[699435 E3D5DC 4ACF84 E581CE 16D37A]一包DLL

显示全部楼层 · 发表于 2007-8-10 16:24:12

用AntiVirusKit扫描病毒
版本 16.0.7
病毒库签名 2007-8-8
开始时间: 2007-8-10 16:22
引擎: KAV 引擎 (AVK 17.6704), BD  引擎 (BD 17.4625)
启发式: 打开
压缩文件: 打开
系统区域: 打开

扫描系统区域...
扫描所选择的目录和文件...
对象: dhcpri.dll
在压缩档案里: C:\Documents and Settings\Administrator\桌面\dll.rar
Status: 已发现病毒
病毒: Trojan-Downloader.Win32.Small.exh (KAV 引擎), Trojan.Downloader.Agent.YJA (BD  引擎)
对象: mydpri.dll
在压缩档案里: C:\Documents and Settings\Administrator\桌面\dll.rar
Status: 已发现病毒
病毒: Trojan-Spy.Win32.Delf.uv (KAV 引擎), DeepScan:Generic.Dld.Agent.8DEDDC08 (BD  引擎)
对象: jzgpri.dll
在压缩档案里: C:\Documents and Settings\Administrator\桌面\dll.rar
Status: 已发现病毒
病毒: Trojan.Downloader.Agent.YJA (BD  引擎)
对象: qhcpri.dll
在压缩档案里: C:\Documents and Settings\Administrator\桌面\dll.rar
Status: 已发现病毒
病毒: DeepScan:Generic.Dld.Agent.C9DCFF68 (BD  引擎)
对象: xyhpri.dll
在压缩档案里: C:\Documents and Settings\Administrator\桌面\dll.rar
Status: 已发现病毒
病毒: DeepScan:Generic.Dld.Agent.1BBFBAEE (BD  引擎)
对象: dll.rar
路径: C:\Documents and Settings\Administrator\桌面
Status: 病毒文件已删除
病毒: Trojan-Downloader.Win32.Small.exh, Trojan-Spy.Win32.Delf.uv (KAV 引擎), Trojan.Downloader.Agent.YJA (2x), DeepScan:Generic.Dld.Agent.8DEDDC08, DeepScan:Generic.Dld.Agent.C9DCFF68, DeepScan:Generic.Dld.Agent.1BBFBAEE (BD  引擎)
分析完毕: 2007-8-10 16:22
已检查 1 个文件
已发现 1 个染毒文件
发现 0 个可疑文件

显示全部楼层 · 发表于 2007-8-10 16:24:54

--> dhcpri.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Small.exh.7
      [WARNING] Infected files in archives cannot be repaired!
--> jzgpri.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.16424.1
      [WARNING] Infected files in archives cannot be repaired!
--> mydpri.dll
      [DETECTION] Is the Trojan horse TR/Spy.Delf.UV.41
      [WARNING] Infected files in archives cannot be repaired!
--> qhcpri.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
--> xyhpri.dll
      [DETECTION] Is the Trojan horse TR/Agent.16436
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    A backup was created as '47282122.qua'  ( QUARANTINE )
      [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-8-10 16:28:52

Scan performed at: 2007/08/10 16:27:27
Scanning Log
NOD32 version 2448 (20070809) NT
Command line: C:\Documents and Settings\Administrator\桌面\dll.rar

Date: 10.8.2007 Time: 16:27:29
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Administrator\桌面\dll.rar
C:\Documents and Settings\Administrator\桌面\dll.rar ?RAR ?dhcpri.dll - a variant of Win32/PSW.OnLineGames.NDA trojan
C:\Documents and Settings\Administrator\桌面\dll.rar ?RAR ?jzgpri.dll - is OK
C:\Documents and Settings\Administrator\桌面\dll.rar ?RAR ?mydpri.dll - is OK
C:\Documents and Settings\Administrator\桌面\dll.rar ?RAR ?qhcpri.dll - a variant of Win32/PSW.OnLineGames.NDA trojan
C:\Documents and Settings\Administrator\桌面\dll.rar ?RAR ?xyhpri.dll - a variant of Win32/PSW.OnLineGames.NDA trojan
Number of scanned files: 6
Number of threats found: 3
Number of files cleaned: 1
Time of completion: 16:27:29 Total scanning time: 0 sec (00:00:00)

