最后一堆，下线了[MD5: 828C85 。。。

zane_xzz

[MD5: 828C85 C576A0 19CA25 0BDD79 4F0818 622991 6938D6 36D74F F243EF]

tracydk

20个

xxwpk007

已检测到: 病毒 Email-Worm.Win32.Zhelatin.gv 文件: G:\样本\Suspicious[1]\Suspicious\1228.rar/1228.exe//stream//data0001
已检测到: 广告软件 not-a-virus:AdWare.Win32.AdMoke.ar 文件: G:\样本\Suspicious[1]\Suspicious\1228.rar/1228.exe//stream//data0002//ASPack
已检测到: 病毒 Heur.Invader (变种) 文件: G:\样本\Suspicious[1]\Suspicious\1228.rar/1228.exe//stream//data0003
已检测到: 木马程序 Trojan-Downloader.Win32.VB.bao 文件: G:\样本\Suspicious[1]\Suspicious\1228.rar/1228.exe//stream//data0005
已检测到: 木马程序 Trojan-Downloader.Win32.Small.eqn 文件: G:\样本\Suspicious[1]\Suspicious\1228.rar/1228.exe//stream//data0007//PE_Patch.Upolyx//PE_Patch.UPX//UPX
已检测到: 广告软件 not-a-virus:AdWare.Win32.NewWeb.i 文件: G:\样本\Suspicious[1]\Suspicious\1228.rar/1228.exe//stream//data0008
已检测到: 病毒 Heur.Trojan.Generic (变种) 文件: G:\样本\Suspicious[1]\Suspicious\1228.rar/1228.exe//stream//data0009
已检测到: 病毒 Heur.Trojan.Generic (变种) 文件: G:\样本\Suspicious[1]\Suspicious\13d012[1].exe//data0002//PE_Patch.Upolyx
已检测到: 木马程序 Trojan-Downloader.Win32.Ieser.c 文件: G:\样本\Suspicious[1]\Suspicious\525.exe//PE_Patch.PECompact//PecBundle//PECompact
已检测到: 木马程序 Trojan-Downloader.Win32.QQHelper.xb 文件: G:\样本\Suspicious[1]\Suspicious\dodolo223.exe//UPX
已检测到: 木马程序 Trojan-Downloader.Win32.Ieser.c 文件: G:\样本\Suspicious[1]\Suspicious\rawrejeszpnnn.dll
已检测到: 木马程序 Trojan-Downloader.Win32.Tiny.hu 文件: G:\样本\Suspicious[1]\Suspicious\setup291[1].exe//#/cdnprh.dll

[ 本帖最后由 xxwpk007 于 2007-8-14 21:25 编辑 ]

xxwpk007

Starting the file scan:

Begin scan in 'G:\样本\Suspicious[1]'
G:\样本\Suspicious[1]\Suspicious\
  1228.rar
    [0] Archive type: RAR
    --> 1228.exe
  13d012[1].exe
  525.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [WARNING]   The file was ignored!
  acpidisk2.sys
      [DETECTION] Contains signature of the rootkit RKIT/Cinmus.M
      [WARNING]   The file was ignored!
  cnprov.sys
      [DETECTION] Contains signature of the rootkit RKIT/AdProt
      [WARNING]   The file was ignored!
  dodolo223.exe
      [DETECTION] Contains signature of the Ad- or Spyware ADSPY/Cinmus.HV
      [WARNING]   The file was ignored!
  host.exe
      [DETECTION] Contains signature of the Ad- or Spyware ADSPY/Cdnup.G
      [WARNING]   The file was ignored!
  rawrejeszpnnn.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!
  setup291[1].exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!

xxwpk007

2个
[Scan path] G:\样本\Suspicious[1]
G:\样本\Suspicious[1]\Suspicious\13d012[1].exe - Ok
>>G:\样本\Suspicious[1]\Suspicious\525.exe - Ok
G:\样本\Suspicious[1]\Suspicious\acpidisk2.sys - Ok
G:\样本\Suspicious[1]\Suspicious\cnprov.sys - Ok
>G:\样本\Suspicious[1]\Suspicious\dodolo223.exe infected with Trojan.PWS.Qqpass.1192
>>G:\样本\Suspicious[1]\Suspicious\host.exe is adware program Adware.Cdn
G:\样本\Suspicious[1]\Suspicious\rawrejeszpnnn.dll - Ok
G:\样本\Suspicious[1]\Suspicious\setup291[1].exe - Ok

xxwpk007

用AntiVirusKit扫描病毒
版本 16.0.7
病毒库签名 2007-8-13
开始时间: 2007-8-14 21:27
引擎: KAV 引擎 (AVK 17.6833), BD  引擎 (BD 17.4714)
启发式: 打开
压缩文件: 打开
系统区域: 打开

