11个

promised

[MD5: 184D9D 4A8B67 AA2EA1 90D80D 5D7006 FD92CB F6F78F DB5A5C FAF462 C8E7CD 47C914]

wangjay1980

detected: Trojan program Backdoor.Win32.Agent.ari        File: C:\Documents and Settings\Owner\×ÀÃæ\C.zip/3.exe
detected: Trojan program Trojan.Win32.Agent.avl        File: C:\Documents and Settings\Owner\×ÀÃæ\C.zip/6.exe//PE_Patch.UPX//#//PE_Patch.UPX//UPX
detected: virus Heur.Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\C.zip/8.exe
detected: virus Worm.Win32.Agent.t        File: C:\Documents and Settings\Owner\×ÀÃæ\C.zip/9.exe//PE_Patch.PECompact//PecBundle//PECompact
detected: adware not-a-virus:AdWare.Win32.Agent.bz        File: C:\Documents and Settings\Owner\×ÀÃæ\C.zip/10.exe//#//data0002
detected: adware not-a-virus:AdWare.Win32.Agent.ck        File: C:\Documents and Settings\Owner\×ÀÃæ\C.zip/10.exe//#//data0003//UPX
detected: adware not-a-virus:AdWare.Win32.Agent.bz        File: C:\Documents and Settings\Owner\×ÀÃæ\C.zip/10.exe//#//data0004//UPX
detected: adware not-a-virus:AdWare.Win32.Agent.ck        File: C:\Documents and Settings\Owner\×ÀÃæ\C.zip/10.exe//#//data0005//UPX
detected: adware not-a-virus:AdWare.Win32.Agent.ck        File: C:\Documents and Settings\Owner\×ÀÃæ\C.zip/10.exe//#//data0006//UPX
detected: adware not-a-virus:AdWare.Win32.NewWeb.z        File: C:\Documents and Settings\Owner\×ÀÃæ\C.zip/10.exe//#//data0007
detected: Trojan program Rootkit.Win32.Agent.gj        File: C:\Documents and Settings\Owner\×ÀÃæ\C.zip/10.exe//#//data0008
detected: adware not-a-virus:AdWare.Win32.NewWeb.y        File: C:\Documents and Settings\Owner\×ÀÃæ\C.zip/10.exe//#//data0010
detected: Trojan program Backdoor.Win32.Agent.ahj        File: C:\Documents and Settings\Owner\×ÀÃæ\C.zip/1.exe
detected: Trojan program Backdoor.Win32.Agent.ari        File: C:\Documents and Settings\Owner\×ÀÃæ\C.zip/2.exe

The EQs

Scan performed at: 2007-8-17 16:38:40
Scanning Log
NOD32 version 2467 (20070816) NT
Command line: C:\Documents and Settings\EQ2\桌面\C
Operating memory - is OK

Date: 17.8.2007  Time: 16:38:47
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\C\
C:\Documents and Settings\EQ2\桌面\C\1.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\EQ2\桌面\C\2.exe - probably a variant of Win32/Agent.NEO trojan
C:\Documents and Settings\EQ2\桌面\C\3.exe - probably a variant of Win32/Agent.NEO trojan
C:\Documents and Settings\EQ2\桌面\C\4.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\EQ2\桌面\C\5.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\EQ2\桌面\C\6.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\C\7.exe ?NSIS ?acpidisk.sys - a variant of Win32/Adware.Cinmus application - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\C\8.exe - probably a variant of Win32/Agent.NEO trojan
C:\Documents and Settings\EQ2\桌面\C\9.exe - a variant of Win32/Agent.NAU worm
Number of scanned files: 14
Number of threats found: 9
Number of files cleaned: 9
Time of completion: 16:38:50 Total scanning time: 3 sec (00:00:03)

Notes:
[7] File is probably infected with an unknown virus.

