19个

qianwenxiang

[MD5: 73DD46 7AE33B D651F0 B068D7 AECEBF FB37E7 85F1B1 9577AB D9CCF6 723868 4B4B46 CF8208 E55F24 E2CFDC C576A0 8FE4A4 9C8E94 A6EFD8 3CCBEE]

1688388728

反病毒专家 AntiVirusKit 2007 扫描病毒日志记录
版本
双引擎反病毒签名 8/14/2007
开始时间: 8/14/2007 16:30
引擎: KAV 引擎 (AVK 17.6858), AVST 引擎 (AVKB 17.338)
高启发式: 打开
压缩文件: 打开
系统区域: 打开

扫描系统区域...
扫描所选择的目录和文件...
对象: 11.exe
        路径: D:\病毒库\081403[1]
狀態: 已发现病毒
        病毒: Trojan-Spy.Win32.Delf.uv (KAV 引擎)
对象: 12.exe
        路径: D:\病毒库\081403[1]
狀態: 已发现病毒
        病毒: Trojan-Spy.Win32.Delf.uv (KAV 引擎)
对象: stream data0001
        在压缩档案里: D:\病毒库\081403[1]\1228.exe
狀態: 已发现病毒
        病毒: Trojan-Downloader.Win32.LoadAdv.gen (KAV 引擎)
对象: stream data0002
        在压缩档案里: D:\病毒库\081403[1]\1228.exe
狀態: 已发现病毒
        病毒: Trojan-Downloader.Win32.Small.eqn (KAV 引擎)
对象: stream/data0003/stream data0002
        在压缩档案里: D:\病毒库\081403[1]\1228.exe
狀態: 已发现病毒
        病毒: Trojan-Downloader.Win32.Agent.bys (KAV 引擎)
对象: 1228.exe
        路径: D:\病毒库\081403[1]
狀態: 已发现病毒
        病毒: Trojan-Downloader.Win32.LoadAdv.gen, Trojan-Downloader.Win32.Small.eqn, Trojan-Downloader.Win32.Agent.bys (KAV 引擎), Win32:Trojan-gen. {Other} (AVST 引擎)
对象: 13.exe
        路径: D:\病毒库\081403[1]
狀態: 已发现病毒
        病毒: Trojan-PSW.Win32.OnLineGames.aci (KAV 引擎)
对象: 14.exe
        路径: D:\病毒库\081403[1]
狀態: 已发现病毒
        病毒: Trojan-Spy.Win32.Delf.uv (KAV 引擎)
对象: 2.exe
        路径: D:\病毒库\081403[1]
狀態: 已发现病毒
        病毒: Trojan-PSW.Win32.OnLineGames.acf (KAV 引擎), Win32:Onlinegames-ACD [Trj] (AVST 引擎)
对象: 6.exe
        路径: D:\病毒库\081403[1]
狀態: 已发现病毒
        病毒: Win32:Small-HHY [Trj] (AVST 引擎)
对象: 7.exe
        路径: D:\病毒库\081403[1]
狀態: 已发现病毒
        病毒: Trojan-PSW.Win32.OnLineGames.rt (KAV 引擎)
对象: 8.exe
        路径: D:\病毒库\081403[1]
狀態: 已发现病毒
        病毒: Trojan-PSW.Win32.OnLineGames.aet (KAV 引擎)
对象: 9.exe
        路径: D:\病毒库\081403[1]
狀態: 已发现病毒
        病毒: Trojan-PSW.Win32.OnLineGames.uo (KAV 引擎), Win32:Small-HHY [Trj] (AVST 引擎)
对象: data0003
        在压缩档案里: D:\病毒库\081403[1]\bpbp.exe
狀態: 已发现病毒
        病毒: Trojan-Downloader.Win32.Delf.bmx (KAV 引擎)
对象: bpbp.exe
        路径: D:\病毒库\081403[1]
狀態: 已发现病毒
        病毒: Trojan-Downloader.Win32.Delf.bmx (KAV 引擎)
对象: dodolook133.exe
        路径: D:\病毒库\081403[1]
狀態: 已发现病毒
        病毒: Trojan-Downloader.Win32.QQHelper.xb (KAV 引擎), Win32:Small-DJC [Trj] (AVST 引擎)
对象: window.exe
        路径: D:\病毒库\081403[1]
狀態: 已发现病毒
        病毒: Trojan.Win32.Agent.avt (KAV 引擎)
对象: wmp11.exe
        路径: D:\病毒库\081403[1]
狀態: 已发现病毒
        病毒: Backdoor.Win32.Hupigon.emk (KAV 引擎)
对象: x.exe
        路径: D:\病毒库\081403[1]
狀態: 已发现病毒
        病毒: Trojan-PSW.Win32.Nilage.up (KAV 引擎), Win32:Agent-BQC [Trj] (AVST 引擎)
扫描完成: 8/14/2007 16:30
    已检查 19 个文件
    已发现 15 个染毒文件

