在同事的电脑上抓的一包15个

promised

c:\ABC\样本\1.exe - Signature 'Backdoor.Win32.Hupigon.dkl' found
c:\ABC\样本\12.exe - Signature 'Trojan-Spy.Win32.Delf.ps' found
c:\ABC\样本\14.exe - Signature 'Backdoor.Win32.Agent.ahj' found
c:\ABC\样本\15.exe - Signature 'Trojan-PWS.OnlineGames.TH' found
c:\ABC\样本\autorun.inf
c:\ABC\样本\ChCfg.exe
c:\ABC\样本\cid_store.dat
c:\ABC\样本\hsomklg.exe - Signature 'Worm.Win32.Delf.ce' found
c:\ABC\样本\Kvsc3.exe - Signature 'Trojan-PWS.Win32.OnLineGames.es' found
c:\ABC\样本\MsIMMs32.exe - Signature 'Trojan-PWS.Win32.OnLineGames.es' found
c:\ABC\样本\TIMHost.exe - Signature 'Trojan-PWS.WSGame.AV' found
c:\ABC\样本\uha.exe - Signature 'Trojan.BAT.Teldoor.b' found
c:\ABC\样本\upxdnd.exe - Signature 'Trojan-PWS.WSGame.AV' found
c:\ABC\样本\WinRAR.exe - Signature 'Trojan-PWS.OnlineGames.TH' found
c:\ABC\样本\wpa.dbl

        15 Files scanned
          (0 Archives with 0 files)
        11 Signatures found
        0 Suspect code-parts found
        Used time: 0:00.688

The EQs

ikarus果然不是盖的

风雪

费尔6个其中一个启发。

promised

ChCfg.exe运行后自动退出，死尸
EXE全了

The EQs

偶还见到过inf报qqpass的。。。

wangjay1980

好在IK这种杀软没什么人用，否则一定。。。

tracydk

Starting the file scan:

Begin scan in 'F:\病毒样本\样本.part1.rar'
F:\病毒样本\样本.part1.rar
  [0] Archive type: RAR
  --> 1.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> 12.exe
      [DETECTION] Is the Trojan horse TR/Drop.Age.32873.C
  --> 14.exe
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Agent.YPT.1 Backdoor server programs
  --> 15.exe
      [DETECTION] Is the Trojan horse TR/Spy.Viking.Gen
  --> hsomklg.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Sma.dat.4.B
  --> Kvsc3.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGame.YF
  --> MsIMMs32.exe
      [DETECTION] Is the Trojan horse TR/PSW.Agent.20480
  --> TIMHost.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGame.YF
  --> upxdnd.exe
      [DETECTION] Is the Trojan horse TR/PSW.Agent.20480
      [INFO]      The file was deleted!
Begin scan in 'F:\病毒样本\样本.part2.rar'


End of the scan: 2007年7月9日  20:54
Used time: 00:12 min

The scan has been done completely.

      0 Scanning directories
     18 Files were scanned
      9 viruses and/or unwanted programs were found
      1 classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      8 Files not concerned
      2 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

欠妳緈諨

woai_jolin

2007/7/9 21:10:11        eAmon        file        D:\病毒上报\WinRAR.exe        probably a variant of Win32/Pacex.Gen virus        deleted - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/7/9 21:10:09        eAmon        file        D:\病毒上报\upxdnd.exe        a variant of Win32/PSW.OnLineGames.YA trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/7/9 21:10:08        eAmon        file        D:\病毒上报\TIMHost.exe        a variant of Win32/PSW.OnLineGames.YA trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/7/9 21:10:07        eAmon        file        D:\病毒上报\MsIMMs32.exe        a variant of Win32/PSW.OnLineGames.YA trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/7/9 21:10:07        eAmon        file        D:\病毒上报\Kvsc3.exe        a variant of Win32/PSW.OnLineGames.YA trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/7/9 21:10:06        eAmon        file        D:\病毒上报\hsomklg.exe        a variant of Win32/Delf.NDF worm        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/7/9 21:10:04        eAmon        file        D:\病毒上报\15.exe        probably a variant of Win32/Pacex.Gen virus        deleted - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/7/9 21:10:02        eAmon        file        D:\病毒上报\14.exe        probably unknown NewHeur_PE virus        deleted - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.

1688388728

反病毒专家 AntiVirusKit 2007 扫描病毒日志记录
版本
双引擎反病毒签名 7/9/2007
开始时间: 7/9/2007 21:38
引擎: KAV 引擎 (AVK 17.5971), AVST 引擎 (AVKB 17.291)
高启发式: 打开
压缩文件: 打开
系统区域: 打开

扫描系统区域...
扫描所选择的目录和文件...
对象: 1.exe
        路径: E:\病毒库\样本[1]
狀態: 无法清除病毒
        病毒: Win32:Pakes-QQ [Trj] (AVST 引擎)
对象: 12.exe
        路径: E:\病毒库\样本[1]
狀態: 无法清除病毒
        病毒: Trojan-PSW.Win32.Delf.wo (KAV 引擎)
对象: 14.exe
        路径: E:\病毒库\样本[1]
狀態: 无法清除病毒
        病毒: Backdoor.Win32.Delf.awy (KAV 引擎), Win32:Delf-DXA [Trj] (AVST 引擎)
对象: hsomklg.exe
        路径: E:\病毒库\样本[1]
狀態: 无法清除病毒
        病毒: Trojan-Downloader.Win32.Agent.bpp (KAV 引擎), Win32:Delf-ERE [Wrm] (AVST 引擎)
对象: Kvsc3.exe
        路径: E:\病毒库\样本[1]
狀態: 无法清除病毒
        病毒: Trojan-PSW.Win32.OnLineGames.rt (KAV 引擎), Win32:Onlinegames-ACD [Trj] (AVST 引擎)
对象: MsIMMs32.exe
        路径: E:\病毒库\样本[1]
狀態: 无法清除病毒
        病毒: Trojan-PSW.Win32.OnLineGames.aaw (KAV 引擎), Win32:Onlinegames-ACD [Trj] (AVST 引擎)
对象: TIMHost.exe
        路径: E:\病毒库\样本[1]
狀態: 无法清除病毒
        病毒: Trojan-PSW.Win32.OnLineGames.yn (KAV 引擎), Win32:Onlinegames-ACD [Trj] (AVST 引擎)
对象: upxdnd.exe
        路径: E:\病毒库\样本[1]
狀態: 无法清除病毒
        病毒: Trojan-PSW.Win32.OnLineGames.rt (KAV 引擎), Win32:Onlinegames-ACD [Trj] (AVST 引擎)
扫描完成: 7/9/2007 21:38
    已检查 15 个文件
    已发现 8 个染毒文件