uhthn2002

C:\Documents and Settings\uhthn\Desktop\C.zip:<ZIP>\3.exe : infected Backdoor.Win32.Agent.ahj
C:\Documents and Settings\uhthn\Desktop\C.zip:<ZIP>\5.exe : is suspected of Trojan-PSW.Game.39 (paranoid heuristics)
C:\Documents and Settings\uhthn\Desktop\C.zip:<ZIP>\8.exe : is suspected of Trojan-PSW.Game.63 (paranoid heuristics)
C:\Documents and Settings\uhthn\Desktop\C.zip:<ZIP>\9.exe : infected Worm.Win32.Agent.t
C:\Documents and Settings\uhthn\Desktop\C.zip:<ZIP>\10.exe : infected Trojan.MulDrop.7434
C:\Documents and Settings\uhthn\Desktop\C.zip:<ZIP>\0.exe : is suspected of Malware.VB.60 (paranoid heuristics)
C:\Documents and Settings\uhthn\Desktop\C.zip:<ZIP>\1.exe : infected Backdoor.Win32.Agent.arn
C:\Documents and Settings\uhthn\Desktop\C.zip:<ZIP>\2.exe : infected Backdoor.Win32.Agent.ahj


Directories       : 0       Files in archives:      Files on disks:
Archives:                   - total       : 11      - total       : 1     
- scanned         : 1       -  scanned    : 11      - scanned     : 1     
- contain viruses : 1       -  infected   : 5       - infected    : 1     
- deleted         : 0       -  suspicious : 3       - suspicious  : 0

红心王子

斧头扫描都不报
看下运行的结果

先运行了0.exe只是在进程列表里加载了一个运行，没有别的

动作

再看下面的运行情况，最后一个7.exe运行发现病毒直接删除了

KV的主动防御拦截起了作用

bobgod2000

瑞星2008只能杀6个。

Nerazzurri

Starting the file scan:

Begin scan in 'F:\Documents and Settings\simasc\桌面\C.zip'
F:\Documents and Settings\simasc\桌面\C.zip
  [0] Archive type: ZIP
  --> 3.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> 4.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> 5.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> 6.exe
      [DETECTION] Is the Trojan horse TR/Agent.avl.7
  --> 8.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> 9.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> 10.exe
      [DETECTION] Contains signature of the dropper DR/Agent.BZ.23
  --> 1.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> 2.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [INFO]      The file was deleted!

欠妳緈諨

删除8只

FBAV

为PC护航风暴微塔
_____________________________________________
                                          
             风暴微塔反病毒               
                            [内测版]      
                   http://www.v0day.com/  
----------------------------------------------
开始扫描……


[C:\Documents and Settings\Administrator\桌面\virus\C.zip]
                    …………引擎[2]发现病毒:Win32.Nop ?1B
[C:\Documents and Settings\Administrator\桌面\virus\C.zip]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\C.zip]
                    …………引擎[2]发现病毒:Win32.Nop ??
[C:\Documents and Settings\Administrator\桌面\virus\C.zip]
                    …………引擎[2]发现病毒:Win32.Nop ??
[C:\Documents and Settings\Administrator\桌面\virus\C.zip]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\C.zip]
                    …………引擎[2]发现病毒:Win32.Nop yt>
[C:\Documents and Settings\Administrator\桌面\virus\C.zip]
                    …………引擎[2]发现病毒:Win32.Nop >S?
[C:\Documents and Settings\Administrator\桌面\virus\C.zip]
                    …………特征码引擎[1]发现病毒
OK  扫描完毕！

啊弥陀佛

微点砍掉


程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\C\4.EXE
被修改文件:
C:\WINDOWS\SYSTEM32\DLLCACHE\SVCHOST.EXE
是否阻止文件被修改?



程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\C\6.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SRCSVC.EXE
2) C:\WINDOWS\DODOLOOK.EXE
是否删除木马程序及其衍生物?



程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\C\8.EXE
可疑程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\24E9F3BC.EXE
2) C:\WINDOWS\SYSTEM32\6F2EA820.DLL
3) C:\WINDOWS\SYSTEM32\DELME.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?