[MD5: 4A8B67 6D521F 0959C6 9C6E25 3AAF9F D7C27D 8EAAE8 D63592 90D80D]

promised

1

wangjay1980

detected: virus Email-Worm.Win32.Zhelatin.gv        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾5.rar/kernelwind32.exe
detected: pornware not-a-virus:Porn-Dialer.Win32.GBDialer.i        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾5.rar/max1d1164v.exe
detected: Trojan program Trojan-Downloader.Win32.QQHelper.vn        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾5.rar/netdde32.exe//PE_Patch.Upolyx
detected: Trojan program Trojan-Downloader.Win32.Agent.bxg        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾5.rar/RAV00A0.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.aci        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾5.rar/RAVZXMON.exe//PE_Patch
detected: virus Heur.Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾5.rar/Server.exe
detected: virus Heur.Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾5.rar/EE99C835.EXE

The EQs

Scan performed at: 2007-8-16 11:46:47
Scanning Log
NOD32 version 2465 (20070816) NT
Command line: C:\Documents and Settings\EQ2\桌面\样本5.rar
Operating memory - is OK

Date: 16.8.2007  Time: 11:46:54
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\样本5.rar
C:\Documents and Settings\EQ2\桌面\样本5.rar ?RAR ?husjdd8s.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\EQ2\桌面\样本5.rar ?RAR ?kernelwind32.exe - Win32/Nuwar.Gen worm
C:\Documents and Settings\EQ2\桌面\样本5.rar ?RAR ?max1d1164v.exe - Win32/Dialer.NAD trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\样本5.rar ?RAR ?netdde32.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\样本5.rar ?RAR ?RAV00A0.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\EQ2\桌面\样本5.rar ?RAR ?RAVZXMON.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\EQ2\桌面\样本5.rar ?RAR ?Server.exe - a variant of Win32/Agent.NEJ trojan
C:\Documents and Settings\EQ2\桌面\样本5.rar ?RAR ?A65461A2.EXE - probably a variant of Win32/Agent.NEO trojan
C:\Documents and Settings\EQ2\桌面\样本5.rar ?RAR ?EE99C835.EXE - probably a variant of Win32/Agent.NEO trojan
Number of scanned files: 10
Number of threats found: 9
Number of files cleaned: 1
Time of completion: 11:46:56 Total scanning time: 2 sec (00:00:02)

Notes:
[7] File is probably infected with an unknown virus.

东京时空

tracydk

微点卫士

微点：
蠕虫名称:Email-Worm.Win32.Zhelatin.yz

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\KERNELWIND32.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.iex

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\RAVZXMON.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
蠕虫名称:Worm.Win32.Agent.dqz

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SERVER.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\HUSJDD8S.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\HUSJDD8S.EXE
2) C:\WINDOWS.0\SYSTEM32\OSIESD3.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\NETDDE32.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\NETDDE32.EXE
2) C:\WINDOWS.0\SYSTEM32\NETDDE32.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\RAV00A0.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\RAV00A0.EXE
2) C:\WINDOWS.0\SYSTEM32\RAV00A0.DAT
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\A65461A2.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\8B583230.EXE
2) C:\WINDOWS.0\SYSTEM32\9F28F200.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\A65461A2.EXE
可疑程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\8B583230.EXE
2) C:\WINDOWS.0\SYSTEM32\9F28F200.DLL
3) C:\WINDOWS.0\SYSTEM32\DELME.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\A65461A2.EXE
删除失败!

延迟删除文件!
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\A65461A2.EXE
1) C:\WINDOWS.0\SYSTEM32\DELME.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\EE99C835.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\727EE3FC.EXE
2) C:\WINDOWS.0\SYSTEM32\FE14C8B0.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\EE99C835.EXE
可疑程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\727EE3FC.EXE
2) C:\WINDOWS.0\SYSTEM32\FE14C8B0.DLL
3) C:\WINDOWS.0\SYSTEM32\DELME.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\EE99C835.EXE
1) C:\WINDOWS.0\SYSTEM32\DELME.BAT
是否删除可疑程序?

