7f41f9 51e400 dc8733

wangjay1980

3

东京时空

AVAST扫描后NORTON先报，脱壳后NIS2007才会报，否则PASS

[ 本帖最后由 东京时空 于 2007-8-16 11:57 编辑 ]

yurius

deleted: Trojan program Trojan-Downloader.Win32.Agent.bbb        File: C:\virus\3.zip/mminstall.exe
deleted: virus Virus.Win32.AutoRun.hg        File: C:\virus\3.zip/s168.exe//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-Spy.Win32.Delf.uv        File: C:\virus\3.zip/mh.exe//UPack

微点卫士

微点：
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MH.EXE
1) C:\DFD12526984.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MH.EXE
1) C:\DFD12526984.BAT
是否删除可疑程序?
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MMINSTALL.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:1112
远端地址:58.211.7.35(江苏·苏州)
远端端口:80
这个东西微点又挂了
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S168.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\RKSLDK.BAK
2) C:\PROGRAM FILES\INTERNET EXPLORER\RKSLDK.DLL
3) C:\PROGRAM FILES\COMMON FILES\GOSKDL.DLL
是否删除木马程序及其衍生物?

The EQs

Scan performed at: 2007-8-16 11:58:27
Scanning Log
NOD32 version 2465 (20070816) NT
Command line: C:\Documents and Settings\EQ2\桌面\3.zip
Operating memory - is OK

Date: 16.8.2007  Time: 11:58:33
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\3.zip
C:\Documents and Settings\EQ2\桌面\3.zip ?ZIP ?mminstall.exe - a variant of Win32/TrojanDownloader.QQHelper.NDF trojan
C:\Documents and Settings\EQ2\桌面\3.zip ?ZIP ?s168.exe - a variant of Win32/PSW.OnLineGames.NBR trojan
C:\Documents and Settings\EQ2\桌面\3.zip ?ZIP ?mh.exe - a variant of Win32/PSW.OnLineGames.NEN trojan
Number of scanned files: 4
Number of threats found: 3
Number of files cleaned: 1
Time of completion: 11:58:34 Total scanning time: 1 sec (00:00:01)

tracydk

miss

lsyer

--> s168.exe
      [DETECTION] Is the Trojan horse TR/Autorun.BK
  --> mh.exe
      [DETECTION] Contains suspicious code HEUR/Malware

yashoo

已删除: 木马程序 Trojan-Downloader.Win32.Agent.bbb        文件: E:\test\3.zip/mminstall.exe
已删除: 病毒 Virus.Win32.AutoRun.hg        文件: E:\test\3.zip/s168.exe//PE_Patch.UPX//UPX
已删除: 木马程序 Trojan-Spy.Win32.Delf.uv        文件: E:\test\3.zip/mh.exe//UPack

碧水寒潭

Start of the scan: 2007年8月16日  12:27

Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\3.zip
  [0] Archive type: ZIP
  --> s168.exe
      [DETECTION] Is the Trojan horse TR/Autorun.BK
  --> mh.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was deleted!


End of the scan: 2007年8月16日  12:27
Used time: 00:09 min

The scan has been done completely.

      1 Scanning directories
      4 Files were scanned
      2 viruses and/or unwanted programs were found
      1 classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

woai_jolin

BitDefender Log File
Product : Bitdefender Internet Security
Version : BitDefender UIScanner v.11
Log date : 12:54:52 16/08/2007
Log path : C:\Documents and Settings\Administrator\Application Data\BitDefender\Desktop\Profiles\Logs\contextual\1187240092_9_01.xml

Scan Paths: Path0000: F:\v\v1\3.zip


Scan Options: Scan for viruses : Yes
Scan for adware : Yes
Scan for spyware : Yes
Scan for applications : Yes
Scan for dialers : Yes
Scan for rootkits : No


Target selection options: Scan registry keys : No
Scan cookies : No
Scan boot sectors : No
Scan memory processes : No
Scan archives : Yes
Scan runtime packers : Yes
Scan email : Yes
Scan all files : No
Heuristic Scan : Yes
Scanned extenstions : (null)
Exclude extensions :  


Target Processing Default action for infected objects : Disinfect
Default action for suspicious objects : None
Default action for hidden objects : None


Scan engines summary Number of virus signatures : 754472
Archive plugins : 40
Email plugins : 6
Scan plugins : 12
Archive plugins : 40
System plugins : 4
Unpack plugins : 6


Overall scan summary Scanned items : 10
Infected items : 2
Suspicious items : 0
Resolved items : 0
Individual viruses found : 2
Scanned directories : 0
Scanned boot sectors : 0
Scanned archives : 2
Input-output errors : 0
Scan time : 00:00:00:06
Files per second : 1


Scanned files summary Scanned : 10
Infected : 2


Scanned processes summary Scanned : 0
Infected : 0


Scanned registry keys summary Scanned : 0
Infected : 0


Scanned cookies summary Scanned : 0
Infected : 0


Remaining issues:Object Name Threat Name  Final Status


Resolved issues:Object Name Threat Name  Final Status
F:\v\v1\3.zip DeepScan:Generic.Dld.Agent.589F7069 Deleted