[MD5: A5C3E1 C222A0 93DEB4]

promised

1

wangjay1980

detected: virus Heur.Invader (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾3.rar/load1.exe
detected: Trojan program Trojan-Downloader.Win32.LoadAdv.gen        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾3.rar/loadadv579.exe//PE_Patch.UPX//UPX

欠妳緈諨

The EQs

Scan performed at: 2007-8-16 11:32:19
Scanning Log
NOD32 version 2465 (20070816) NT
Command line: C:\Documents and Settings\EQ2\桌面\样本3.rar
Operating memory - is OK

Date: 16.8.2007  Time: 11:32:25
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\样本3.rar
C:\Documents and Settings\EQ2\桌面\样本3.rar ?RAR ?load1.exe - Win32/Virut.NAK virus - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\样本3.rar ?RAR ?loadadv579.exe - a variant of Win32/TrojanDownloader.Small.NUS trojan
Number of scanned files: 4
Number of threats found: 2
Number of files cleaned: 1
Time of completion: 11:32:26 Total scanning time: 1 sec (00:00:01)

碧水寒潭

Start of the scan: 2007年8月16日  11:33

Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\样本3.rar
  [0] Archive type: RAR
  --> load1.exe
      [DETECTION] Contains code of the Windows virus W32/Virut.P
  --> loadadv579.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was deleted!


End of the scan: 2007年8月16日  11:33
Used time: 00:08 min

The scan has been done completely.

      1 Scanning directories
      4 Files were scanned
      2 viruses and/or unwanted programs were found
      0 classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

红心王子

瑞星Trojan.DL.Win32.LoadAdv.h

江民Win32/Virut.f

金山  -

tracydk

诺顿PASS

微点卫士

微点：
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\LI01.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\LOCALSERVICE\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS\LOCAL.DLL
是否删除木马程序及其衍生物?
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\LOAD1.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:4746
远端地址:81.95.149.102(英国)
远端端口:80
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\LOAD1.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\LOADADV579.EXE
是否删除木马程序及其衍生物?

东京时空

NIS2007更新了病毒库，似乎有所变强。

yashoo

已删除: 病毒 Heur.Invader (变种)        文件: E:\test\样本3.rar/load1.exe
已删除: 木马程序 Trojan-Downloader.Win32.LoadAdv.gen        文件: E:\test\样本3.rar/loadadv579.exe//PE_Patch.UPX//UPX