最后一堆，下线了[MD5: 828C85 。。。

1688388728

反病毒专家 AntiVirusKit 2007 扫描病毒日志记录
版本
双引擎反病毒签名 8/14/2007
开始时间: 8/14/2007 21:46
引擎: KAV 引擎 (AVK 17.6863), AVST 引擎 (AVKB 17.338)
高启发式: 打开
压缩文件: 打开
系统区域: 打开

扫描系统区域...
扫描所选择的目录和文件...
对象: 1228.exe/stream data0001
        在压缩档案里: D:\病毒库\Suspicious[1]\Suspicious\1228.rar
狀態: 已发现病毒
        病毒: Email-Worm.Win32.Zhelatin.gv (KAV 引擎)
对象: 1228.exe/stream data0002
        在压缩档案里: D:\病毒库\Suspicious[1]\Suspicious\1228.rar
狀態: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.AdMoke.ar (KAV 引擎)
对象: 1228.exe/stream data0005
        在压缩档案里: D:\病毒库\Suspicious[1]\Suspicious\1228.rar
狀態: 已发现病毒
        病毒: Trojan-Downloader.Win32.VB.bao (KAV 引擎)
对象: 1228.exe/stream data0007
        在压缩档案里: D:\病毒库\Suspicious[1]\Suspicious\1228.rar
狀態: 已发现病毒
        病毒: Trojan-Downloader.Win32.Small.eqn (KAV 引擎)
对象: 1228.exe/stream data0008
        在压缩档案里: D:\病毒库\Suspicious[1]\Suspicious\1228.rar
狀態: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.NewWeb.i (KAV 引擎)
对象: 1228.exe
        在压缩档案里: D:\病毒库\Suspicious[1]\Suspicious\1228.rar
狀態: 已发现病毒
        病毒: Win32:Trojan-gen. {Other} (AVST 引擎)
对象: 1228.rar
        路径: D:\病毒库\Suspicious[1]\Suspicious
狀態: 已发现病毒
        病毒: Email-Worm.Win32.Zhelatin.gv, not-a-virus:AdWare.Win32.AdMoke.ar, Trojan-Downloader.Win32.VB.bao, Trojan-Downloader.Win32.Small.eqn, not-a-virus:AdWare.Win32.NewWeb.i (KAV 引擎), Win32:Trojan-gen. {Other} (AVST 引擎)
对象: 13d012[1].exe
        路径: D:\病毒库\Suspicious[1]\Suspicious
狀態: 已发现病毒
        病毒: Win32:Trojan-gen. {Other} (AVST 引擎)
对象: 525.exe
        路径: D:\病毒库\Suspicious[1]\Suspicious
狀態: 已发现病毒
        病毒: Trojan-Downloader.Win32.Ieser.c (KAV 引擎), Win32:Delf-FKJ [Trj] (AVST 引擎)
对象: acpidisk2.sys
        路径: D:\病毒库\Suspicious[1]\Suspicious
狀態: 已发现病毒
        病毒: Win32:Cinmus-J [Rtk] (AVST 引擎)
对象: cnprov.sys
        路径: D:\病毒库\Suspicious[1]\Suspicious
狀態: 已发现病毒
        病毒: Win32:Adware-gen. [Adw] (AVST 引擎)
对象: dodolo223.exe
        路径: D:\病毒库\Suspicious[1]\Suspicious
狀態: 已发现病毒
        病毒: Trojan-Downloader.Win32.QQHelper.xb (KAV 引擎), Win32:Small-DJC [Trj] (AVST 引擎)
对象: rawrejeszpnnn.dll
        路径: D:\病毒库\Suspicious[1]\Suspicious
狀態: 已发现病毒
        病毒: Trojan-Downloader.Win32.Ieser.c (KAV 引擎), Win32:Delf-FKI [Trj] (AVST 引擎)
扫描完成: 8/14/2007 21:46
    已检查 9 个文件
    已发现 7 个染毒文件

uhthn2002

C:\Documents and Settings\uhthn\Desktop\Suspicious\dodolo223.exe : infected Trojan.PWS.Qqpass.1131


