呆在硬盘里面的一包[MD5: BE05B0 EC2AD9 9F2C6E 2C0ED6 E32026 D8BB91 027439]

dikex

冒个泡，发一包

扫描开始时间: 2007-6-30 14:56:51
扫描日志
NOD32 版本 2365 (20070630) NT
命令行: F:\virus\样本.rar

日期: 2007年6月30日  时间: 14:56:53
反 Rookits 技术已启用。
已扫描磁盘、文件夹和文件: F:\virus\样本.rar
F:\virus\样本.rar ?RAR ?msdebug.dll<病毒 - Win32/Agent.NIK 木马 变种>
F:\virus\样本.rar ?RAR ?qj.exe<病毒 - Win32/PSW.OnLineGames.RC 木马 变种>
F:\virus\样本.rar ?RAR ?RemoteDbg.dll<病毒 - Win32/Agent.NIK 木马 变种>
F:\virus\样本.rar ?RAR ?biz6.exe<病毒 - Win32/Delf.CC 蠕虫 变种>
已扫描文件数量: 7
已发现病毒数量: 4
完成时间: 14:56:55 总共扫描时间: 2 秒 (00:00:02)

ghsy_2007

只有biz6.exe和cq.exe是加过壳的，其他无壳。
好东西哦

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\样本.rar'
C:\Documents and Settings\Administrator\My Documents\
  样本.rar
    [0] Archive type: RAR
    --> msdebug.dll
    --> qj.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGam.QW
        [WARNING]   Infected files in archives cannot be repaired!
    --> RemoteDbg.dll
    --> tfsaa.ccr
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> biz6.exe
        [DETECTION] Is the Trojan horse TR/PSW.Nilage.bcw.16
        [WARNING]   Infected files in archives cannot be repaired!
    --> cq.exe
        [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
        [WARNING]   Infected files in archives cannot be repaired!
    --> fk.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!


End of the scan: 2007年6月29日  23:59
Used time: 00:08 min

The scan has been done completely.

      0 Scanning directories
      8 Files were scanned
      5 viruses and/or unwanted programs were found
      2 classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      6 Warnings
      0 Notes
      0 Hidden objects were found

wangjay1980

detected: virus Heur.Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\&Ntilde;ù±&frac34;.rar/qj.exe//PE_Patch.UPX
detected: Trojan program Trojan-PSW.Win32.Nilage.bcw        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\&Ntilde;ù±&frac34;.rar/biz6.exe//PE_Patch//ASPack//PE_Patch.MaskPE//#
detected: virus Heur.Trojan.Generic        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\&Ntilde;ù±&frac34;.rar/fk.exe

promised

DLL无视
Demo mode
Command line options:
/r=susp.rpt /ha=3 /collect_suspects /n.../af+ /fd+ /ar+ /bt- /mr- /ml+ /rw+ /as-
Ctrl-C will terminate program execution

*:
C:\
C:\ABC\样本.rar:<RAR>\qj.exe : is suspected of Downloader.Small.160
C:\ABC\...\tfsaa.ccr : is suspected of Trojan-PSW.Game.45 (paranoid heuristics)
C:\ABC\样本.rar:<RAR>\biz6.exe : infected Trojan.PWS.Lineage
C:\ABC\...\cq.exe : is suspected of Trojan-PSW.Game.44 (paranoid heuristics)
C:\ABC\样本.rar:<RAR>\fk.exe : is suspected of Downloader.Small.19
Program execution terminated by user


Directories       : 4       Files in archives:      Files on disks:
Archives:                   - total       : 7       - total       : 19
- scanned         : 1       -  scanned    : 7       - scanned     : 18
- contain viruses : 1       -  infected   : 1       - infected    : 1
- deleted         : 0       -  suspicious : 4       - suspicious  : 0

Startup    : 15:13:30 30-06-2007
End        : 15:13:36 30-06-2007
Total time : 00:00:06
终止批处理操作吗(Y/N)?

