还有

显示全部楼层 · 发表于 2007-7-6 15:42:39

三个，都是流行的MSN病毒

显示全部楼层 · 发表于 2007-7-6 15:45:44

Scan performed at: 2007-7-6 15:45:25
Scanning Log
NOD32 version 2381 (20070706) NT
Command line: C:\Documents and Settings\EQ2\桌面\00.rar
Operating memory - is OK

Date: 6.7.2007 Time: 15:45:31
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\00.rar
C:\Documents and Settings\EQ2\桌面\00.rar ?RAR ?00\myalbum2007.zip - Win32/IRCBot.XW trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\00.rar ?RAR ?00\syshosts.rar ?RAR ?syshosts.dll - a variant of Win32/IRCBot.WO trojan
C:\Documents and Settings\EQ2\桌面\00.rar ?RAR ?00\sysprinters.rar ?RAR ?sysprinters.dll - Win32/IRCBot.XW trojan - was a part of the deleted object
Number of scanned files: 4
Number of threats found: 3
Number of files cleaned: 1
Time of completion: 15:45:31 Total scanning time: 0 sec (00:00:00)

显示全部楼层 · 发表于 2007-7-6 15:49:03

c:\ABC\00.rar:\00\myalbum2007.zip\photo album-2007.scr - Signature 'Generic.Dropper.Delf' found
c:\ABC\00.rar:\00\myalbum2007.zip
c:\ABC\00.rar:\00\syshosts.rar\syshosts.dll - Signature 'Backdoor.Win32.IRCBot.aaq' found
c:\ABC\00.rar:\00\syshosts.rar
c:\ABC\00.rar:\00\sysprinters.rar\sysprinters.dll - Signature 'Backdoor.Win32.IRCBot.acd' found
c:\ABC\00.rar:\00\sysprinters.rar
c:\ABC\00.rar

7 Files scanned
(1 Archiv with 6 files)
3 Signatures found
0 Suspect code-parts found
Used time: 0:00.063

显示全部楼层 · 发表于 2007-7-6 15:53:25

显示全部楼层 · 发表于 2007-7-6 15:57:15

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\00.rar'
C:\Documents and Settings\Administrator\桌面\00.rar
  [0] Archive type: RAR
  --> 00\myalbum2007.zip
   [DETECTION] Contains signature of the worm WORM/IRCBot.ACD
   [1] Archive type: ZIP
   --> photo album-2007.scr
      [DETECTION] Contains signature of the worm WORM/IRCBot.52736.4
--> 00\syshosts.rar
   [1] Archive type: RAR
   --> syshosts.dll
      [DETECTION] Contains signature of the worm WORM/IRCBot.22016.2
--> 00\sysprinters.rar
   [1] Archive type: RAR
   --> sysprinters.dll
      [DETECTION] Contains signature of the worm WORM/IRCBot.24040
   [INFO]    The file was moved to '46bbf61c.qua'!

End of the scan: 2007年7月6日  15:57
Used time: 00:04 min

The scan has been done completely.

   0 Scanning directories
   7 Files were scanned
   4 viruses and/or unwanted programs were found
   0 classified as suspicious:
   0 files were deleted
   0 files were repaired
   1 files were moved to quarantine
   0 files were renamed

显示全部楼层 · 发表于 2007-7-6 15:57:17

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Backdoor.Win32.IRCbot.w
病毒： Worm.Mail.PhotoCheat.a(MSN相片病毒)
病毒： Backdoor.Win32.IRCbot.w

用户来源：互联网

软件版本：19.30.41

显示全部楼层 · 发表于 2007-7-6 15:59:55

myalbum2007.zip\photo album-2007.scr;D:\Documents and Settings\dell\桌面\00.rar\00\myalbum2007.zip;Trojan.MulDrop.7373;;
00\myalbum2007.zip;D:\Documents and Settings\dell\桌面\00.rar\00;Archive contains infected objects;;
syshosts.rar\syshosts.dll;D:\Documents and Settings\dell\桌面\00.rar\00\syshosts.rar;Win32.HLLW.Sodoku;;
00\syshosts.rar;D:\Documents and Settings\dell\桌面\00.rar\00;Archive contains infected objects;;
sysprinters.rar\sysprinters.dll;D:\Documents and Settings\dell\桌面\00.rar\00\sysprinters.rar;Win32.HLLW.Sodoku;;
00\sysprinters.rar;D:\Documents and Settings\dell\桌面\00.rar\00;Archive contains infected objects;;

显示全部楼层 · 发表于 2007-7-6 16:12:07

C:\Documents and Settings\uhthn\Desktop\00.rar:<RAR>\00\myalbum2007.zip:<ZIP>\photo album-2007.scr : infected Trojan.MulDrop.7373
C:\Documents and Settings\uhthn\Desktop\00.rar:<RAR>\00\syshosts.rar:<RAR>\syshosts.dll : infected Backdoor.Win32.IRCBot.aaq
C:\Documents and Settings\uhthn\Desktop\00.rar:<RAR>\00\sysprinters.rar:<RAR>\sysprinters.dll : infected Backdoor.Win32.IRCBot.acd
C:\Documents and Settings\uhthn\Desktop\00.rar : backup copy created

Directories    : 0    Files in archives:    Files on disks:
Archives:                - total    : 6    - total    : 1
- scanned       : 4    -  scanned : 6    - scanned    : 1
- contain viruses : 4    -  infected : 6    - infected : 1
- deleted       : 0    -  suspicious : 0    - suspicious  : 0
[:26:]

显示全部楼层 · 发表于 2007-7-6 16:21:47

快餐

deleted: Trojan program Backdoor.Win32.IRCBot.acd File: C:\Documents and Settings\Owner\×ÀÃæ\00.rar/00\myalbum2007.zip/photo album-2007.scr
deleted: Trojan program Backdoor.Win32.IRCBot.aaq File: C:\Documents and Settings\Owner\×ÀÃæ\00.rar/00\syshosts.rar/syshosts.dll
deleted: Trojan program Backdoor.Win32.IRCBot.acd File: C:\Documents and Settings\Owner\×ÀÃæ\00.rar/00\sysprinters.rar/sysprinters.dll

显示全部楼层 · 发表于 2007-7-6 16:44:30

已删除: 木马程序 Backdoor.Win32.IRCBot.acd 文件: C:\Documents and Settings\XinDeng\Local Settings\Application Data\Mozilla\Firefox\Profiles\lxbanyjc.default\Cache\EE8FCB5Dd01\00\myalbum2007.zip\photo album-2007.scr

[病毒样本] 还有

本帖子中包含更多资源

本帖子中包含更多资源

卡巴搞定