FBAV

为PC护航风暴微塔
_____________________________________________
                                          
             风暴微塔反病毒               
                            [内测版]      
                   http://www.v0day.com/  
----------------------------------------------
开始扫描……

正在检查启动……
[C:\Documents and Settings\Administrator\桌面\virus\081403\9.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\081403\11.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\081403\12.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\081403\13.exe]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\081403\13.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\081403\14.exe]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\081403\14.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\081403\window.exe]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\081403\dodolook133.exe]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\081403\dodolook133.exe]
                    …………引擎[2]发现病毒:Win32.NkHack.FSG.A
[C:\Documents and Settings\Administrator\桌面\virus\081403\6.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\081403\8.exe]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\081403\8.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
文件数:19   病毒数:13  比重:0.6842105263158
OK  扫描完毕！

欠妳緈諨

AVAST删除11个

wangjay1980

detected: Trojan program Trojan-PSW.Win32.OnLineGames.uo        File: E:\Ñù±¾\н¨Îļþ¼Ð\9.exe//UPack
detected: Trojan program Trojan-Proxy.Win32.Small.fl        File: E:\Ñù±¾\н¨Îļþ¼Ð\10.exe//#//PE_Patch.PECompact//PecBundle
detected: Trojan program Trojan-Spy.Win32.Delf.uv        File: E:\Ñù±¾\н¨Îļþ¼Ð\11.exe//UPack
detected: Trojan program Trojan-Spy.Win32.Delf.uv        File: E:\Ñù±¾\н¨Îļþ¼Ð\12.exe//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.aci        File: E:\Ñù±¾\н¨Îļþ¼Ð\13.exe//PE_Patch
detected: Trojan program Trojan-Spy.Win32.Delf.uv        File: E:\Ñù±¾\н¨Îļþ¼Ð\14.exe//UPack
detected: Trojan program Backdoor.Win32.Hupigon.emk        File: E:\Ñù±¾\н¨Îļþ¼Ð\wmp11.exe
detected: Trojan program Trojan.Win32.Agent.avt        File: E:\Ñù±¾\н¨Îļþ¼Ð\window.exe
detected: Trojan program Trojan-Downloader.Win32.Delf.bmx        File: E:\Ñù±¾\н¨Îļþ¼Ð\bpbp.exe//data0003
detected: Trojan program Trojan-PSW.Win32.Nilage.up        File: E:\Ñù±¾\н¨Îļþ¼Ð\x.exe//UPX
detected: Trojan program Trojan-Downloader.Win32.LoadAdv.gen        File: E:\Ñù±¾\н¨Îļþ¼Ð\1228.exe//stream//data0001//PE_Patch.UPX//UPX
detected: Trojan program Trojan-Downloader.Win32.Small.eqn        File: E:\Ñù±¾\н¨Îļþ¼Ð\1228.exe//stream//data0002//PE_Patch.Upolyx//PE_Patch.UPX//UPX
detected: Trojan program Trojan-Downloader.Win32.Agent.bys        File: E:\Ñù±¾\н¨Îļþ¼Ð\1228.exe//stream//data0003//stream//data0002
detected: Trojan program Trojan-Downloader.Win32.QQHelper.xb        File: E:\Ñù±¾\н¨Îļþ¼Ð\dodolook133.exe//UPX
detected: Trojan program Trojan-PSW.Win32.OnLineGames.acf        File: E:\Ñù±¾\н¨Îļþ¼Ð\2.exe//PE_Patch.UPX//UPX
detected: Trojan program Trojan-Proxy.Win32.Small.fl        File: E:\Ñù±¾\н¨Îļþ¼Ð\1.exe//#//PE_Patch.PECompact//PecBundle
detected: Trojan program Trojan-Proxy.Win32.Small.fl        File: E:\Ñù±¾\н¨Îļþ¼Ð\3.exe//#//PE_Patch.PECompact//PecBundle
detected: virus Heur.Downloader (modification)        File: E:\Ñù±¾\н¨Îļþ¼Ð\6.exe//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.rt        File: E:\Ñù±¾\н¨Îļþ¼Ð\7.exe//PE_Patch.UPX//UPX
detected: Trojan program Trojan-PSW.Win32.OnLineGames.aet        File: E:\Ñù±¾\н¨Îļþ¼Ð\8.exe//PE_Patch//UPack

