一堆又一堆

zane_xzz

[MD5: CB1C52 D0324C F766E5 61F186 93858F 9C6E25 6B3A32 FD895C D27C7B 36C5CC 89E699 1FE01B 6FD07F 3D1BDB F05028 81831D 912891 A5C243 CF8BFB 7E44D2 38EC40 8E3ECF]

tracydk

11个

1688388728

反病毒专家 AntiVirusKit 2007 扫描病毒日志记录
版本
双引擎反病毒签名 8/14/2007
开始时间: 8/14/2007 21:00
引擎: KAV 引擎 (AVK 17.6863), AVST 引擎 (AVKB 17.338)
高启发式: 打开
压缩文件: 打开
系统区域: 打开

扫描系统区域...
扫描所选择的目录和文件...
对象: InfoWin.Sys
        路径: D:\病毒库\Suspicious2
狀態: 已发现病毒
        病毒: Win32:Delf-FHQ [Trj] (AVST 引擎)
对象: loadadv579.exe
        路径: D:\病毒库\Suspicious2
狀態: 已发现病毒
        病毒: Trojan-Downloader.Win32.LoadAdv.gen (KAV 引擎), Win32:LoadAdv-I [Trj] (AVST 引擎)
对象: NewTemp.dll
        路径: D:\病毒库\Suspicious2
狀態: 已发现病毒
        病毒: Virus.Win32.AutoRun.gr (KAV 引擎), Win32:Nilage-AI [Trj] (AVST 引擎)
对象: nshA.tmp
        路径: D:\病毒库\Suspicious2
狀態: 已发现病毒
        病毒: Win32:Agent-JQL [Trj] (AVST 引擎)
对象: shenji.exe
        路径: D:\病毒库\Suspicious2
狀態: 已发现病毒
        病毒: Virus.Win32.AutoRun.go (KAV 引擎), Win32:Agent-HFX [Trj] (AVST 引擎)
对象: svchost.exe
        路径: D:\病毒库\Suspicious2
狀態: 已发现病毒
        病毒: Virus.Win32.AutoRun.go (KAV 引擎), Win32:Agent-HFX [Trj] (AVST 引擎)
对象: SysWin64.Jmp
        路径: D:\病毒库\Suspicious2
狀態: 已发现病毒
        病毒: Trojan-PSW.Win32.Agent.mi (KAV 引擎), Win32:Small-DJC [Trj] (AVST 引擎)
对象: Uninst.exe
        路径: D:\病毒库\Suspicious2
狀態: 已发现病毒
        病毒: Win32:Boran-J [Trj] (AVST 引擎)
对象: winsys16_070812.dll
        路径: D:\病毒库\Suspicious2
狀態: 已发现病毒
        病毒: Trojan-Spy.Win32.Agent.pn (KAV 引擎), Win32:Delf-ECW [Trj] (AVST 引擎)
对象: WinSys64.Sys
        路径: D:\病毒库\Suspicious2
狀態: 已发现病毒
        病毒: Trojan-PSW.Win32.Agent.mi (KAV 引擎)
对象: wr-1-20.exe
        路径: D:\病毒库\Suspicious2
狀態: 已发现病毒
        病毒: Trojan-Downloader.Win32.Small.eqn (KAV 引擎), Win32:Small-GWM [Trj] (AVST 引擎)
扫描完成: 8/14/2007 21:00
    已检查 22 个文件
    已发现 11 个染毒文件

wangjay1980

detected: Trojan program Trojan-Downloader.Win32.LoadAdv.gen        File: C:\Documents and Settings\Owner\×ÀÃæ\Suspicious2.rar/loadadv579.exe//PE_Patch.UPX//UPX
detected: virus Heur.Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\Suspicious2.rar/netdde32.exe//PE_Patch.Upolyx
detected: virus Virus.Win32.AutoRun.gr        File: C:\Documents and Settings\Owner\×ÀÃæ\Suspicious2.rar/NewTemp.dll//PE_Patch
detected: virus Virus.Win32.AutoRun.go        File: C:\Documents and Settings\Owner\×ÀÃæ\Suspicious2.rar/shenji.exe
detected: virus Virus.Win32.AutoRun.go        File: C:\Documents and Settings\Owner\×ÀÃæ\Suspicious2.rar/svchost.exe
detected: Trojan program Trojan-PSW.Win32.Agent.mi        File: C:\Documents and Settings\Owner\×ÀÃæ\Suspicious2.rar/SysWin64.Jmp//FSG
detected: Trojan program Trojan-Spy.Win32.Agent.pn        File: C:\Documents and Settings\Owner\×ÀÃæ\Suspicious2.rar/winsys16_070812.dll
detected: Trojan program Trojan-PSW.Win32.Agent.mi        File: C:\Documents and Settings\Owner\×ÀÃæ\Suspicious2.rar/WinSys64.Sys
detected: Trojan program Trojan-Downloader.Win32.Small.eqn        File: C:\Documents and Settings\Owner\×ÀÃæ\Suspicious2.rar/wr-1-20.exe//PE_Patch.Upolyx//PE_Patch.UPX//UPX