扫描系统区域...
扫描所选择的目录和文件...
对象: 1228.exe/stream data0005
        在压缩档案里: G:\样本\Suspicious[1]\Suspicious\1228.rar
        Status: 已发现病毒
        病毒: Trojan-Downloader.Win32.VB.bao (KAV 引擎)
对象: 1228.exe/stream data0007
        在压缩档案里: G:\样本\Suspicious[1]\Suspicious\1228.rar
        Status: 已发现病毒
        病毒: Trojan-Downloader.Win32.Small.eqn (KAV 引擎)
对象: 1228.exe/stream data0008
        在压缩档案里: G:\样本\Suspicious[1]\Suspicious\1228.rar
        Status: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.NewWeb.i (KAV 引擎)
对象: 1228.exe=>(NSIS o) lzma_solid_nsis0002
        在压缩档案里: G:\样本\Suspicious[1]\Suspicious\1228.rar
        Status: 已发现病毒
        病毒: Trojan.Adload.L (BD  引擎)
对象: 1228.exe=>(NSIS o) lzma_solid_nsis0003
        在压缩档案里: G:\样本\Suspicious[1]\Suspicious\1228.rar
        Status: 已发现病毒
        病毒: Win32.Virtob.P (BD  引擎)
对象: 1228.exe=>(NSIS o) lzma_solid_nsis0007
        在压缩档案里: G:\样本\Suspicious[1]\Suspicious\1228.rar
        Status: 已发现病毒
        病毒: Trojan.Downloader.Small.EQN (BD  引擎)
对象: 1228.exe=>(NSIS o) lzma_solid_nsis0009
        在压缩档案里: G:\样本\Suspicious[1]\Suspicious\1228.rar
        Status: 已发现病毒
        病毒: DeepScan:Generic.Malware.SBdldspg.92B5B2D4 (BD  引擎)
对象: 1228.rar
        路径: G:\样本\Suspicious[1]\Suspicious
        Status: 已发现病毒
        病毒: Trojan-Downloader.Win32.VB.bao, Trojan-Downloader.Win32.Small.eqn, not-a-virus:AdWare.Win32.NewWeb.i (KAV 引擎), Trojan.Adload.L, Win32.Virtob.P, Trojan.Downloader.Small.EQN, DeepScan:Generic.Malware.SBdldspg.92B5B2D4 (BD  引擎)
对象: 525.exe
        路径: G:\样本\Suspicious[1]\Suspicious
        Status: 已发现病毒
        病毒: Trojan-Downloader.Win32.Ieser.c (KAV 引擎)
对象: dodolo223.exe
        路径: G:\样本\Suspicious[1]\Suspicious
        Status: 已发现病毒
        病毒: Trojan-Downloader.Win32.QQHelper.xb (KAV 引擎), Dropped:Generic.PWStealer.C52FE99B (BD  引擎)
对象: rawrejeszpnnn.dll
        路径: G:\样本\Suspicious[1]\Suspicious
        Status: 已发现病毒
        病毒: Trojan-Downloader.Win32.Ieser.c (KAV 引擎)
分析完毕: 2007-8-14 21:27
    已检查 9 个文件
    已发现 4 个染毒文件
    发现 0 个可疑文件

微点卫士

微点：
木马名称:Trojan-Downloader.Win32.Ieser.bk

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SUSPICIOUS\525.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SUSPICIOUS\ACPIDISK2.SYS
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Downloader.Win32.QQHelper.fmp

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SUSPICIOUS\DODOLO223.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Downloader.Win32.Ieser.bl

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SUSPICIOUS\RAWREJESZPNNN.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知间谍软件

程序:
C:\WINDOWS.0\SYSTEM32\NETDDE32.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知间谍软件

程序:
C:\WINDOWS.0\SYSTEM32\D03.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SUSPICIOUS\HOST.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\2D\CNDSV.DLL
2) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\2D\CNPROV.SYS
3) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\2D\CNPROVH.DLL4) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\2D\CONFIG.EXE
5) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\2D\CONVS.DLL
6) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\2D\IDNREG.DLL
7) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\2D\IDNSVR.DLL
8) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\2D\IDNSVR.EXE
9) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\2D\IEAUX.DLL
10) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\2D\LOADER.EXE
11) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\2D\SETUP.DLL
12) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\2D\SETUP.EXE
13) C:\PROGRAM FILES\OCINS\CONVS.DLL
14) C:\PROGRAM FILES\OCINS\UNINSTALL.EXE
15) C:\PROGRAM FILES\OCINS\IDNSVR.EXE
16) C:\PROGRAM FILES\OCINS\IDNSVR.DLL
17) C:\PROGRAM FILES\OCINS\CNDSV.DLL
18) C:\PROGRAM FILES\OCINS\CONFIG.EXE
19) C:\PROGRAM FILES\OCINS\IEAUX.DLL
20) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\2D\UNINSTALL.EXE
是否删除木马程序及其衍生物?
程序:
C:\PROGRAM FILES\OCINS\IEAUX.DLL
是可疑程序，是否阻止该进程继续运行?
程序:
C:\PROGRAM FILES\OCINS\IEAUX.DLL
是否删除病毒程序?
木马名称:Trojan-Downloader.Win32.Tiny.um

