[MD5: E219A3 EBE3C8 3E7E2E]

显示全部楼层 · 发表于 2007-7-25 16:21:03

三个，网上的

显示全部楼层 · 发表于 2007-7-25 16:29:16

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本.rar'
C:\Documents and Settings\Administrator\桌面\
  样本.rar
[0] Archive type: RAR
--> come.exe
      [DETECTION] Is the Trojan horse TR/Hijack.Explor.3801
      [WARNING] Infected files in archives cannot be repaired!
--> go.exe
      [DETECTION] Is the Trojan horse TR/PSW.Delf.WH.2
      [WARNING] Infected files in archives cannot be repaired!
--> vip.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Age.25088.A
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    A backup was created as '46d5710a.qua'  ( QUARANTINE )
      [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-7-25 16:34:28

扫描开始时间: 2007-7-25 16:34:20
扫描日志
NOD32 版本 2418 (20070725) NT
命令行: F:\virus\样本11.rar

日期: 2007年7月25日时间: 16:34:21
反 Rookits 技术已启用。
已扫描磁盘、文件夹和文件: F:\virus\样本11.rar
F:\virus\样本11.rar ?RAR ?come.exe<病毒 - Win32/TrojanDownloader.Delf.BHO 木马变种>
F:\virus\样本11.rar ?RAR ?go.exe<病毒 - Win32/PSW.Delf.NHI 木马>
F:\virus\样本11.rar ?RAR ?vip.exe<病毒 - 可能是 Win32/Genetik 木马变种>
已扫描文件数量: 3
已发现病毒数量: 3
完成时间: 16:34:22 总共扫描时间: 1 秒 (00:00:01)

显示全部楼层 · 发表于 2007-7-25 16:49:06

金山3个
费尔2个木马,一个启发

微点:
木马名称:Trojan-Downloader.Win32.Delf.gpv

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.812\COME.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.Delf.elb

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.812\GO.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan.Win32.Genetik.aoi

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.812\VIP.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2007-7-25 16:52:08

detected: Trojan program Trojan-Downloader.Win32.Agent.bqj File: C:\Users\NFS\Documents\Downloads\Compressed\Ñù±¾.rar/come.exe//NSPack//PE_Patch.MaskPE
detected: Trojan program Trojan-PSW.Win32.Delf.wh File: C:\Users\NFS\Documents\Downloads\Compressed\Ñù±¾.rar/go.exe//PE_Patch.UPX//UPX
detected: virus Virus.Win32.AutoRun.er File: C:\Users\NFS\Documents\Downloads\Compressed\Ñù±¾.rar/vip.exe//UPX

显示全部楼层 · 发表于 2007-7-25 16:54:43

===================================================================================================
NVCOD On Demand Scanner 5.80.02

NSE revision 5.91.02
nvcbin.def revision 5.90.00 of 2007/07/24 08:21:08 (815016 variants)
nvcmacro.def revision 5.90.00 of 2007/06/29 06:32:19 (20341 variants)
Total number of variants: 835357
Command line: "@C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~OD30.tmp"
===================================================================================================

   Time  Filename                                                    Virus name
---------------------------------------------------------------------------------------------------
- Scanning files matching: F:\vv\v\vip.exe
   16 ms F:\vv\v\vip.exe                                           Trojan W32/Downloader.ASO ()
- Scanning files matching: F:\vv\v\come.exe
   16 ms F:\vv\v\come.exe                                           Trojan W32/Agent.BWZU ()
- Scanning files matching: F:\vv\v\go.exe
      0 ms F:\vv\v\go.exe                                              Trojan W32/Delf.AJHD ()
- File F:\vv\v\vip.exe quarantined.
- File F:\vv\v\vip.exe deleted.
- File F:\vv\v\come.exe quarantined.
- File F:\vv\v\come.exe deleted.
- File F:\vv\v\go.exe quarantined.
- File F:\vv\v\go.exe deleted.

===================================================================================================

The scanning started: 2007/07/25 16:54:50
            ended: 2007/07/25 16:54:50
Logged on as       : Administrator
on hostname       : 2FEA146376E2420

Scanning results:
Total number of files found..............................:    3
Number of files scanned..................................:    3
Number of files/directories skipped due to exclude list..:    0
Number of files that could not be opened.................:    0
Number of archive files unpacked.........................:    0
Number of archive files not unpacked.....................:    0
Number of infections.....................................:    3

Copyright (c) 1993-2005 Norman ASA.

显示全部楼层 · 发表于 2007-7-25 17:53:59

江民杀2个 come.exe过了

显示全部楼层 · 发表于 2007-7-25 17:58:33

avast拦截

显示全部楼层 · 发表于 2007-7-25 18:00:06

显示全部楼层 · 发表于 2007-7-25 18:34:37

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Worm.Win32.Delf.ysd
病毒： Worm.Win32.Agent.yw

MAC地址：00:D0:F8:38:4B:7A

用户来源：局域网

软件版本：19.33.22

漏掉一个上报

[病毒样本] [MD5: E219A3 EBE3C8 3E7E2E]

本帖子中包含更多资源

本帖子中包含更多资源