KABA

显示全部楼层 · 发表于 2007-7-8 11:24:32

密码:123

显示全部楼层 · 发表于 2007-7-8 11:29:11

c:\ABC\新建文件夹_(2)\2852F67C.EXE - Signature 'Trojan-PWS.Win32.Agent.BU' found
c:\ABC\新建文件夹_(2)\cmdbcs.exe - Signature 'Trojan-PWS.Win32.OnLineGames.es' found
c:\ABC\新建文件夹_(2)\nwizzhuxians.exe - Signature 'Trojan-Downloader.Win32.Zlob.and' found

3 Files scanned
(0 Archives with 0 files)
3 Signatures found
0 Suspect code-parts found
Used time: 0:00.047

显示全部楼层 · 发表于 2007-7-8 11:29:12

Exported events:

2007-7-8 11:26 [Guard] Malware found
   Virus or unwanted program 'HEUR/Crypted [HEUR/Crypted]'
   detected in file 'C:\Documents and
   Settings\Administrator\桌面\新建文件夹_(2)\2852F67C.EXE.
   Action performed: Delete file

2007-7-8 11:26 [Guard] Malware found
   Virus or unwanted program 'TR/PSW.Agent.20480 [TR/PSW.Agent.20480]'
   detected in file 'C:\Documents and
   Settings\Administrator\桌面\新建文件夹_(2)\cmdbcs.exe.
   Action performed: Delete file

2007-7-8 11:26 [Guard] Malware found
   Virus or unwanted program 'TR/PSW.OnLineGam.QW [TR/PSW.OnLineGam.QW]'
   detected in file 'C:\Documents and
   Settings\Administrator\桌面\新建文件夹_(2)\nwizzhuxians.exe.
   Action performed: Delete file

显示全部楼层 · 发表于 2007-7-8 11:29:52

[Scan path] C:\Documents and Settings\Administrator\桌面\新建文件夹_(2)\2852F67C.EXE
C:\Documents and Settings\Administrator\桌面\新建文件夹_(2)\2852F67C.EXE infected with BackDoor.QQChin

[Scan path] C:\Documents and Settings\Administrator\桌面\新建文件夹_(2)\cmdbcs.exe
>C:\Documents and Settings\Administrator\桌面\新建文件夹_(2)\cmdbcs.exe infected with Trojan.PWS.Wsgame

[Scan path] C:\Documents and Settings\Administrator\桌面\新建文件夹_(2)\nwizzhuxians.exe
>C:\Documents and Settings\Administrator\桌面\新建文件夹_(2)\nwizzhuxians.exe infected with Trojan.PWS.Wsgame

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 5
Infected objects found: 3
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 53 Kb/s
Scan time: 00:00:00

显示全部楼层 · 发表于 2007-7-8 11:32:06

费尔启发3个。

显示全部楼层 · 发表于 2007-7-8 12:03:38

[:27:] AVAST! Win32:Onlinegames-AEA [Trj]

显示全部楼层 · 发表于 2007-7-8 12:17:36

病毒: Trojan-PSW.Win32.OnLineGames.es
文件: cmdbcs.exe
目录: E:\病毒库\新建文件夹_(2)
进程: WinRAR.exe
病毒: Win32:Onlinegames-ACS [Trj]
文件: nwizzhuxians.exe
目录: E:\病毒库\新建文件夹_(2)
病毒: Win32:Agent-HFX [Trj]
文件: 2852F67C.EXE
目录: E:\病毒库\新建文件夹_(2)

显示全部楼层 · 发表于 2007-7-8 12:28:02

RS挂

显示全部楼层 · 发表于 2007-7-8 12:45:05

扫描进行于：2007/7/8 12:36:03
扫描日志
NOD32版本 2384 (20070708) NT
命令行： D:\病毒上报
C:\Program Files\Eset\nod32.exe - 是正常的
1 的MBR区.物理磁盘 - 是正常的
1 的启动引导区.物理磁盘 - 是正常的

日期： 8.7.2007 时间：12:36:05
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：D:\病毒上报\
D:\病毒上报\1.rar >>RAR >>1.exe - 错误的文件检查值(CRC)，此文件可能已被密码保护.
D:\病毒上报\2852F67C.EXE - 可能是 Win32/Agent.NEO 木马的一个变种
D:\病毒上报\cmdbcs.exe - Win32/PSW.OnLineGames.YA 木马的变种
D:\病毒上报\nwizzhuxians.exe - Win32/PSW.Agent.NEW 木马的变种
D:\病毒上报\promote.rar >>RAR >>promote.dll - 错误的文件检查值(CRC)，此文件可能已被密码保护.
已扫描的文件数目：3
已发现的病毒数目：3
完成时间： 12:36:05 总扫描时间：0 秒 (00:00:00)

显示全部楼层 · 发表于 2007-7-8 15:17:43

cmdbcs.exe
   [DETECTION] Is the Trojan horse TR/PSW.Agent.20480

2852F67C.EXE
   [DETECTION] Contains suspicious code HEUR/Crypted

nwizzhuxians.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnLineGam.QW

[病毒样本] KABA

本帖子中包含更多资源