程序:
C:\WINDOWS.0\SYSTEM32\CDNPRH.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\HOST.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SUSPICIOUS\SETUP291[1].EXE
是否删除木马程序及其衍生物?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SUSPICIOUS\1228.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

xxwpk007

木马名称:Trojan-Downloader.Win32.Ieser.bl

程序:
G:\样本\SUSPICIOUS[1]\SUSPICIOUS\RAWREJESZPNNN.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-Downloader.Win32.QQHelper.fmp

程序:
G:\样本\SUSPICIOUS[1]\SUSPICIOUS\DODOLO223.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-Downloader.Win32.Ieser.bk

程序:
G:\样本\SUSPICIOUS[1]\SUSPICIOUS\525.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?



程序:
G:\样本\SUSPICIOUS[1]\SUSPICIOUS\13D012[1].EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\NETDDE32.EXE
2) C:\WINDOWS\SYSTEM32\D03.EXE
3) C:\PROGRAM FILES\COMMON FILES\CPUSH\UNINST.EXE
是否删除木马程序及其衍生物?

木马名称:未知木马

程序:
G:\样本\SUSPICIOUS[1]\SUSPICIOUS\13D012[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-Downloader.Win32.Small.kls

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\WR-1-22.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
G:\样本\SUSPICIOUS[1]\SUSPICIOUS\1228.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\WIN32.EXE
2) C:\WINDOWS\SYSTEM32\KERNELWIND32.EXE
3) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\506.EXE
4) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LOAD1.EXE
5) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\MY_70229.EXE
6) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ICCO.EXE
7) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\10037.EXE
8) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LI01.EXE
9) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\EQI0YAHOO_005.EXE
是否删除木马程序及其衍生物?

木马名称:未知木马

程序:
G:\样本\SUSPICIOUS[1]\SUSPICIOUS\1228.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\PROGRAM FILES\OCINS\IEAUX.DLL
是可疑程序，是否阻止该进程继续运行?

程序:
C:\PROGRAM FILES\OCINS\IEAUX.DLL
是否删除病毒程序?

木马名称:Trojan-Downloader.Win32.Tiny.um

程序:
C:\WINDOWS\SYSTEM32\CDNPRH.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

wangjay1980

detected: virus Email-Worm.Win32.Zhelatin.gv        File: C:\Documents and Settings\Owner\×ÀÃæ\Suspicious\1228.rar/1228.exe//stream//data0001
detected: adware not-a-virus:AdWare.Win32.AdMoke.ar        File: C:\Documents and Settings\Owner\×ÀÃæ\Suspicious\1228.rar/1228.exe//stream//data0002//ASPack
detected: virus Heur.Invader (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\Suspicious\1228.rar/1228.exe//stream//data0003
detected: Trojan program Trojan-Downloader.Win32.VB.bao        File: C:\Documents and Settings\Owner\×ÀÃæ\Suspicious\1228.rar/1228.exe//stream//data0005
detected: Trojan program Trojan-Downloader.Win32.Small.eqn        File: C:\Documents and Settings\Owner\×ÀÃæ\Suspicious\1228.rar/1228.exe//stream//data0007//PE_Patch.Upolyx//PE_Patch.UPX//UPX
detected: adware not-a-virus:AdWare.Win32.NewWeb.i        File: C:\Documents and Settings\Owner\×ÀÃæ\Suspicious\1228.rar/1228.exe//stream//data0008
detected: virus Heur.Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\Suspicious\1228.rar/1228.exe//stream//data0009
detected: virus Heur.Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\Suspicious\13d012[1].exe//data0002//PE_Patch.Upolyx
detected: Trojan program Trojan-Downloader.Win32.Ieser.c        File: C:\Documents and Settings\Owner\×ÀÃæ\Suspicious\525.exe//PE_Patch.PECompact//PecBundle//PECompact
detected: Trojan program Trojan-Downloader.Win32.QQHelper.xb        File: C:\Documents and Settings\Owner\×ÀÃæ\Suspicious\dodolo223.exe//UPX
detected: Trojan program Trojan-Downloader.Win32.Ieser.c        File: C:\Documents and Settings\Owner\×ÀÃæ\Suspicious\rawrejeszpnnn.dll
detected: Trojan program Trojan-Downloader.Win32.Tiny.hu        File: C:\Documents and Settings\Owner\×ÀÃæ\Suspicious\setup291[1].exe//#/cdnprh.dll

欠妳緈諨

总共才9个毒,AVAST删除8个