下载回来的东西[MD5: 472036 5FC6DC DAA0E1]

promised

[ 本帖最后由 promised 于 2007-7-16 15:33 编辑 ]

红心王子

C:\Documents and Settings\Administrator\桌面\viru
s.zip>>virus/ser.exe>>upx_c       Trojan.PSW.QQPass.tlc

woai_jolin

===================================================================================================
NVCOD On Demand Scanner 5.80.02

NSE revision 5.91.02
nvcbin.def revision 5.90.00 of 2007/07/13 18:54:26 (807131 variants)
nvcmacro.def revision 5.90.00 of 2007/06/29 06:32:19 (20341 variants)
Total number of variants: 827472
Command line: "@C:\Users\Jason\AppData\Local\Temp\~OD7F13.tmp"
===================================================================================================

       Time  Filename                                                     Virus name
---------------------------------------------------------------------------------------------------
- Scanning files matching: D:\virus\virus.zip
       47 ms D:\virus\virus.zip : virus/ser.exe                           Trojan W32/Malware.UMI ()
     3359 ms D:\virus\virus.zip : virus/swe.exe                          
      344 ms D:\virus\virus.zip : virus/wdfmgr32.exe                     
        0 ms D:\virus\virus.zip                                          
        0 ms D:\virus\virus.zip:Zone.Identifier                          
- File D:\virus\virus.zip quarantined.

===================================================================================================

The scanning started: 2007/07/16 15:18:46
               ended: 2007/07/16 15:18:52
Logged on as        : Jason
on hostname         : JASON-PC

Scanning results:
   Total number of files found..............................:       5
   Number of files scanned..................................:       5
   Number of files/directories skipped due to exclude list..:       0
   Number of files that could not be opened.................:       0
   Number of archive files unpacked.........................:       1
   Number of archive files not unpacked.....................:       0
   Number of infections.....................................:       1

Copyright (c) 1993-2005 Norman ASA.

1688388728

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\I0GU558Q\virus[1].zip\virus/ser.exe - infected with Trojan.PWS.Gamania.2870
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\I0GU558Q\virus[1].zip\virus/wdfmgr32.exe - infected with Trojan.DownLoader.15732
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\I0GU558Q\virus[1].zip\vv[1].exe - infected with Trojan.PWS.Gamania.2870

Archive contains 3 infected items

蓝色牛仔裤

有漏网之鱼。。。

[Scan path] C:\Documents and Settings\Administrator\桌面\virus.zip
>>C:\Documents and Settings\Administrator\桌面\virus.zip\virus/ser.exe infected with Trojan.PWS.Gamania.2870
>C:\Documents and Settings\Administrator\桌面\virus.zip\virus/swe.exe - Ok
>>>C:\Documents and Settings\Administrator\桌面\virus.zip\virus/wdfmgr32.exe infected with Trojan.DownLoader.15732
>>C:\Documents and Settings\Administrator\桌面\virus.zip\vv[1].exe infected with Trojan.PWS.Gamania.2870
C:\Documents and Settings\Administrator\桌面\virus.zip - archive contains infected objects

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 6
Infected objects found: 3
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 752 Kb/s
Scan time: 00:00:00

wangjay1980

detected: Trojan program Trojan-PSW.Win32.WOW.qz        File: C:\Documents and Settings\Owner\×ÀÃæ\virus.zip/virus/ser.exe//UPX
detected: Trojan program Trojan-Downloader.Win32.Cryptic.gen        File: C:\Documents and Settings\Owner\×ÀÃæ\virus.zip/virus/wdfmgr32.exe

promised

原来漏了那个鸽子

秋叶濛濛

扫描进行于：2007-7-16 16:10:21
扫描日志
NOD32版本 2399 (20070714) NT

日期： 16.7.2007  时间：16:10:34
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\Administrator\桌面\virus.zip
C:\Documents and Settings\Administrator\桌面\virus.zip >>ZIP >>virus/ser.exe - 可能是 Win32/PSW.QQShou 木马 的一个变种
C:\Documents and Settings\Administrator\桌面\virus.zip >>ZIP >>virus/wdfmgr32.exe - Win32/TrojanDownloader.VB.APY 木马的变种
已扫描的文件数目：3
已发现的病毒数目：2
完成时间： 16:10:38 总扫描时间：4 秒 (00:00:04)

秋叶濛濛

Antivirus Version Last Update Result
AhnLab-V3 2007.7.14.0 2007.07.16 no virus found
AntiVir 7.4.0.42 2007.07.16 TR/PSW.52403
Authentium 4.93.8 2007.07.13 W32/Downloader.gen10
Avast 4.7.997.0 2007.07.16 Win32:QQpass-JH
AVG 7.5.0.476 2007.07.15 PSW.Generic4.LLO
BitDefender 7.2 2007.07.16 Trojan.PWS.WOW.QZ
CAT-QuickHeal 9.00 2007.07.14 (Suspicious) - DNAScan
ClamAV devel-20070416 2007.07.16 Trojan.Spy-1478
DrWeb 4.33 2007.07.16 Trojan.PWS.Gamania
eSafe 7.0.15.0 2007.07.10 suspicious Trojan/Worm
eTrust-Vet 30.8.3787 2007.07.16 Win32/Dowque!generic
Ewido 4.0 2007.07.14 Trojan.WOW.qz
FileAdvisor 1 2007.07.16 no virus found
Fortinet 2.91.0.0 2007.07.16 W32/QQPass.B!tr.pws
F-Prot 4.3.2.48 2007.07.13 W32/PWStealer.GQN
Ikarus T3.1.1.8 2007.07.16 Trojan-PWS.Win32.Nilage.bga
Kaspersky 4.0.2.24 2007.07.16 Trojan-PSW.Win32.WOW.qz
McAfee 5074 2007.07.13 PWS-QQPass
Microsoft 1.2704 2007.07.16 TrojanDropper:Win32/Dowque.A
NOD32v2 2399 2007.07.14 probably a variant of Win32/PSW.QQShou
Norman 5.80.02 2007.07.13 W32/Malware.UMI
Panda 9.0.0.4 2007.07.15 Suspicious file
Sophos 4.19.0 2007.07.16 Mal/QQPass-B
Sunbelt 2.2.907.0 2007.07.14 VIPRE.Suspicious
Symantec 10 2007.07.16 Trojan.PWS.QQPass
TheHacker 6.1.6.146 2007.07.13 Trojan/PSW.WOW.qz
VBA32 3.12.0.2 2007.07.16 Trojan.PWS.Gamania
VirusBuster 4.3.23:9 2007.07.15 Trojan.QQPass.Gen.6
Webwasher-Gateway 6.0.1 2007.07.16 Trojan.PSW.52403
Aditional information
File size: 719882 bytes
MD5: 13b573e10610810a4950309d8dab8de7
SHA1: b820db28284f112f44bab18caa2917578d58dd67
packers: Aspack
Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics.

tracydk

Starting the file scan:

Begin scan in 'F:\病毒样本\virus.zip'
F:\病毒样本\virus.zip
  [0] Archive type: ZIP
  --> virus/ser.exe
      [DETECTION] Is the Trojan horse TR/PSW.52403
  --> virus/swe.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> virus/wdfmgr32.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [INFO]      The file was deleted!