xxwpk007

Starting the file scan:

Begin scan in 'G:\样本\Suspicious2'
G:\样本\Suspicious2\
  ieBF0E.tmp
  InfoWin.Dll
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
      [WARNING]   The file was ignored!
  InfoWin.Sys
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!
  loadadv579.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [WARNING]   The file was ignored!
  mscpx32r.det
  my_70145[1].exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!
  netdde32.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [WARNING]   The file was ignored!
  NewTemp.dll
      [DETECTION] Is the Trojan horse TR/Drop.Age.15671.B
      [WARNING]   The file was ignored!
  nshA.tmp
  ocinfo.dat
  s11870848861.dat
  s11870848862.dat
  shenji.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [WARNING]   The file was ignored!
  svchost.dat
  svchost.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [WARNING]   The file was ignored!
  SVKP.sys
  SysWin64.Jmp
      [DETECTION] Is the Trojan horse TR/PSW.Agent.MI.6
      [WARNING]   The file was ignored!
  Uninst.exe
      [DETECTION] Contains signature of the Ad- or Spyware ADSPY/Boran.BD
      [WARNING]   The file was ignored!
  UPDE.tmp
  winsys16_070812.dll
      [DETECTION] Is the Trojan horse TR/Spy.Agent.PN.341
      [WARNING]   The file was ignored!
  WinSys64.Sys
      [DETECTION] Is the Trojan horse TR/PSW.Agent.MI.6
      [WARNING]   The file was ignored!
  wr-1-20.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [WARNING]   The file was ignored!

微点卫士

微点：
木马名称:Trojan.Win32.Genetik.blq

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SUSPICIOUS2\INFOWIN.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Downloader.Win32.LoadAdv.ac

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SUSPICIOUS2\LOADADV579.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan.Win32.Genetik.blj

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SUSPICIOUS2\SHENJI.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SUSPICIOUS2\WR-1-20.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SUSPICIOUS2\NETDDE32.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\NETDDE32.EXE
是否删除木马程序及其衍生物?
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SUSPICIOUS2\MY_70145[1].EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:1628
远端地址:58.211.7.25(江苏·苏州)
远端端口:80
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SUSPICIOUS2\MY_70145[1].EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TEMPAQ
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SUSPICIOUS2\SVCHOST.EXE
被修改文件:
C:\WINDOWS.0\SYSTEM32\DLLCACHE\SVCHOST.EXE
是否阻止文件被修改?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SUSPICIOUS2\SVCHOST.EXE
是否删除病毒程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SUSPICIOUS2\UNINST.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\~NSU.TMP\AU_.EXE
是否删除木马程序及其衍生物?

能运行的都拦截了

xxwpk007

蜘蛛4个
[Scan path] G:\样本\Suspicious2
G:\样本\Suspicious2\ieBF0E.tmp - Ok
>G:\样本\Suspicious2\InfoWin.Dll infected with Trojan.StartPage.372
>G:\样本\Suspicious2\InfoWin.Sys probably infected with DLOADER.Trojan
>G:\样本\Suspicious2\loadadv579.exe - Ok
G:\样本\Suspicious2\mscpx32r.det - Ok
G:\样本\Suspicious2\my_70145[1].exe - Ok
G:\样本\Suspicious2\netdde32.exe - Ok
G:\样本\Suspicious2\NewTemp.dll infected with Win32.HLLW.Autoruner.249
G:\样本\Suspicious2\nshA.tmp - Ok
G:\样本\Suspicious2\ocinfo.dat - Ok
G:\样本\Suspicious2\s11870848861.dat - Ok
G:\样本\Suspicious2\s11870848862.dat - Ok
G:\样本\Suspicious2\shenji.exe - Ok
G:\样本\Suspicious2\svchost.dat - Ok
G:\样本\Suspicious2\svchost.exe - Ok
G:\样本\Suspicious2\SVKP.sys - Ok
>>G:\样本\Suspicious2\SysWin64.Jmp - Ok
G:\样本\Suspicious2\Uninst.exe - Ok
G:\样本\Suspicious2\UPDE.tmp - Ok
G:\样本\Suspicious2\winsys16_070812.dll - Ok
G:\样本\Suspicious2\WinSys64.Sys - Ok
G:\样本\Suspicious2\wr-1-20.exe infected with Trojan.DownLoader.26881