max1d1164v.exe挂了，上报

lsyer

--> husjdd8s.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> kernelwind32.exe
      [DETECTION] Contains signature of the worm WORM/Zhelatin.Gen
  --> max1d1164v.exe
      [DETECTION] Contains signature of the dial-up program DIAL/Generic
  --> netdde32.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> RAV00A0.exe
      [DETECTION] Is the Trojan horse TR/PSW.Agent.rwa
  --> RAVZXMON.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ES.3387
  --> Server.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> A65461A2.EXE
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> EE99C835.EXE
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

yashoo

还有色情程序
已删除: 病毒 Email-Worm.Win32.Zhelatin.gv        文件: E:\test\样本5.rar/kernelwind32.exe
已删除: 色情程序 not-a-virus:Porn-Dialer.Win32.GBDialer.i        文件: E:\test\样本5.rar/max1d1164v.exe
已删除: 木马程序 Trojan-Downloader.Win32.QQHelper.vn        文件: E:\test\样本5.rar/netdde32.exe//PE_Patch.Upolyx
已删除: 木马程序 Trojan-Downloader.Win32.Agent.bxg        文件: E:\test\样本5.rar/RAV00A0.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.aci        文件: E:\test\样本5.rar/RAVZXMON.exe//PE_Patch
已删除: 病毒 Heur.Trojan.Generic (变种)        文件: E:\test\样本5.rar/Server.exe
已删除: 病毒 Heur.Trojan.Generic (变种)        文件: E:\test\样本5.rar/EE99C835.EXE

碧水寒潭

Start of the scan: 2007年8月16日  12:06

Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\样本5.rar
  [0] Archive type: RAR
  --> husjdd8s.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> kernelwind32.exe
      [DETECTION] Contains signature of the worm WORM/Zhelatin.Gen
  --> max1d1164v.exe
      [DETECTION] Contains signature of the dial-up program DIAL/Generic
  --> netdde32.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> RAV00A0.exe
      [DETECTION] Is the Trojan horse TR/PSW.Agent.rwa
  --> RAVZXMON.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ES.3387
  --> Server.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> A65461A2.EXE
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> EE99C835.EXE
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [INFO]      The file was deleted!


End of the scan: 2007年8月16日  12:06
Used time: 00:11 min

The scan has been done completely.

      1 Scanning directories
     10 Files were scanned
      9 viruses and/or unwanted programs were found
      1 classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      0 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

kasper

驱逐舰报两个·~~~~~

BD

C:\Documents and Settings\同同\桌面\样本5.rar=>husjdd8s.exe        Infected: DeepScan:Generic.Malware.SBdldspg.98006DC0
C:\Documents and Settings\同同\桌面\样本5.rar=>husjdd8s.exe        Disinfection failed
C:\Documents and Settings\同同\桌面\样本5.rar=>husjdd8s.exe        Move failed
C:\Documents and Settings\同同\桌面\样本5.rar=>kernelwind32.exe        Infected: Trojan.Peed.IEL
C:\Documents and Settings\同同\桌面\样本5.rar=>kernelwind32.exe        Disinfection failed
C:\Documents and Settings\同同\桌面\样本5.rar=>kernelwind32.exe        Move failed
C:\Documents and Settings\同同\桌面\样本5.rar=>max1d1164v.exe        Detected: Dialer.Porn.Gbdialer.I
C:\Documents and Settings\同同\桌面\样本5.rar=>max1d1164v.exe        Disinfection failed
C:\Documents and Settings\同同\桌面\样本5.rar=>max1d1164v.exe        Move failed
C:\Documents and Settings\同同\桌面\样本5.rar=>RAV00A0.exe        Infected: BehavesLike:Win32.ExplorerHijack
C:\Documents and Settings\同同\桌面\样本5.rar=>RAV00A0.exe        Disinfection failed
C:\Documents and Settings\同同\桌面\样本5.rar=>RAV00A0.exe        Move failed
C:\Documents and Settings\同同\桌面\样本5.rar=>RAVZXMON.exe        Infected: Dropped:Generic.Malware.PWS.99809822
C:\Documents and Settings\同同\桌面\样本5.rar=>RAVZXMON.exe        Disinfection failed
C:\Documents and Settings\同同\桌面\样本5.rar=>RAVZXMON.exe        Move failed
C:\Documents and Settings\同同\桌面\样本5.rar=>A65461A2.EXE        Infected: GenPack:Generic.Popwin.67B27D8E
C:\Documents and Settings\同同\桌面\样本5.rar=>A65461A2.EXE        Disinfection failed
C:\Documents and Settings\同同\桌面\样本5.rar=>A65461A2.EXE        Move failed
C:\Documents and Settings\同同\桌面\样本5.rar=>EE99C835.EXE        Infected: GenPack:Generic.Popwin.AC61DAB6
C:\Documents and Settings\同同\桌面\样本5.rar=>EE99C835.EXE        Disinfection failed
C:\Documents and Settings\同同\桌面\样本5.rar=>EE99C835.EXE        Move failed