Directories       : 0       Files in archives:      Files on disks:
Archives:                   - total       : 1       - total       : 9     
- scanned         : 1       -  scanned    : 1       - scanned     : 9     
- contain viruses : 0       -  infected   : 0       - infected    : 1     
- deleted         : 0       -  suspicious : 0       - suspicious  : 0

The EQs

Scan performed at: 2007-8-15 3:32:45
Scanning Log
NOD32 version 2460 (20070814) NT
Command line: C:\Documents and Settings\EQ2\桌面\Suspicious
Operating memory - is OK

Date: 15.8.2007  Time: 03:32:51
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\Suspicious\
C:\Documents and Settings\EQ2\桌面\Suspicious\Suspicious\1228.rar ?RAR ?1228.exe ?NSIS ?wr-1-22.exe - Win32/TrojanDownloader.Small.EQN trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\Suspicious\Suspicious\1228.rar ?RAR ?1228.exe ?NSIS ?li01.exe ?NSIS ?Local.dll - Win32/TrojanDownloader.Agent.NQH trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\Suspicious\Suspicious\1228.rar ?RAR ?1228.exe ?NSIS ?eqi0yahoo_005.exe - probably a variant of Win32/Genetik trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\Suspicious\Suspicious\13d012[1].exe ?NSIS ?netdde32.exe - probably unknown NewHeur_PE virus [7] - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\Suspicious\Suspicious\13d012[1].exe ?NSIS ?d03.exe ?NSIS ?cpush.dll - probably a variant of Win32/Adware.BHO.AV application - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\Suspicious\Suspicious\525.exe - a variant of Win32/TrojanDownloader.Ieser trojan
C:\Documents and Settings\EQ2\桌面\Suspicious\Suspicious\acpidisk2.sys - a variant of Win32/Adware.Cinmus application
C:\Documents and Settings\EQ2\桌面\Suspicious\Suspicious\rawrejeszpnnn.dll - a variant of Win32/TrojanDownloader.Ieser trojan
Number of scanned files: 20
Number of threats found: 8
Number of files cleaned: 5
Time of completion: 03:32:58 Total scanning time: 7 sec (00:00:07)

Notes:
[7] File is probably infected with an unknown virus.

woai_jolin

===================================================================================================
Norman Virus Control On-demand scanner 7.0.0.9

NSE revision 5.91.04
nvcbin.def revision 5.90.00 of 2007/08/09 20:07:15 (824384 variants)
nvcmacro.def revision 5.90.00 of 2007/08/06 19:46:49 (20358 variants)
Total number of variants: 844742
===================================================================================================

       Time  Filename                                                     Virus name
---------------------------------------------------------------------------------------------------

- Scanning drive: F:\
- Scanning system areas of drive: F:\
- Scanning files in the directory: F:\v\Suspicious\
        0 ms F:\v\Suspicious\1228.rar                                    
       62 ms F:\v\Suspicious\13d012[1].exe                                Trojan Smalltroj.gen5 ()
- File F:\v\Suspicious\13d012[1].exe quarantined.
- File F:\v\Suspicious\13d012[1].exe deleted.
     6156 ms F:\v\Suspicious\525.exe                                    
       47 ms F:\v\Suspicious\acpidisk2.sys                              
      156 ms F:\v\Suspicious\cnprov.sys                                 
        0 ms F:\v\Suspicious\dodolo223.exe                                Aggressive commersial W32/IEHlpr.FG ()
- File F:\v\Suspicious\dodolo223.exe quarantined.
- File F:\v\Suspicious\dodolo223.exe deleted.
     7172 ms F:\v\Suspicious\host.exe                                    
       15 ms F:\v\Suspicious\rawrejeszpnnn.dll                           
       78 ms F:\v\Suspicious\setup291[1].exe                             

===================================================================================================

The scanning started: 2007/08/15 08:36:34
               ended: 2007/08/15 08:36:49
Logged on as        : Administrator
on hostname         : 2FF87FC2B9AB46F

Scanning results:
   Total number of files found..............................:       9
   Number of files scanned..................................:       9
   Number of files/directories skipped due to exclude list..:       0
   Number of files that could not be opened.................:       0
   Number of archive files unpacked.........................:       0
   Number of archive files not unpacked.....................:       0
   Number of infections.....................................:       2

Copyright (c) 1993-2005 Norman ASA.