)
扫描MBR及引导区中：没有进行 (选项已关闭)
日期： 26.6.2007  时间：00:58:56
已关闭反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\ ?
?Administrator\My Documents\5.rar
C:\Documents and Settings\Administrator\My Documents\5. ?
?rar >>RAR >>softmuma.exe - 未查明的 NewHeur_PE 病毒 [7]
C:\Documents and Settings\Administrator\My Documents\5. ?
?rar >>RAR >>WinForm.exe - Win32/PSW.OnLineGames.YA  ?
?木马的变种
C:\Documents and Settings\Administrator\My Documents\5. ?
?rar >>RAR >>6.exe - 是正常的
C:\Documents and Settings\Administrator\My Documents\5. ?
?rar >>RAR >>11.exe - 可能是 Win32/PSW.QQPass.VD 木马  ?
?的一个变种
C:\Documents and Settings\Administrator\My Documents\5. ?
?rar >>RAR >>13.exe - 是正常的
已扫描的文件数目：5
已发现的病毒数目：3
完成时间： 00:59:00 总扫描时间：4 秒 (00:00:04)
注意：
[7] 该文件可能感染上未知病毒。

mofunzone

[Scan path] C:\Documents and Settings\Administrator\My Documents\5.rar
>>C:\Documents and Settings\Administrator\My Documents\5.rar\softmuma.exe probably infected with DLOADER.Trojan
>C:\Documents and Settings\Administrator\My Documents\5.rar\WinForm.exe infected with Trojan.PWS.Gamania
>>C:\Documents and Settings\Administrator\My Documents\5.rar\6.exe infected with Trojan.PWS.Wsgame
>>>C:\Documents and Settings\Administrator\My Documents\5.rar\11.exe infected with Trojan.PWS.Qqpass.851
>>C:\Documents and Settings\Administrator\My Documents\5.rar\13.exe\data001 - Ok
>>>C:\Documents and Settings\Administrator\My Documents\5.rar\13.exe\data002 - Ok
>>>C:\Documents and Settings\Administrator\My Documents\5.rar\13.exe\data003 - Ok
>>>C:\Documents and Settings\Administrator\My Documents\5.rar\13.exe\data004 - Ok
>>C:\Documents and Settings\Administrator\My Documents\5.rar\13.exe\data005 infected with Trojan.Sniff
>>C:\Documents and Settings\Administrator\My Documents\5.rar\13.exe\data006 - Ok
>C:\Documents and Settings\Administrator\My Documents\5.rar\13.exe - archive contains infected objects
C:\Documents and Settings\Administrator\My Documents\5.rar - archive contains infected objects

绅博周幸

原帖由 mofunzone 于 2007-6-26 15:53 发表
扫描日志
NOD32版本 2354 (20070626) NT
命令行： C:\Documents and Settings\Administrator\My  ?
?Documents\5.rar
正在检查NOD32.EXE文件的CRC：状态正常
D:\Eset\nod32.exe - 是正常的
扫描系统内存中 ...

卡巴全部已知

1688388728

病毒: Trojan-Downloader.Win32.Agent.bmp, Trojan-PSW.Win32.OnLineGames.zc, Trojan-PSW.Win32.Nilage.bjp, Trojan-PSW.Win32.QQPass.xc, Trojan.Win32.Patched.ac
檔案: 5[1].rar
目錄: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OH2QVAT0
處理序: GreenBrowser.exe

hahacomcn

原帖由 mofunzone 于 2007-6-26 15:49 发表
已经侦测到了
Thank you for your submission. Below you can see the current status of the uploaded files.

A listing of files alongside their results can be found below:
File ID          Filena ...

M，偶在红伞区发了一个问题，就是你现在出现的这个情况。

红伞杀不到，但是上报的时候，分析了却说是病毒文件。

为何？

mofunzone

他和kav一样有自动分析系统的
而且有时候是侦测到但是还没来的急升级
你可以看一下这个样本提示升级的vdf版本号，再看看你现在的