xxwpk007

用AntiVirusKit扫描病毒
版本 16.0.7
病毒库签名 2007-8-13
开始时间: 2007-8-14 21:04
引擎: KAV 引擎 (AVK 17.6833), BD  引擎 (BD 17.4714)
启发式: 打开
压缩文件: 打开
系统区域: 打开

扫描系统区域...
扫描所选择的目录和文件...
对象: InfoWin.Dll
        路径: G:\样本\Suspicious2
        Status: 可疑病毒
        病毒: Trojan.Delf.NEB (BD  引擎)
对象: InfoWin.Sys
        路径: G:\样本\Suspicious2
        Status: 已发现病毒
        病毒: Generic.Malware.Fdldsp.3A51D6EB (BD  引擎)
对象: loadadv579.exe
        路径: G:\样本\Suspicious2
        Status: 已发现病毒
        病毒: Trojan-Downloader.Win32.LoadAdv.gen (KAV 引擎), Trojan.Downloader.LoadAdv.B (BD  引擎)
对象: NewTemp.dll
        路径: G:\样本\Suspicious2
        Status: 已发现病毒
        病毒: Virus.Win32.AutoRun.gr (KAV 引擎)
对象: shenji.exe
        路径: G:\样本\Suspicious2
        Status: 已发现病毒
        病毒: Trojan.PWS.TT (BD  引擎)
对象: svchost.exe
        路径: G:\样本\Suspicious2
        Status: 已发现病毒
        病毒: Trojan.PWS.TT (BD  引擎)
对象: SysWin64.Jmp
        路径: G:\样本\Suspicious2
        Status: 已发现病毒
        病毒: Trojan-PSW.Win32.Agent.mi (KAV 引擎), Generic.PWStealer.C52FE99B (BD  引擎)
对象: winsys16_070812.dll
        路径: G:\样本\Suspicious2
        Status: 已发现病毒
        病毒: Trojan-Spy.Win32.Agent.pn (KAV 引擎)
对象: WinSys64.Sys
        路径: G:\样本\Suspicious2
        Status: 已发现病毒
        病毒: Trojan-PSW.Win32.Agent.mi (KAV 引擎), Generic.PWStealer.0CCADD8D (BD  引擎)
对象: wr-1-20.exe
        路径: G:\样本\Suspicious2
        Status: 已发现病毒
        病毒: Trojan-Downloader.Win32.Small.eqn (KAV 引擎), Trojan.Downloader.Small.EQN (BD  引擎)
分析完毕: 2007-8-14 21:05
    已检查 22 个文件
    已发现 9 个染毒文件
    发现 1 个可疑文件

碧水寒潭

Start of the scan: 2007年8月14日  22:09

Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\Suspicious2.rar
  [0] Archive type: RAR
  --> InfoWin.Dll
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
  --> InfoWin.Sys
      [DETECTION] Contains suspicious code HEUR/Malware
  --> loadadv579.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> my_70145[1].exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> netdde32.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> NewTemp.dll
      [DETECTION] Is the Trojan horse TR/Drop.Age.15671.B
  --> shenji.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> svchost.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> SysWin64.Jmp
      [DETECTION] Is the Trojan horse TR/PSW.Agent.MI.6
  --> winsys16_070812.dll
      [DETECTION] Is the Trojan horse TR/Spy.Agent.PN.341
  --> WinSys64.Sys
      [DETECTION] Is the Trojan horse TR/PSW.Agent.MI.6
  --> wr-1-20.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [INFO]      The file was deleted!


End of the scan: 2007年8月14日  22:10
Used time: 00:13 min

The scan has been done completely.

      1 Scanning directories
     23 Files were scanned
     12 viruses and/or unwanted programs were found
      2 classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      9 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

hj5abc