显示全部楼层 · 发表于 2007-8-10 16:29:23

C:\virus\mydpri.dll - infected with Trojan.PWS.Gamania.3239

显示全部楼层 · 发表于 2007-8-10 16:30:12

Scan performed at: 2007-8-10 16:29:34
Scanning Log
NOD32 version 2448 (20070809) NT
Command line: C:\Documents and Settings\Administrator\桌面\dll.rar
Operating memory - is OK

Date: 10.8.2007 Time: 16:29:39
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Administrator\桌面\dll.rar
C:\Documents and Settings\Administrator\桌面\dll.rar ?RAR ?dhcpri.dll - a variant of Win32/PSW.OnLineGames.NDA trojan
C:\Documents and Settings\Administrator\桌面\dll.rar ?RAR ?qhcpri.dll - a variant of Win32/PSW.OnLineGames.NDA trojan
C:\Documents and Settings\Administrator\桌面\dll.rar ?RAR ?xyhpri.dll - a variant of Win32/PSW.OnLineGames.NDA trojan
Number of scanned files: 6
Number of threats found: 3
Number of files cleaned: 1
Time of completion: 16:29:39 Total scanning time: 0 sec (00:00:00)

显示全部楼层 · 发表于 2007-8-10 16:55:05

IKARUS - T3SCAN V1.27 (WIN32)
      T3 V1.01.12
      Copyright (c) 2003 - 2007 by IKARUS Software.
      Written by Richard Schmoegner.
      All rights reserved.
Signature-database from 10.8.2007 04:24:52 (Build: 69330)

G:\virtualshare\temp\dll\dhcpri.dll - Signature 'Trojan-Downloader.Agent.YJA' found

G:\virtualshare\temp\dll\jzgpri.dll - Signature 'Trojan-Spy.Win32.Delf.uv' found

G:\virtualshare\temp\dll\mydpri.dll - Signature 'Trojan-Spy.Win32.Delf.uv' found

G:\virtualshare\temp\dll\qhcpri.dll - Signature 'Trojan-Spy.Win32.Delf.uv' found

G:\virtualshare\temp\dll\xyhpri.dll - Signature 'Trojan-Downloader.Agent.YJA' found

5 Files scanned
(0 Archives with 0 files)
5 Signatures found
0 Suspect code-parts found
Used time: 0:00.000

显示全部楼层 · 发表于 2007-8-10 17:05:57

驱逐舰只报了1个

显示全部楼层 · 发表于 2007-8-10 17:22:06

发现风险！风险： Infostealer.Gampass 位于文件：C:\Documents and Settings\Administrator\桌面\Virus样本\dll.rar>>jzgpri.dll 由：手动扫描。操作：隔离成功。操作说明：已经成功地隔离了文件。

发现风险！风险： Infostealer.Huaxiat 位于文件：C:\Documents and Settings\Administrator\桌面\Virus样本\dll.rar>>qhcpri.dll 由：手动扫描。操作：隔离成功。操作说明：已经成功地隔离了文件。

显示全部楼层 · 发表于 2007-8-10 18:00:58

BitDefender

This web page has been blocked by BitDefender Antivirus Real-time Protection!

The blocked web page included objects that were either infected or likely to be infected with a virus. Your system has NOT been infected.
http://www.bitdefender.com/vfind/?q=DeepScan:Generic.Dld.Agent.1BBFBAEE
http://www.bitdefender.com/vfind/?q=DeepScan:Generic.Dld.Agent.C9DCFF68
http://www.bitdefender.com/vfind/?q=DeepScan:Generic.Dld.Agent.8DEDDC08
http://www.bitdefender.com/vfind/?q=Trojan.Downloader.Agent.YJA

[病毒样本] [699435 E3D5DC 4ACF84 E581CE 16D37A]一包DLL

本帖子中包含更多资源

本帖子中包含更多资源