13个

qianwenxiang

[MD5: 818BB5 6938D6 78C9DE F49569 CB3799 6A08E2 A8320A 12EDF3 A1E3B4 FED5B7 2E3188 8673CF 2C790D]

微点卫士

微点：
木马名称:Trojan-Downloader.Win32.Agent.itl

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\0801402[1]\RETADPU22.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
蠕虫名称:Worm.Win32.Agent.djw

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\0801402[1]\4D1697D4.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Downloader.Win32.Small.kkc

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\0801402[1]\LDCORE.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.QQPass.fdp

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\0801402[1]\LOVEQQ.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\0801402[1]\AB465634.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\8B583230.EXE
2) C:\WINDOWS.0\SYSTEM32\9F28F200.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\0801402[1]\AB465634.EXE
可疑程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\8B583230.EXE
2) C:\WINDOWS.0\SYSTEM32\9F28F200.DLL
3) C:\WINDOWS.0\SYSTEM32\DELME.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\0801402[1]\AB465634.EXE
删除失败!

延迟删除文件!
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\0801402[1]\AB465634.EXE
1) C:\WINDOWS.0\SYSTEM32\DELME.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\0801402[1]\MCLIENT.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\RGKHPNYCDNFGW.DLL
是否删除木马程序及其衍生物?

dyw1021

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\0801402.part1.rar'
C:\Documents and Settings\Administrator\桌面\0801402.part1.rar
  [0] Archive type: RAR
  --> mclient.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> MSURLPAR.dll
      [DETECTION] Is the Trojan horse TR/BHO.Agent.136576
  --> MSURLPAR.dll.zgx.tmp
      [DETECTION] Contains signature of the dropper DR/Zhongsou.G
      [1] Archive type: CAB (Microsoft)
      --> MSURLPAR.dll.zgx
          [DETECTION] Is the Trojan horse TR/BHO.Agent.136576
  --> mszstb.dll
      [DETECTION] Is the Trojan horse TR/Spy.Agent.90112
  --> mszstb.dll.zgx.tmp
      [DETECTION] Contains signature of the dropper DR/Zhongsou.G.1
      [1] Archive type: CAB (Microsoft)
      --> mszstb.dll.zgx
          [DETECTION] Is the Trojan horse TR/Spy.Agent.90112
  --> mszstb.sys
      [DETECTION] Contains signature of the Ad- or Spyware ADSPY/Zhongsou.I
      [INFO]      The file was moved to '46f1493a.qua'!


End of the scan: 2007年8月14日  14:17
Used time: 00:05 min

The scan has been done completely.

      0 Scanning directories
      9 Files were scanned
      8 viruses and/or unwanted programs were found
      0 classified as suspicious:
      0 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      3 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

promised

C:\ABC\0801402\4D1697D4.EXE - 特征码 'Generic.Popwin' 被发现
C:\ABC\0801402\AB465634.EXE - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\0801402\gooupzlnboiid.dll - 特征码 'Trojan-Downloader.Win32.Delf.asz' 被发现
C:\ABC\0801402\ldcore.dll - 特征码 'Trojan-Downloader.Win32.Small.dxm' 被发现
C:\ABC\0801402\Loveqq.exe - 特征码 'Generic.Hupigon' 被发现
C:\ABC\0801402\mclient.exe - 可疑代码段 被发现 (Level: 150)
C:\ABC\0801402\MSURLPAR.dll - 特征码 'not-a-virus:AdWare.Win32.Zhongsou.g' 被发现
C:\ABC\0801402\MSURLPAR.dll.zgx.tmp:\MSURLPAR.dll.zgx - 特征码 'not-a-virus:AdWare.Win32.Zhongsou.g' 被发现
C:\ABC\0801402\MSURLPAR.dll.zgx.tmp
C:\ABC\0801402\mszstb.dll - 特征码 'not-a-virus:AdWare.Win32.Zhongsou.g' 被发现
C:\ABC\0801402\mszstb.dll.zgx.tmp:\mszstb.dll.zgx - 特征码 'not-a-virus:AdWare.Win32.Zhongsou.g' 被发现
C:\ABC\0801402\mszstb.dll.zgx.tmp
C:\ABC\0801402\mszstb.sys - 特征码 'not-a-virus:AdWare.Win32.Zhongsou.i' 被发现
C:\ABC\0801402\retadpu22.exe - 特征码 'Trojan-Downloader.Win32.Agent.bls' 被发现
C:\ABC\0801402\setup\mszstb.sys - 特征码 'not-a-virus:AdWare.Win32.Zhongsou.i' 被发现

        16 文件被扫描
          (2 压缩档 2 文件)
        12 特征码被侦测
        1 可疑代码段被发现
        耗时: 0:00.234