kasper

BD     16个~~~~



C:\Documents and Settings\同同\桌面\081403.part1.rar=>9.exe        Infected: DeepScan:Generic.Dld.Agent.72A96409
C:\Documents and Settings\同同\桌面\081403.part1.rar=>9.exe        Disinfection failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>9.exe        Move failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>10.exe        Infected: Trojan.PWS.Onlinegames.AYD
C:\Documents and Settings\同同\桌面\081403.part1.rar=>10.exe        Disinfection failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>10.exe        Move failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>11.exe        Infected: DeepScan:Generic.Dld.Agent.A8618419
C:\Documents and Settings\同同\桌面\081403.part1.rar=>11.exe        Disinfection failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>11.exe        Move failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>12.exe        Infected: DeepScan:Generic.Dld.Agent.95F8A0FE
C:\Documents and Settings\同同\桌面\081403.part1.rar=>12.exe        Disinfection failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>12.exe        Move failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>13.exe        Infected: BehavesLike:Win32.ExplorerHijack
C:\Documents and Settings\同同\桌面\081403.part1.rar=>13.exe        Disinfection failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>13.exe        Move failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>14.exe        Infected: DeepScan:Generic.Dld.Agent.8331DB85
C:\Documents and Settings\同同\桌面\081403.part1.rar=>14.exe        Disinfection failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>14.exe        Move failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>window.exe        Infected: GenPack:Trojan.PWS.Delf.IED
C:\Documents and Settings\同同\桌面\081403.part1.rar=>window.exe        Deleted
C:\Documents and Settings\同同\桌面\081403.part1.rar        Archive repacking has failed (marked actions not taken)
C:\Documents and Settings\同同\桌面\081403.part1.rar=>x.exe        Infected: Generic.Malware.SBdldg.C5019E46
C:\Documents and Settings\同同\桌面\081403.part1.rar=>x.exe        Disinfection failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>x.exe        Move failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>1228.exe=>(NSIS o)=>lzma_solid_nsis0001        Suspect: Trojan.Downloader.LoadAdv.B
C:\Documents and Settings\同同\桌面\081403.part1.rar=>1228.exe=>(NSIS o)=>lzma_solid_nsis0002        Infected: Trojan.Downloader.Small.EQN
C:\Documents and Settings\同同\桌面\081403.part1.rar=>1228.exe=>(NSIS o)=>lzma_solid_nsis0002        Disinfection failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>1228.exe=>(NSIS o)=>lzma_solid_nsis0002        Move failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>1228.exe=>(NSIS o)=>lzma_solid_nsis0003=>(NSIS o)=>lzma_solid_nsis0002        Infected: Trojan.Downloader.Agent.BYS
C:\Documents and Settings\同同\桌面\081403.part1.rar=>1228.exe=>(NSIS o)=>lzma_solid_nsis0003=>(NSIS o)=>lzma_solid_nsis0002        Disinfection failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>1228.exe=>(NSIS o)=>lzma_solid_nsis0003=>(NSIS o)=>lzma_solid_nsis0002        Move failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>dodolook133.exe        Infected: Dropped:Generic.PWStealer.C52FE99B
C:\Documents and Settings\同同\桌面\081403.part1.rar=>dodolook133.exe        Disinfection failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>dodolook133.exe        Move failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>2.exe        Infected: Generic.Malware.PWS.F050B0E5
C:\Documents and Settings\同同\桌面\081403.part1.rar=>2.exe        Disinfection failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>2.exe        Move failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>1.exe        Infected: Trojan.Dropper.RIA
C:\Documents and Settings\同同\桌面\081403.part1.rar=>1.exe        Disinfection failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>1.exe        Move failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>3.exe        Infected: Trojan.Dropper.RIA
C:\Documents and Settings\同同\桌面\081403.part1.rar=>3.exe        Disinfection failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>3.exe        Move failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>4.exe        Infected: Trojan.PWS.Onlinegames.AYD
C:\Documents and Settings\同同\桌面\081403.part1.rar=>4.exe        Disinfection failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>4.exe        Move failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>6.exe        Infected: DeepScan:Generic.Dld.Agent.2522842C
C:\Documents and Settings\同同\桌面\081403.part1.rar=>6.exe        Disinfection failed
C:\Documents and Settings\同同\桌面\081403.part1.rar=>6.exe        Move failed

