3个[MD5: 42845D 468E3A F4B9AE]

xxwpk007

已检测到: 木马程序 Trojan.Win32.Agent.ata        URL: http://bbs.kafan.cn/attachment.php?aid=104438//16.exe

woai_jolin

===================================================================================================
NVCOD On Demand Scanner 5.80.02

NSE revision 5.91.02
nvcbin.def revision 5.90.00 of 2007/07/24 08:21:08 (815016 variants)
nvcmacro.def revision 5.90.00 of 2007/06/29 06:32:19 (20341 variants)
Total number of variants: 835357
Command line: "@C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~OD25.tmp"
===================================================================================================

       Time  Filename                                                     Virus name
---------------------------------------------------------------------------------------------------
- Scanning files in the directory: F:\vv\v\
     1157 ms F:\vv\v\16.exe                                               Virus W32/Delf.AHOA.dropper ( [ General information ]
    * **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
    * Accesses executable file from resource section.
    * Creating several executable files on hard-drive.
    * File length:       218400 bytes.

[ Changes to filesystem ]
    * Creates file C:\WINDOWS\SYSTEM32\wuclmi.exe.
    * Creates file C:\WINDOWS\SYSTEM32\sevices.exe.
    * Deletes file C:\WINDOWS\SYSTEM32\wuclmi.exe.
    * Creates file C:\WINDOWS\SYSTEM32\drivers\sfdisk.sys.
    * Creates file C:\WINDOWS\SYSTEM32\drivers\npf.sys.
    * Deletes file C:\WINDOWS\SYSTEM32\drivers\sfdisk.sys.
    * Creates file C:\WINDOWS\SYSTEM32\Packet1.dll.
    * Creates file C:\WINDOWS\SYSTEM32\Packet.dll.
    * Deletes file C:\WINDOWS\SYSTEM32\Packet1.dll.
    * Creates file C:\WINDOWS\SYSTEM32\WanPacket1.dll.

[ Signature Scanning ]
    * C:\WINDOWS\SYSTEM32\sevices.exe (32768 bytes) : W32/Delf.AHOA.

)
        0 ms F:\vv\v\17.exe                                               Security Risk W32/Suspicious_U.gen ()
        0 ms F:\vv\v\18.exe                                               Security Risk W32/Suspicious_U.gen ()
- File F:\vv\v\16.exe quarantined.
- File F:\vv\v\16.exe deleted.
- File F:\vv\v\17.exe quarantined.
- File F:\vv\v\17.exe deleted.
- File F:\vv\v\18.exe quarantined.
- File F:\vv\v\18.exe deleted.

===================================================================================================

The scanning started: 2007/07/25 16:42:33
               ended: 2007/07/25 16:42:34
Logged on as        : Administrator
on hostname         : 2FEA146376E2420

Scanning results:
   Total number of files found..............................:       3
   Number of files scanned..................................:       3
   Number of files/directories skipped due to exclude list..:       0
   Number of files that could not be opened.................:       0
   Number of archive files unpacked.........................:       0
   Number of archive files not unpacked.....................:       0
   Number of infections.....................................:       3

Copyright (c) 1993-2005 Norman ASA.