[MD5: 6D521F EDA804 9743AE 2346B3 C1E336]

promised

1

wangjay1980

deleted: virus Email-Worm.Win32.Zhelatin.gv        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/win32.exe
deleted: Trojan program Trojan.Win32.Agent.abe        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/safdsa.exe

The EQs

Scan performed at: 2007-8-16 11:30:42
Scanning Log
NOD32 version 2465 (20070816) NT
Command line: C:\Documents and Settings\EQ2\桌面\样本.rar
Operating memory - is OK

Date: 16.8.2007  Time: 11:30:48
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\样本.rar
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?win32.exe - Win32/Nuwar.Gen worm
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?safdsa.exe - a variant of Win32/Agent.ABE trojan
Number of scanned files: 6
Number of threats found: 2
Number of files cleaned: 1
Time of completion: 11:30:48 Total scanning time: 0 sec (00:00:00)

碧水寒潭

Start of the scan: 2007年8月16日  11:31

Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\样本.rar
  [0] Archive type: RAR
  --> win32.exe
      [DETECTION] Contains signature of the worm WORM/Zhelatin.Gen
  --> safdsa.exe
      [DETECTION] Is the Trojan horse TR/Spy.Agent.ABE
  --> sdadlrow-t2.exe
      [DETECTION] Is the Trojan horse TR/PSW.Poker.B
  --> soft210.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was deleted!


End of the scan: 2007年8月16日  11:31
Used time: 00:08 min

The scan has been done completely.

      1 Scanning directories
      6 Files were scanned
      4 viruses and/or unwanted programs were found
      0 classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

欠妳緈諨

xxwpk007

用AntiVirusKit扫描病毒
版本 16.0.7
病毒库签名 2007-8-15
开始时间: 2007-8-16 11:31
引擎: KAV 引擎 (AVK 17.6876), BD  引擎 (BD 17.4738)
启发式: 打开
压缩文件: 打开
系统区域: 打开

扫描系统区域...
扫描所选择的目录和文件...
对象: win32.exe
        路径: G:\样本\样本
        Status: 已发现病毒
        病毒: Email-Worm.Win32.Zhelatin.gv (KAV 引擎), Trojan.Peed.IEL (BD  引擎)
对象: safdsa.exe
        路径: G:\样本\样本
        Status: 已发现病毒
        病毒: Trojan.Win32.Agent.abe (KAV 引擎)
对象: soft210.exe
        路径: G:\样本\样本
        Status: 可疑病毒
        病毒: BehavesLike:Trojan.Downloader (BD  引擎)
分析完毕: 2007-8-16 11:32
    已检查 5 个文件
    已发现 2 个染毒文件
    发现 1 个可疑文件

tracydk

报壳

微点卫士

微点：
蠕虫名称:Email-Worm.Win32.Zhelatin.yz

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\WIN32.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?
蠕虫名称:Worm.Win32.Agent.dpk

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SAFDSA.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SOFT210.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:4570
远端地址:60.191.254.73(浙江·金华)
远端端口:80
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SOFT210.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TEMPORARY INTERNET FILES\CONTENT.IE5\MVKZMRIH\WXPSETUP210[1].TXT
2) C:\DWNSETUP\WXPSETUP210.EXE
3) C:\DWNSETUP\WEBHELP.EXE
4) C:\WINDOWS.0\SYSTEM32\WEBHELP.EXE
5) C:\WINDOWS.0\SYSTEM32\WEBSHOW.DLL
6) C:\WINDOWS.0\SYSTEM32\DRIVERS\WEBSHOW.DRV
7) C:\WINDOWS.0\SYSTEM32\DRIVERS\WEBHELP.DRV
8) C:\DWNSETUP\WEBSHOW.DLL
是否删除木马程序及其衍生物?
程序:
C:\DWNSETUP\WXPSETUP210.EXE
删除失败!

延迟删除文件!程序:
C:\DWNSETUP\WEBHELP.EXE
删除失败!

延迟删除文件!程序:
C:\DWNSETUP\WEBSHOW.DLL
删除失败!

延迟删除文件!

user10.exe和sdadlrow-t2.exe不报

wangjay1980

soft210.exey - Trojan-Downloader.Win32.Delf.bgp

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

sdadlrow-t2.exey,
user10.exey

These files are corrupted.

woai_jolin

BitDefender Log File
Product : Bitdefender Internet Security
Version : BitDefender UIScanner v.11
Log date : 13:01:05 16/08/2007
Log path : C:\Documents and Settings\Administrator\Application Data\BitDefender\Desktop\Profiles\Logs\contextual\1187240465_9_02.xml

Scan Paths: Path0000: F:\v\v1\样本.rar


Scan Options: Scan for viruses : Yes
Scan for adware : Yes
Scan for spyware : Yes
Scan for applications : Yes
Scan for dialers : Yes
Scan for rootkits : No


Target selection options: Scan registry keys : No
Scan cookies : No
Scan boot sectors : No
Scan memory processes : No
Scan archives : Yes
Scan runtime packers : Yes
Scan email : Yes
Scan all files : No
Heuristic Scan : Yes
Scanned extenstions : (null)
Exclude extensions :  


Target Processing Default action for infected objects : Disinfect
Default action for suspicious objects : None
Default action for hidden objects : None


Scan engines summary Number of virus signatures : 754472
Archive plugins : 40
Email plugins : 6
Scan plugins : 12
Archive plugins : 40
System plugins : 4
Unpack plugins : 6


Overall scan summary Scanned items : 12
Infected items : 0
Suspicious items : 2
Resolved items : 0
Individual viruses found : 0
Scanned directories : 0
Scanned boot sectors : 0
Scanned archives : 2
Input-output errors : 0
Scan time : 00:00:00:05
Files per second : 2


Scanned files summary Scanned : 12
Infected : 0


Scanned processes summary Scanned : 0
Infected : 0


Scanned registry keys summary Scanned : 0
Infected : 0


Scanned cookies summary Scanned : 0
Infected : 0


Remaining issues:Object Name Threat Name  Final Status


Resolved issues:Object Name Threat Name  Final Status
F:\v\v1\样本.rar BehavesLike:Trojan.Downloader Deleted