【md5内详】25

jimmyleo

check

jimmyleo

【C0AFBF|3501C3|F4E9DD|959004|7B5138|1654A9|E09A7D|A4FD82|97C81F|A07A31|D70CA0|D3F68B|9BF859|D6AF1E|089ACD|E73EFC|E1F0C2|148C28|CA4253|793530|089ACD|0BF118|2E5514|A73063|7CAEA4】

The EQs

Scan performed at: 2007-8-14 14:35:36
Scanning Log
NOD32 version 2458 (20070813) NT
Command line: C:\Documents and Settings\EQ2\桌面\25.rar
Operating memory - is OK

Date: 14.8.2007  Time: 14:35:42
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\25.rar
C:\Documents and Settings\EQ2\桌面\25.rar ?RAR ?WinSys64.Sys - a variant of Win32/AutoRun.Q worm
C:\Documents and Settings\EQ2\桌面\25.rar ?RAR ?yy.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\25.rar ?RAR ?SysWin64.Jmp - a variant of Win32/AutoRun.Q worm
C:\Documents and Settings\EQ2\桌面\25.rar ?RAR ?jopen13.exe - a variant of Win32/AutoRun.Q worm
C:\Documents and Settings\EQ2\桌面\25.rar ?RAR ?630.exe - Win32/Delf.NDF worm - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\25.rar ?RAR ?jopen10.exe - probably a variant of Win32/PSW.Agent.NDP trojan
C:\Documents and Settings\EQ2\桌面\25.rar ?RAR ?jopen6.exe - a variant of Win32/PSW.OnLineGames.NCU trojan
C:\Documents and Settings\EQ2\桌面\25.rar ?RAR ?jopen8.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\25.rar ?RAR ?jopen9.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\25.rar ?RAR ?jopen11.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\EQ2\桌面\25.rar ?RAR ?jopen2.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\25.rar ?RAR ?jopen4.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\25.rar ?RAR ?www.exe - Win32/Viking.LU virus - was a part of the deleted object
Number of scanned files: 33
Number of threats found: 13
Number of files cleaned: 1
Time of completion: 14:35:44 Total scanning time: 2 sec (00:00:02)

Notes:
[7] File is probably infected with an unknown virus.

FBAV

为PC护航风暴微塔
_____________________________________________
                                          
             风暴微塔反病毒               
                            [内测版]      
                   http://www.v0day.com/  
----------------------------------------------
开始扫描……

正在检查启动……
[C:\Documents and Settings\Administrator\桌面\virus\25\yy.exe]
                    …………引擎[2]发现病毒:Win32.NkHack.PeM.A
[C:\Documents and Settings\Administrator\桌面\virus\25\jopen13.exe]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\25\jopen13.exe]
                    …………引擎[2]发现病毒:Win32.NkHack.FSG.A
[C:\Documents and Settings\Administrator\桌面\virus\25\630.exe]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\25\630.exe]
                    …………引擎[2]发现病毒:Win32.NkHack.FSG.A
[C:\Documents and Settings\Administrator\桌面\virus\25\qq.exe]
                    …………引擎[2]发现病毒:Win32.Nop x9PC
[C:\Documents and Settings\Administrator\桌面\virus\25\1.exe]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\25\1.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\25\jopen6.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\25\jopen1.exe]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\25\jopen1.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\25\jopen8.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\25\jopen9.exe]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\25\jopen9.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\25\jopen3.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\25\jopen12.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\25\jopen11.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\25\jopen2.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\25\jopen4.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
文件数:20   病毒数:19  比重:0.95
OK  扫描完毕！

[ 本帖最后由 FBAV 于 2007-8-14 14:46 编辑 ]

woai_jolin

19个
Scan duration: 00:00:03
Scan areas:
F:\v\n\25.rar  - recursive
Objects
-------------------
Scanned         33         Disinfected      0
Infected         4         Deleted          0
Suspicious      15         Quarantined      0
Error(s) occurred during the scan: 0

[ 本帖最后由 woai_jolin 于 2007-8-14 14:39 编辑 ]