1688388728

扫描病毒日志记录
版本 17.0.6353
双引擎反病毒签名 6/30/2007
开始时间: 6/30/2007 15:34
引擎: A 引擎 (AVK 17.5752), B 引擎 (AVKB 17.279)
高启发式: 打开
压缩文件: 打开
系统区域: 打开

扫描系统区域...
扫描所选择的目录和文件...
对象: [ASPack]
        在压缩档案里: E:\病毒库\样本\biz6.exe
        Status: 已发现病毒
        病毒: Win32:Lineage-590 [Trj] (B 引擎)
对象: biz6.exe
        路径: E:\病毒库\样本
        Status: 已发现病毒
        病毒: Win32:Lineage-590 [Trj] (B 引擎)
对象: [PECompact]
        在压缩档案里: E:\病毒库\样本\msdebug.dll
        Status: 已发现病毒
        病毒: Win32:Agent-HJW [Trj] (B 引擎)
对象: msdebug.dll
        路径: E:\病毒库\样本
        Status: 已发现病毒
        病毒: Win32:Agent-HJW [Trj] (B 引擎)
对象: [UPX]
        在压缩档案里: E:\病毒库\样本\qj.exe
        Status: 已发现病毒
        病毒: Win32:Onlinegames-ACS [Trj] (B 引擎)
对象: qj.exe
        路径: E:\病毒库\样本
        Status: 已发现病毒
        病毒: Win32:Onlinegames-ACS [Trj] (B 引擎)
对象: [PECompact]
        在压缩档案里: E:\病毒库\样本\RemoteDbg.dll
        Status: 已发现病毒
        病毒: Win32:Agent-HJW [Trj] (B 引擎)
对象: RemoteDbg.dll
        路径: E:\病毒库\样本
        Status: 已发现病毒
        病毒: Win32:Agent-HJW [Trj] (B 引擎)
对象: [Upack]
        在压缩档案里: E:\病毒库\样本\tfsaa.ccr
        Status: 已发现病毒
        病毒: Win32:OnLineGames-AIR [Trj] (B 引擎)
对象: tfsaa.ccr
        路径: E:\病毒库\样本
        Status: 已发现病毒
        病毒: Win32:OnLineGames-AIR [Trj] (B 引擎)
扫描完成: 6/30/2007 15:35
    已检查 6 个文件
    已发现 5 个染毒文件
    发现 0 个可疑文件

woai_jolin

2007/6/30 15:44:15        eAmon        file        D:\病毒上报\BIZ6.EXE        a variant of Win32/Delf.CC worm        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred during an attempt to access the file by the application: C:\Program Files\Micropoint\MPSVC2.exe.
2007/6/30 15:44:11        eAmon        file        D:\病毒上报\REMOTEDBG.DLL        a variant of Win32/Agent.NIK trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred during an attempt to access the file by the application: C:\Program Files\Micropoint\MPSVC2.exe.
2007/6/30 15:44:10        eAmon        file        D:\病毒上报\QJ.EXE        a variant of Win32/PSW.OnLineGames.RC trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred during an attempt to access the file by the application: C:\Program Files\Micropoint\MPSVC2.exe.
2007/6/30 15:44:07        eAmon        file        D:\病毒上报\MSDEBUG.DLL        a variant of Win32/Agent.NIK trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred during an attempt to access the file by the application: C:\Program Files\Micropoint\MPSVC2.exe.

欠妳緈諨

AVAST6个

蓝色牛仔裤

3个。。


[Scan path] C:\Documents and Settings\Administrator\桌面\样本
>>>C:\Documents and Settings\Administrator\桌面\样本\biz6.exe infected with Trojan.PWS.Lineage
C:\Documents and Settings\Administrator\桌面\样本\cq.exe - Ok
C:\Documents and Settings\Administrator\桌面\样本\fk.exe infected with Win32.HLLW.Autoruner.178
>C:\Documents and Settings\Administrator\桌面\样本\msdebug.dll - Ok
>C:\Documents and Settings\Administrator\桌面\样本\qj.exe infected with Trojan.PWS.Wsgame
>C:\Documents and Settings\Administrator\桌面\样本\RemoteDbg.dll - Ok
C:\Documents and Settings\Administrator\桌面\样本\tfsaa.ccr - Ok