20ge

zane_xzz

[MD5: 1DC7D2 6A6AF8 D55A08 AE82FA AD2A34 C8246D 1DDE18 EAA71D 472C0E 976892 5CAE9C 8DACC2 0323A4 E4504A 716E9B CB816E ECD122 51D916 B4B49B 997C56]

FBAV

_____________________________________________
                                          
             风暴微塔反病毒               
                            [内测版]      
                   http://www.v0day.com/  
----------------------------------------------
开始扫描……

[C:\Documents and Settings\Administrator\桌面\virus\20Ge\19.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\20Ge\0.exe]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\20Ge\2.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\20Ge\3.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\20Ge\5.exe]
                    …………引擎[2]发现病毒:Win32.NkHack.FSG.A
[C:\Documents and Settings\Administrator\桌面\virus\20Ge\6.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\20Ge\8.exe]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\20Ge\8.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\20Ge\9.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\20Ge\10.exe]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\20Ge\10.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\20Ge\11.exe]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\20Ge\11.exe]
                    …………引擎[2]发现病毒:Win32.NkHack.FSG.A
[C:\Documents and Settings\Administrator\桌面\virus\20Ge\12.exe]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\20Ge\12.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\20Ge\14.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\20Ge\17.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\20Ge\18.exe]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\20Ge\18.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
OK  扫描完毕！

[ 本帖最后由 FBAV 于 2007-8-10 14:09 编辑 ]

微点卫士

微点：
木马名称:Trojan.Win32.Agent.gwo
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\13.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Downloader.Win32.Small.khz
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\16.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.OnLineGames.hxw
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\18.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\0.EXE
由
C:\AUTORUN.INF
自启动运行!
并生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\NEWTEMP.BAK
2) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\NEWTEMP.DLL
3) C:\PEGEFILE.PIF
4) C:\AUTORUN.INF
以及可由此INF文件引导自启的文件:
C:\PEGEFILE.PIF
是否删除木马程序及其衍生物?
木马名称:Trojan-PSW.Win32.WOW.aum
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\WOSO0.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\WOSO.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\2.EXE
1) C:\DELETEFILEDOS.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\2.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\3.EXE
1) C:\DELETEFILEDOS.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\3.EXE
是否删除木马程序及其衍生物?
木马名称:Trojan-PSW.Win32.OnLineGames.hyn
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RXSO0.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\4.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RXSO.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\5.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\WINSRVGUNKVS.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\6.EXE
1) C:\DELETEFILEDOS.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\6.EXE
是否删除木马程序及其衍生物?
木马名称:Trojan-PSW.Win32.OnLineGames.hyw
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TLSO0.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\7.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TLSO.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\8.EXE
1) C:\DELETEFILEDOS.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\8.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\9.EXE
1) C:\DELETEFILEDOS.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\9.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\10.EXE
1) C:\DELETEFILEDOS.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\10.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\11.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\SYSWIN64.JMP
2) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\WINSYS64.SYS
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\12.EXE
1) C:\DELETEFILEDOS.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\12.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\14.EXE
1) C:\DELETEFILEDOS.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\14.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\19.EXE
1) C:\DELETEFILEDOS.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\19.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\15.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\17.EXE
1) C:\DELETEFILEDOS.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\17.EXE
是否删除木马程序及其衍生物?


