[MD5: CFD6DF F91119 EFB6EB]

promised

1

红心王子

Trojan.DL.Multi.wjc      
Trojan.Win32.Delf.rsq

siman.yu

AVAST截杀！

wangjay1980

detected: Trojan program Trojan-Downloader.Win32.Delf.bki        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/m1.exe//PE_Patch.UPX//UPX
detected: Trojan program Trojan-Downloader.Win32.Delf.bdc        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/321.exe//NSPack

The EQs

微点卫士

微点：
木马名称:Trojan-Downloader.Win32.Delf.fuu

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\M1.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
蠕虫名称:Worm.Win32.Agent.dqz

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\SERVER.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\321.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:3008
远端地址:222.141.50.183(河南·洛阳)
远端端口:80
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\321.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\JHQ.EXE
2) C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\IEINFO5.DLL
3) C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\IEINFO5.SYS
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\321.EXE
可疑程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\JHQ.EXE
2) C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\IEINFO5.DLL
3) C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\IEINFO5.SYS
4) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\_XIARAN.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\321.EXE
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\_XIARAN.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\567.EXE
是否删除木马程序及其衍生物?

红心王子

金山毒霸 2007.6.20.249 2007.8.16 2007-08-16 Win32.Troj.Agent.tp.252879
江民杀毒 10.00.650 2007.08.15 2007-08-15 Trojan/PSW.GamePass.wmr

woai_jolin

BitDefender Log File
Product : Bitdefender Internet Security
Version : BitDefender UIScanner v.11
Log date : 11:11:20 16/08/2007
Log path : C:\Documents and Settings\Administrator\Application Data\BitDefender\Desktop\Profiles\Logs\contextual\1187233880_9_02.xml

Scan Paths: Path0000: F:\v\v1\样本1.rar


Scan Options: Scan for viruses : Yes
Scan for adware : Yes
Scan for spyware : Yes
Scan for applications : Yes
Scan for dialers : Yes
Scan for rootkits : No


Target selection options: Scan registry keys : No
Scan cookies : No
Scan boot sectors : No
Scan memory processes : No
Scan archives : Yes
Scan runtime packers : Yes
Scan email : Yes
Scan all files : No
Heuristic Scan : Yes
Scanned extenstions : (null)
Exclude extensions :  


Target Processing Default action for infected objects : Disinfect
Default action for suspicious objects : None
Default action for hidden objects : None


Scan engines summary Number of virus signatures : 754472
Archive plugins : 40
Email plugins : 6
Scan plugins : 12
Archive plugins : 40
System plugins : 4
Unpack plugins : 6


Overall scan summary Scanned items : 8
Infected items : 4
Suspicious items : 0
Resolved items : 0
Individual viruses found : 4
Scanned directories : 0
Scanned boot sectors : 0
Scanned archives : 2
Input-output errors : 0
Scan time : 00:00:00:06
Files per second : 1


Scanned files summary Scanned : 8
Infected : 4


Scanned processes summary Scanned : 0
Infected : 0


Scanned registry keys summary Scanned : 0
Infected : 0


Scanned cookies summary Scanned : 0
Infected : 0


Remaining issues:Object Name Threat Name  Final Status


Resolved issues:Object Name Threat Name  Final Status
F:\v\v1\样本1.rar BehavesLike:Win32.ExplorerHijack Deleted
F:\v\v1\样本1.rar Trojan.Downloader.Delf.NSO Deleted

xxwpk007

用AntiVirusKit扫描病毒
版本 16.0.7
病毒库签名 2007-8-15
开始时间: 2007-8-16 11:24
引擎: KAV 引擎 (AVK 17.6876), BD  引擎 (BD 17.4738)
启发式: 打开
压缩文件: 打开
系统区域: 打开

扫描系统区域...
扫描所选择的目录和文件...
对象: m1.exe
        路径: G:\样本\样本1
        Status: 已发现病毒
        病毒: Trojan-Downloader.Win32.Delf.bki (KAV 引擎), Trojan.Downloader.Delf.NSO (BD  引擎)
对象: 321.exe
        路径: G:\样本\样本1
        Status: 已发现病毒
        病毒: Trojan-Downloader.Win32.Delf.bdc (KAV 引擎)
对象: 567.exe
        路径: G:\样本\样本1
        Status: 已发现病毒
        病毒: BehavesLike:Win32.ExplorerHijack (BD  引擎)
分析完毕: 2007-8-16 11:24
    已检查 3 个文件
    已发现 3 个染毒文件
    发现 0 个可疑文件

碧水寒潭

Start of the scan: 2007年8月16日  11:27

Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\样本1.rar
  [0] Archive type: RAR
  --> m1.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> 321.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
  --> 567.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was deleted!


End of the scan: 2007年8月16日  11:27
Used time: 00:08 min

The scan has been done completely.

      1 Scanning directories
      4 Files were scanned
      3 viruses and/or unwanted programs were found
      0 classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found