[ 本帖最后由 kasper 于 2007-8-14 17:12 编辑 ]

kasper

驱逐舰3个，昏迷~~~~~~~~~~~~~

The EQs

Scan performed at: 2007-8-14 17:39:24
Scanning Log
NOD32 version 2458 (20070813) NT
Command line: C:\Documents and Settings\EQ2\桌面\081403
Operating memory - is OK

Date: 14.8.2007  Time: 17:39:31
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\081403\
C:\Documents and Settings\EQ2\桌面\081403\1.exe - a variant of Win32/Agent.NIK trojan
C:\Documents and Settings\EQ2\桌面\081403\10.exe - a variant of Win32/Agent.NIK trojan
C:\Documents and Settings\EQ2\桌面\081403\1228.exe ?NSIS ?loadadv579.exe - a variant of Win32/TrojanDownloader.Small.NUS trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\081403\1228.exe ?NSIS ?wr-1-20.exe - Win32/TrojanDownloader.Small.EQN trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\081403\1228.exe ?NSIS ?1228.exe ?NSIS ?aabb.exe - Win32/TrojanDownloader.Agent.BYS trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\081403\13.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\EQ2\桌面\081403\2.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\EQ2\桌面\081403\3.exe - a variant of Win32/Agent.NIK trojan
C:\Documents and Settings\EQ2\桌面\081403\4.exe - a variant of Win32/Agent.NIK trojan
C:\Documents and Settings\EQ2\桌面\081403\6.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\EQ2\桌面\081403\7.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\EQ2\桌面\081403\8.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\081403\9.exe - a variant of Win32/PSW.OnLineGames.NDA trojan
C:\Documents and Settings\EQ2\桌面\081403\window.exe - probably a variant of Win32/PSW.Delf.NHI trojan
C:\Documents and Settings\EQ2\桌面\081403\wmp11.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\081403\x.exe - probably unknown NewHeur_PE virus [7]
Number of scanned files: 24
Number of threats found: 16
Number of files cleaned: 14
Time of completion: 17:39:35 Total scanning time: 4 sec (00:00:04)

Notes:
[7] File is probably infected with an unknown virus.

woai_jolin

===================================================================================================
Norman Virus Control On-demand scanner 7.0.0.9

NSE revision 5.91.04
nvcbin.def revision 5.90.00 of 2007/08/09 20:07:15 (824384 variants)
nvcmacro.def revision 5.90.00 of 2007/08/06 19:46:49 (20358 variants)
Total number of variants: 844742
===================================================================================================

       Time  Filename                                                     Virus name
---------------------------------------------------------------------------------------------------