微点全杀，呼，点的我累死

yurius

[Scan path] C:\virus\桌面.rar
>>C:\virus\桌面.rar\19.exe infected with Trojan.PWS.Gamania.3090
>>C:\virus\桌面.rar\0.exe infected with Win32.HLLW.Autoruner.249
>>C:\virus\桌面.rar\1.exe infected with Trojan.PWS.Wsgame
>>>C:\virus\桌面.rar\2.exe infected with Trojan.PWS.Wsgame.1063
>>>>>C:\virus\桌面.rar\3.exe - Ok
>>>>>C:\virus\桌面.rar\4.exe infected with Trojan.PWS.Wsgame
>>>>>>C:\virus\桌面.rar\5.exe probably infected with DLOADER.Trojan
>>>>>>>>C:\virus\桌面.rar\6.exe - Ok
>>>>>>>>C:\virus\桌面.rar\7.exe infected with Trojan.PWS.Wsgame
>>>>>>>>>>C:\virus\桌面.rar\8.exe - Ok
>>>>>>>>>>>>C:\virus\桌面.rar\9.exe - Ok
>>>>>>>>>>>>>>C:\virus\桌面.rar\10.exe - Ok
>>>>>>>>>>>>>>>C:\virus\桌面.rar\11.exe infected with Trojan.PWS.Qqpass.1201
>>>>>>>>>>>>>>>>>C:\virus\桌面.rar\12.exe infected with Trojan.PWS.Gamania.3239
>>>>>>>>>>>>>>>>>>C:\virus\桌面.rar\13.exe\data001 infected with Trojan.Starter.221
>>>>>>>>>>>>>>>>>>>C:\virus\桌面.rar\13.exe\data002 - Ok
>>>>>>>>>>>>>>>>>>>>C:\virus\桌面.rar\13.exe\data003 - Ok
>>>>>>>>>>>>>>>>>>>>>C:\virus\桌面.rar\13.exe\data004 - Ok
>>>>>>>>>>>>>>>>>>>>>C:\virus\桌面.rar\13.exe\data005 infected with Trojan.Sniff
>>>>>>>>>>>>>>>>>>>>>C:\virus\桌面.rar\13.exe\data006 - Ok
>C:\virus\桌面.rar\13.exe - archive contains infected objects
>>>C:\virus\桌面.rar\14.exe - Ok
>>>>C:\virus\桌面.rar\15.exe infected with Trojan.PWS.Legmir.1188
>>>>>C:\virus\桌面.rar\16.exe infected with BackDoor.Twin
>>>>>>>C:\virus\桌面.rar\17.exe - Ok
>>>>>>>>C:\virus\桌面.rar\18.exe infected with Trojan.DownLoader.29402
C:\virus\桌面.rar - archive contains infected objects
C:\virus\桌面.rar:Zone.Identifier - Ok

sb

金山发现18个

残缺的唯美

--> 19.exe
        [DETECTION] Is the Trojan horse TR/Spy.Delf.UV.34
        [WARNING]   Infected files in archives cannot be repaired!
    --> 0.exe
        [DETECTION] Is the Trojan horse TR/PSW.Delf.WH.2
        [WARNING]   Infected files in archives cannot be repaired!
    --> 1.exe
        [DETECTION] Is the Trojan horse TR/Spy.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 2.exe
        [DETECTION] Is the Trojan horse TR/Agent.ABIO.8
        [WARNING]   Infected files in archives cannot be repaired!
    --> 3.exe
        [DETECTION] Is the Trojan horse TR/Agent.ABIO.24
        [WARNING]   Infected files in archives cannot be repaired!
    --> 4.exe
        [DETECTION] Is the Trojan horse TR/Spy.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 5.exe
        [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 6.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> 7.exe
        [DETECTION] Is the Trojan horse TR/Spy.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 8.exe
        [DETECTION] Is the Trojan horse TR/Agent.ABIO.30
        [WARNING]   Infected files in archives cannot be repaired!
    --> 9.exe
        [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 10.exe
        [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 11.exe
        [DETECTION] Is the Trojan horse TR/PSW.Steal.48274
        [WARNING]   Infected files in archives cannot be repaired!
    --> 12.exe
        [DETECTION] Is the Trojan horse TR/Agent.ABIO.21
        [WARNING]   Infected files in archives cannot be repaired!
    --> 13.exe
        [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.2
        [WARNING]   Infected files in archives cannot be repaired!
    --> 14.exe
        [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 15.exe
        [DETECTION] Contains signature of the dropper DR/Delphi.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 16.exe
        [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 17.exe
        [DETECTION] Is the Trojan horse TR/Agent.ABIO.37
        [WARNING]   Infected files in archives cannot be repaired!
    --> 18.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.UO.60
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      A backup was created as '46ef02e2.qua'  ( QUARANTINE )
        [INFO]      The file was deleted!

电影结束了

Scan performed at: 2007-8-10 15:01:48
Scanning Log
NOD32 version 2448 (20070809) NT
Command line: C:\Documents and Settings\wangcheng\桌面\桌面.rar
C:\Program Files\Eset\nod32.exe - is OK