The EQs

Scan performed at: 2007-8-14 14:30:31
Scanning Log
NOD32 version 2458 (20070813) NT
Command line: C:\Documents and Settings\EQ2\桌面\0801402
Operating memory - is OK

Date: 14.8.2007  Time: 14:30:41
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\0801402\
C:\Documents and Settings\EQ2\桌面\0801402\4D1697D4.EXE - probably a variant of Win32/Agent.NEO trojan
C:\Documents and Settings\EQ2\桌面\0801402\AB465634.EXE - probably a variant of Win32/Agent.NEO trojan
C:\Documents and Settings\EQ2\桌面\0801402\gooupzlnboiid.dll - a variant of Win32/TrojanDownloader.Ieser trojan
C:\Documents and Settings\EQ2\桌面\0801402\mclient.exe - a variant of Win32/TrojanDownloader.Ieser trojan
C:\Documents and Settings\EQ2\桌面\0801402\retadpu22.exe - a variant of Win32/TrojanDownloader.Agent.BLS trojan
Number of scanned files: 13
Number of threats found: 5
Number of files cleaned: 5
Time of completion: 14:30:47 Total scanning time: 6 sec (00:00:06)

碧水寒潭

红伞:12个Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\0801402[1].part1.rar
  [0] Archive type: RAR
  --> mclient.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> MSURLPAR.dll
      [DETECTION] Is the Trojan horse TR/BHO.Agent.136576
  --> MSURLPAR.dll.zgx.tmp
      [DETECTION] Contains signature of the dropper DR/Zhongsou.G
      [1] Archive type: CAB (Microsoft)
      --> MSURLPAR.dll.zgx
          [DETECTION] Is the Trojan horse TR/BHO.Agent.136576
  --> mszstb.dll
      [DETECTION] Is the Trojan horse TR/Spy.Agent.90112
  --> mszstb.dll.zgx.tmp
      [DETECTION] Contains signature of the dropper DR/Zhongsou.G.1
      [1] Archive type: CAB (Microsoft)
      --> mszstb.dll.zgx
          [DETECTION] Is the Trojan horse TR/Spy.Agent.90112
      [INFO]      The file was deleted!
H:\AV-TEST\0801402[1].part2.rar
  [0] Archive type: RAR
  --> setup.tmp
      [DETECTION] Contains signature of the dropper DR/Zhongsou.I
  --> 4D1697D4.EXE
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Exaal.45056 Backdoor server programs
  --> AB465634.EXE
      [DETECTION] Is the Trojan horse TR/Dldr.Flux.A.3
  --> gooupzlnboiid.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> ldcore.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Small.dxm.3
      [INFO]      The file was deleted!


End of the scan: 2007年8月14日  14:32
Used time: 00:26 min

The scan has been done completely.

      1 Scanning directories
     16 Files were scanned
     12 viruses and/or unwanted programs were found
      1 classified as suspicious:
      2 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      5 Archives were scanned
      0 Warnings
      1 Notes
      0 Hidden objects were found

promised

反正在我的几个大包好像都出现过

1688388728

反病毒专家 AntiVirusKit 2007 扫描病毒日志记录
版本
双引擎反病毒签名 8/14/2007
开始时间: 8/14/2007 15:09
引擎: KAV 引擎 (AVK 17.6857), AVST 引擎 (AVKB 17.338)
高启发式: 打开
压缩文件: 打开
系统区域: 打开