The EQs

里面有7个是一样的。。。。

微点卫士

微点：
木马名称:Trojan.Win32.Delf.bgk

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\630.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.Agent.emt

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\JOPEN10.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\JOPEN13.EXE
由
E:\AUTORUN.INF
自启动运行!
并生成以下文件:
1) E:\AUTORUN.EXE
2) E:\AUTORUN.INF
以及可由此INF文件引导自启的文件:
E:\AUTORUN.EXE

是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1.EXE
可疑程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM\INTERNAT.EXE
2) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1.EXE.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\WINDOWS.0\SYSTEM\INTERNAT.EXE
是否删除木马程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1.EXE
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1.EXE.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\JOPEN1.EXE
1) C:\DFD1833953.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\JOPEN1.EXE
1) C:\DFD1833953.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\JOPEN11.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\RAVZXMON.EXE
2) C:\WINDOWS.0\SYSTEM32\RAVZXMON.DAT
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\JOPEN12.EXE
1) C:\DFD1867484.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\JOPEN12.EXE
1) C:\DFD1867484.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\JOPEN2.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\FONTS\RAVZTMON.EXE
2) C:\WINDOWS.0\FONTS\RAVZTMON.DAT
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\JOPEN3.EXE
1) C:\DFD1916953.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\JOPEN3.EXE
1) C:\DFD1916953.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\JOPEN4.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\FONTS\RAVMHMON.EXE
2) C:\WINDOWS.0\FONTS\RAVMHMON.DAT
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\JOPEN6.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\RAVZXMON.EXE
2) C:\PROGRAM FILES\INTERNET EXPLORER\RAVZXMON.DAT
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\JOPEN4.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\JOPEN8.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\FONTS\RAVDTHXMON.EXE
2) C:\WINDOWS.0\FONTS\RAVDTHXMON.DAT
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\JOPEN9.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\FONTS\RAVCHDMON.EXE
2) C:\WINDOWS.0\FONTS\RAVCHDMON.DAT
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\JOPEN8.EXE
是否删除木马程序及其衍生物?
蠕虫名称:Worm.Win32.Vikings.dua

程序:
C:\WINDOWS.0\RICHDLL.DLL
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\WWW.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\UNINSTALL\RUNDL132.EXE
2) C:\WINDOWS.0\RICHDLL.DLL
是否删除木马程序及其衍生物?


1 run  yy qq 微点挂，上报

碧水寒潭

红伞c版:23个Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\0801402[1].part3.rar
  [0] Archive type: RAR
  --> WinSys64.Sys
      [DETECTION] Contains suspicious code HEUR/Malware
  --> yy.exe
      [DETECTION] Is the Trojan horse TR/Agent.33143
  --> SysWin64.Jmp
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
  --> jopen13.exe
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
  --> 630.exe
      [DETECTION] Is the Trojan horse TR/Agent.28829
  --> mydpri.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.20024
  --> wddpri.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> dhdpri.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> qq.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> jopen10.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 1.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Zhidao
  --> jopen6.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> jopen1.exe
      [DETECTION] Is the Trojan horse TR/Spy.Delf.UV.49
  --> jopen8.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> jopen9.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.aet.7
  --> jopen3.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> jopen12.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> jopen11.exe
      [DETECTION] Is the Trojan horse TR/PSW.6340
  --> jopen2.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> jopen4.exe
      [DETECTION] Is the Trojan horse TR/Agent.5127
  --> 1.bat
      [DETECTION] Contains suspicious code HEUR/Exploit.HTML
    --> jopen15.exe
      [1] Archive type: RAR SFX (self extracting)
      --> qq.exe
          [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> www.exe
      [DETECTION] Is the Trojan horse TR/PSW.Delf.AF.2
      [INFO]      The file was deleted!


End of the scan: 2007年8月14日  14:36
Used time: 00:22 min

The scan has been done completely.

      1 Scanning directories
     33 Files were scanned
     23 viruses and/or unwanted programs were found
      6 classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      4 Files not concerned
      2 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

promised

1.bat高宽=0

The EQs

又是报款和高为0。。。。。