- Scanning drive: F:\
- Scanning system areas of drive: F:\
- Scanning files in the directory: F:\v\v1\
      422 ms F:\v\v1\1.exe                                               
      562 ms F:\v\v1\10.exe                                             
        0 ms F:\v\v1\11.exe                                               Security Risk W32/Suspicious_U.gen ()
- File F:\v\v1\11.exe quarantined.
- File F:\v\v1\11.exe deleted.
        0 ms F:\v\v1\12.exe                                               Security Risk W32/Suspicious_U.gen ()
- File F:\v\v1\12.exe quarantined.
- File F:\v\v1\12.exe deleted.
       16 ms F:\v\v1\1228.exe                                             Trojan W32/Agent.AMIS ()
- File F:\v\v1\1228.exe quarantined.
- File F:\v\v1\1228.exe deleted.
        0 ms F:\v\v1\13.exe                                               Security Risk W32/Suspicious_U.gen ()
- File F:\v\v1\13.exe quarantined.
- File F:\v\v1\13.exe deleted.
        0 ms F:\v\v1\14.exe                                               Security Risk W32/Suspicious_U.gen ()
- File F:\v\v1\14.exe quarantined.
- File F:\v\v1\14.exe deleted.
       15 ms F:\v\v1\2.exe                                                Trojan OnLineGames.gen26 ()
- File F:\v\v1\2.exe quarantined.
- File F:\v\v1\2.exe deleted.
      562 ms F:\v\v1\3.exe                                               
      282 ms F:\v\v1\4.exe                                               
        0 ms F:\v\v1\6.exe                                                Security Risk W32/Suspicious_U.gen ()
- File F:\v\v1\6.exe quarantined.
- File F:\v\v1\6.exe deleted.
        0 ms F:\v\v1\7.exe                                                Trojan OnLineGames.gen26 ()
- File F:\v\v1\7.exe quarantined.
- File F:\v\v1\7.exe deleted.
        0 ms F:\v\v1\8.exe                                                Security Risk W32/Suspicious_U.gen ()
- File F:\v\v1\8.exe quarantined.
- File F:\v\v1\8.exe deleted.
        0 ms F:\v\v1\9.exe                                                Security Risk W32/Suspicious_U.gen ()
- File F:\v\v1\9.exe quarantined.
- File F:\v\v1\9.exe deleted.
     1328 ms F:\v\v1\bpbp.exe                                            
        0 ms F:\v\v1\dodolook133.exe                                      Aggressive commersial W32/IEHlpr.FG ()
- File F:\v\v1\dodolook133.exe quarantined.
- File F:\v\v1\dodolook133.exe deleted.
     1063 ms F:\v\v1\window.exe                                          
      547 ms F:\v\v1\wmp11.exe                                          
      219 ms F:\v\v1\x.exe                                                Virus W32/Smalldoor.ARFP.dropper ( [ General information ]
    * **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
    * Decompressing UPX.
    * File length:        14848 bytes.

[ Changes to filesystem ]
    * Creates directory C:\WINDOWS\AppPatch.
    * Creates file C:\WINDOWS\AppPatch\msi.dll.
    * Creates file C:\WINDOWS\SYSTEM32\unxxx.bat.

[ Changes to registry ]
    * Creates key "HKCR\CLSID\{DADE1910-AA86-4ED0-4B87-2928BA3D4E99}\InprocServer32".
    * Sets value "ThreadingModel"="Apartment" in key "HKCR\CLSID\{DADE1910-AA86-4ED0-4B87-2928BA3D4E99}\InprocServer32".
    * Sets value "DL4"="{DADE1910-AA86-4ED0-4B87-2928BA3D4E99}" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad".

[ Process/window information ]
    * Enumerates running processes.
    * Modifies other process memory.

[ Signature Scanning ]
    * C:\WINDOWS\AppPatch\msi.dll (12288 bytes) : W32/Smalldoor.ARFP.

)
- File F:\v\v1\x.exe quarantined.
- File F:\v\v1\x.exe deleted.

===================================================================================================

The scanning started: 2007/08/14 17:41:09
               ended: 2007/08/14 17:41:15
Logged on as        : Administrator
on hostname         : 2FF87FC2B9AB46F

Scanning results:
   Total number of files found..............................:      19
   Number of files scanned..................................:      19
   Number of files/directories skipped due to exclude list..:       0
   Number of files that could not be opened.................:       0
   Number of archive files unpacked.........................:       0
   Number of archive files not unpacked.....................:       0
   Number of infections.....................................:      12

Copyright (c) 1993-2005 Norman ASA.

东京时空