Date: 10.8.2007  Time: 15:01:49
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\wangcheng\桌面\桌面.rar
C:\Documents and Settings\wangcheng\桌面\桌面.rar ?RAR ?19.exe - a variant of Win32/PSW.OnLineGames.NDA trojan
C:\Documents and Settings\wangcheng\桌面\桌面.rar ?RAR ?0.exe - Win32/PSW.Delf.NHI trojan
C:\Documents and Settings\wangcheng\桌面\桌面.rar ?RAR ?1.exe - Win32/PSW.Agent.NDP trojan
C:\Documents and Settings\wangcheng\桌面\桌面.rar ?RAR ?2.exe - a variant of Win32/PSW.OnLineGames.NDA trojan
C:\Documents and Settings\wangcheng\桌面\桌面.rar ?RAR ?3.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\wangcheng\桌面\桌面.rar ?RAR ?4.exe - probably a variant of Win32/PSW.Agent.NDP trojan
C:\Documents and Settings\wangcheng\桌面\桌面.rar ?RAR ?5.exe ?FSG v2.0 - is OK
C:\Documents and Settings\wangcheng\桌面\桌面.rar ?RAR ?6.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\wangcheng\桌面\桌面.rar ?RAR ?7.exe - Win32/PSW.Agent.NDP trojan
C:\Documents and Settings\wangcheng\桌面\桌面.rar ?RAR ?8.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\wangcheng\桌面\桌面.rar ?RAR ?9.exe - probably a variant of Win32/PSW.OnLineGames.NDA trojan
C:\Documents and Settings\wangcheng\桌面\桌面.rar ?RAR ?10.exe - probably a variant of Win32/PSW.OnLineGames.NDA trojan
C:\Documents and Settings\wangcheng\桌面\桌面.rar ?RAR ?11.exe - a variant of Win32/AutoRun.Q worm
C:\Documents and Settings\wangcheng\桌面\桌面.rar ?RAR ?12.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\wangcheng\桌面\桌面.rar ?RAR ?13.exe - is OK
C:\Documents and Settings\wangcheng\桌面\桌面.rar ?RAR ?14.exe - probably a variant of Win32/PSW.OnLineGames.NDA trojan
C:\Documents and Settings\wangcheng\桌面\桌面.rar ?RAR ?15.exe - a variant of Win32/PSW.Legendmir.NEP trojan
C:\Documents and Settings\wangcheng\桌面\桌面.rar ?RAR ?16.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\wangcheng\桌面\桌面.rar ?RAR ?17.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\wangcheng\桌面\桌面.rar ?RAR ?18.exe - Win32/PSW.OnLineGames.NDA trojan
C:\Documents and Settings\wangcheng\桌面\桌面.rar:Zone.Identifier - is OK
Number of scanned files: 22
Number of threats found: 18
Number of active threats: 1
Time of completion: 15:01:57 Total scanning time: 8 sec (00:00:08)

Notes:
[7] File is probably infected with an unknown virus.



运行１３．ＥＸＥ
ＮＯＤ３２杀     　共杀了１９个           加几个生成物．．．．．．．

[ 本帖最后由 电影结束了 于 2007-8-10 15:16 编辑 ]

uhthn2002

C:\Documents and Settings\uhthn\Desktop\dt.rar:<RAR>\19.exe : infected Trojan-Spy.Win32.Delf.uv
C:\Documents and Settings\uhthn\Desktop\dt.rar:<RAR>\0.exe : infected Trojan-PSW.Win32.Delf.wh
C:\Documents and Settings\uhthn\Desktop\dt.rar:<RAR>\1.exe : infected MalwareScope.Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\dt.rar:<RAR>\2.exe : infected Trojan-Spy.Win32.Delf.uv
C:\Documents and Settings\uhthn\Desktop\dt.rar:<RAR>\4.exe : infected MalwareScope.Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\dt.rar:<RAR>\5.exe : infected MalwareScope.Trojan-PSW.Game.7
C:\Documents and Settings\uhthn\Desktop\dt.rar:<RAR>\7.exe : infected MalwareScope.Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\dt.rar:<RAR>\11.exe : infected MalwareScope.Trojan-PSW.Game.7
C:\Documents and Settings\uhthn\Desktop\dt.rar:<RAR>\13.exe : infected Trojan.Win32.Agent.ata
C:\Documents and Settings\uhthn\Desktop\dt.rar:<RAR>\15.exe : infected Trojan-PSW.Win32.OnLineGames.adn
C:\Documents and Settings\uhthn\Desktop\dt.rar:<RAR>\16.exe : infected Trojan-Downloader.Win32.Small.czl
C:\Documents and Settings\uhthn\Desktop\dt.rar:<RAR>\18.exe : infected Trojan-PSW.Win32.OnLineGames.uo


Directories       : 0       Files in archives:      Files on disks:
Archives:                   - total       : 20      - total       : 1     
- scanned         : 1       -  scanned    : 20      - scanned     : 1     
- contain viruses : 1       -  infected   : 12      - infected    : 1     
- deleted         : 0       -  suspicious : 0       - suspicious  : 0

zzm3145

zzm3145