扫描系统区域...
扫描所选择的目录和文件...
对象: 4D1697D4.EXE
        路径: D:\病毒库\0801402[1]
狀態: 已发现病毒
        病毒: Backdoor.Win32.Agent.ahj (KAV 引擎), Win32:Agent-HFX [Trj] (AVST 引擎)
对象: AB465634.EXE
        路径: D:\病毒库\0801402[1]
狀態: 已发现病毒
        病毒: Trojan-Downloader.Win32.Flux.a (KAV 引擎), Win32:Agent-HFX [Trj] (AVST 引擎)
对象: gooupzlnboiid.dll
        路径: D:\病毒库\0801402[1]
狀態: 已发现病毒
        病毒: Trojan-Downloader.Win32.Ieser.c (KAV 引擎), Win32:Delf-FKI [Trj] (AVST 引擎)
对象: ldcore.dll
        路径: D:\病毒库\0801402[1]
狀態: 已发现病毒
        病毒: Trojan-Downloader.Win32.Small.dxm (KAV 引擎), Win32:Small-HLG [Trj] (AVST 引擎)
对象: Loveqq.exe
        路径: D:\病毒库\0801402[1]
狀態: 已发现病毒
        病毒: Trojan-PSW.Win32.QQPass.xn (KAV 引擎)
对象: mclient.exe
        路径: D:\病毒库\0801402[1]
狀態: 已发现病毒
        病毒: Trojan-Downloader.Win32.Ieser.c (KAV 引擎), Win32:Delf-FKJ [Trj] (AVST 引擎)
对象: MSURLPAR.dll
        路径: D:\病毒库\0801402[1]
狀態: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.Zhongsou.g (KAV 引擎), Win32:Zhongsou [Adw] (AVST 引擎)
对象: MSURLPAR.dll.zgx
        在压缩档案里: D:\病毒库\0801402[1]\MSURLPAR.dll.zgx.tmp
狀態: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.Zhongsou.g (KAV 引擎), Win32:Zhongsou [Adw] (AVST 引擎)
对象: MSURLPAR.dll.zgx.tmp
        路径: D:\病毒库\0801402[1]
狀態: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.Zhongsou.g (KAV 引擎), Win32:Zhongsou [Adw] (AVST 引擎)
对象: mszstb.dll
        路径: D:\病毒库\0801402[1]
狀態: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.Zhongsou.g (KAV 引擎), Win32:Zhongsou [Adw] (AVST 引擎)
对象: mszstb.dll.zgx
        在压缩档案里: D:\病毒库\0801402[1]\mszstb.dll.zgx.tmp
狀態: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.Zhongsou.g (KAV 引擎), Win32:Zhongsou [Adw] (AVST 引擎)
对象: mszstb.dll.zgx.tmp
        路径: D:\病毒库\0801402[1]
狀態: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.Zhongsou.g (KAV 引擎), Win32:Zhongsou [Adw] (AVST 引擎)
对象: mszstb.sys
        路径: D:\病毒库\0801402[1]
狀態: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.Zhongsou.i (KAV 引擎), Win32:Zhongsou-B [Adw] (AVST 引擎)
对象: retadpu22.exe
        路径: D:\病毒库\0801402[1]
狀態: 已发现病毒
        病毒: Trojan-Downloader.Win32.Agent.bls (KAV 引擎), Win32:Agent-HKJ [Trj] (AVST 引擎)
对象: mszstb.sys
        在压缩档案里: D:\病毒库\0801402[1]\setup.tmp
狀態: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.Zhongsou.i (KAV 引擎), Win32:Zhongsou-B [Adw] (AVST 引擎)
对象: setup.tmp
        路径: D:\病毒库\0801402[1]
狀態: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.Zhongsou.i (KAV 引擎), Win32:Zhongsou-B [Adw] (AVST 引擎)
扫描完成: 8/14/2007 15:09
    已检查 13 个文件
    已发现 13 个染毒文件

wangjay1980

detected: adware not-a-virus:AdWare.Win32.Zhongsou.i        File: E:\Ñù±¾\bingdu\setup.tmp/mszstb.sys
detected: Trojan program Trojan-Downloader.Win32.Agent.bls        File: E:\Ñù±¾\bingdu\retadpu22.exe//PE_Patch.Upolyx//PE_Patch.UPX//UPX
detected: adware not-a-virus:AdWare.Win32.Zhongsou.i        File: E:\Ñù±¾\bingdu\mszstb.sys
detected: adware not-a-virus:AdWare.Win32.Zhongsou.g        File: E:\Ñù±¾\bingdu\mszstb.dll.zgx.tmp/mszstb.dll.zgx
detected: adware not-a-virus:AdWare.Win32.Zhongsou.g        File: E:\Ñù±¾\bingdu\mszstb.dll
detected: adware not-a-virus:AdWare.Win32.Zhongsou.g        File: E:\Ñù±¾\bingdu\MSURLPAR.dll.zgx.tmp/MSURLPAR.dll.zgx
detected: adware not-a-virus:AdWare.Win32.Zhongsou.g        File: E:\Ñù±¾\bingdu\MSURLPAR.dll
detected: Trojan program Trojan-Downloader.Win32.Ieser.c        File: E:\Ñù±¾\bingdu\mclient.exe//PE_Patch.PECompact//PecBundle//PECompact
detected: Trojan program Trojan-PSW.Win32.QQPass.xn        File: E:\Ñù±¾\bingdu\Loveqq.exe
detected: Trojan program Trojan-Downloader.Win32.Small.dxm        File: E:\Ñù±¾\bingdu\ldcore.dll
detected: Trojan program Trojan-Downloader.Win32.Ieser.c        File: E:\Ñù±¾\bingdu\gooupzlnboiid.dll
detected: Trojan program Trojan-Downloader.Win32.Flux.a        File: E:\Ñù±¾\bingdu\AB465634.EXE//UPack//ASPack
detected: Trojan program Backdoor.Win32.Agent.ahj        File: E:\Ñù±¾\bingdu\4D1697D4.EXE//ASPack
13

东京时空

原来诺顿也会拦截