6个[MD5: 5767AB 3469C5 32D7BC 110448 C58694 565ACD]

显示全部楼层 · 发表于 2007-8-24 01:01:16

Scan performed at: 2007-8-24 1:00:33
Scanning Log
NOD32 version 2479 (20070823) NT
Command line: C:\Documents and Settings\Don johnson\桌面\样本.rar
D:\Program Files\Eset\nod32.exe - is OK
Operating memory - is OK
MBR sector of the 1. physical disk - is OK
Active boot sector of the 1. physical disk - is OK

Date: 24.8.2007 Time: 01:00:42
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\样本.rar
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?MM.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?nn.exe - is OK
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?PPKart.exe - probably a variant of Win32/PSW.QQShou trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?QQ.exe - probably a variant of Win32/PSW.QQShou trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?server.exe - a variant of Win32/AutoRun.K worm
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?vv.exe ?FSG v2.0 - is OK
Number of scanned files: 7
Number of threats found: 4
Number of files cleaned: 1
Time of completion: 01:00:44 Total scanning time: 2 sec (00:00:02)

显示全部楼层 · 发表于 2007-8-24 01:25:31

Begin scan in 'C:\Documents and Settings\dell\桌面\样本.rar'
C:\Documents and Settings\dell\桌面\样本.rar
  [0] Archive type: RAR
  --> MM.exe
   [DETECTION] Contains signature of the dropper DR/Delphi.Gen
  --> nn.exe
   [DETECTION] Is the Trojan horse TR/Drop.QQHelper.D
  --> PPKart.exe
   [DETECTION] Is the Trojan horse TR/Hook.Shell.230
  --> QQ.exe
   [DETECTION] Is the Trojan horse TR/PSW.Stealer.34293
  --> server.exe
   [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> vv.exe
   [DETECTION] Contains signature of the dropper DR/Delphi.Gen
   [INFO]    The file was successfully wiped!
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-8-24 01:32:16

C:\Documents and Settings\uhthn\Desktop\virus\MM.exe : infected MalwareScope.Trojan-PSW.Game.7
C:\Documents and Settings\uhthn\Desktop\virus\nn.exe : infected Trojan.Win32.Agent.axf
C:\Documents and Settings\uhthn\Desktop\virus\PPKart.exe : infected Trojan-Spy.Win32.Delf.wg
C:\Documents and Settings\uhthn\Desktop\virus\QQ.exe : is suspected of Embedded.MalwareScope.Trojan-PSW.Game.7
C:\Documents and Settings\uhthn\Desktop\virus\vv.exe : is suspected of Backdoor.Hupigon.5 (paranoid heuristics)

Directories    : 0    Files in archives:    Files on disks:
Archives:                - total    : 0    - total    : 6
- scanned       : 0    -  scanned : 0    - scanned    : 6
- contain viruses : 0    -  infected : 0    - infected : 3
- deleted       : 0    -  suspicious : 0    - suspicious  : 2

显示全部楼层 · 发表于 2007-8-24 01:40:50

Starting the file scan:

Begin scan in 'C:\Users\Alex\Desktop\样本.rar'
C:\Users\Alex\Desktop\样本.rar
  [0] Archive type: RAR
  --> MM.exe
   [DETECTION] Contains signature of the dropper DR/Delphi.Gen
  --> nn.exe
   [DETECTION] Is the Trojan horse TR/Drop.QQHelper.D
  --> PPKart.exe
   [DETECTION] Is the Trojan horse TR/Hook.Shell.230
  --> QQ.exe
   [DETECTION] Is the Trojan horse TR/PSW.Stealer.34293
  --> server.exe
   [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> vv.exe
   [DETECTION] Contains signature of the dropper DR/Delphi.Gen
   [INFO]    The file was deleted!

End of the scan: 2007年8月24日  01:39
Used time: 00:30 min

The scan has been done completely.

显示全部楼层 · 发表于 2007-8-24 03:20:37

扫描进行于：2007-8-24 3:18:07
扫描日志
NOD32版本 2479 (20070823) NT
命令行： D:\病毒库\样本.rar

日期： 24.8.2007 时间：03:18:11
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：D:\病毒库\样本.rar
D:\病毒库\样本.rar >>RAR >>MM.exe - 可能是 Win32/Genetik 木马的一个变种
D:\病毒库\样本.rar >>RAR >>PPKart.exe - 可能是 Win32/PSW.QQShou 木马的一个变种
D:\病毒库\样本.rar >>RAR >>QQ.exe - 可能是 Win32/PSW.QQShou 木马的一个变种
D:\病毒库\样本.rar >>RAR >>server.exe - Win32/AutoRun.K 蠕虫的变种
已扫描的文件数目：8
已发现的病毒数目：4
活动的病毒数目：1
完成时间： 03:18:14 总扫描时间：3 秒 (00:00:03)

显示全部楼层 · 发表于 2007-8-24 06:21:04

为PC护航风暴微塔
_____________________________________________

         风暴微塔反间谋
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]
                        [内测版]
               http://www.v0day.com/
----------------------------------------------
开始扫描……

正在检查启动……
[C:\Documents and Settings\Administrator\桌面\virus\探测壳\MM.exe]
                  …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\探测壳\nn.exe]
                  …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\探测壳\nn.exe]
                  …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\探测壳\server.exe]
                  …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\探测壳\vv.exe]
                  …………引擎[2]发现病毒:Win32.NkHack.FSG.A
文件数:6 病毒数:5  比重:0.8333333333333
OK  扫描完毕！

显示全部楼层 · 发表于 2007-8-24 06:47:29

江民杀毒软件报告文件

北京江民新科技术有限公司

扫描引擎 11.00.700
病毒库日期 2007-08-23
更新日期 2007-08-24

扫描目标 C:\Documents and Settings\Administrator\桌面\样本1.rar

开始时间 2007-08-24 06:46:49

在 C:\Documents and Settings\Administrator\桌面\样本1.rar->nn.exe 中发现 Trojan/Agent.nmg 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\样本1.rar->PPKart.exe 中发现 Trojan/PSW.GamePass.umc 病毒, 已删除
正常结束。

扫描结果:
               文件数 :456                               病毒体 :2
               删除 :2                                  解毒 :0
扫描速度(千字节/秒) :8602                            扫描时间 :00:00:14
扫描文件速度(个/秒) :32

显示全部楼层 · 发表于 2007-8-24 07:35:01

Result: 5 malware found
Trojan.Win32.Agent.axf (virus)
C:\Documents and Settings\Administrator\×ÀÃæ\1.rar\nn.exe
Trojan-Spy.Win32.Delf.wg (virus)
C:\Documents and Settings\Administrator\×ÀÃæ\1.rar\PPKart.exe
Trojan-PSW.Win32.QQPass.yp (virus)
C:\Documents and Settings\Administrator\×ÀÃæ\1.rar\QQ.exe
Virus.Win32.AutoRun.fk (virus)
C:\Documents and Settings\Administrator\×ÀÃæ\1.rar\server.exe
Trojan-PSW.Win32.OnLineGames.aiz (virus)
C:\Documents and Settings\Administrator\×ÀÃæ\1.rar\vv.exe

显示全部楼层 · 发表于 2007-8-24 07:42:58

D:\Documents and Settings\EKINCHENG\桌面\123.rar » RAR » server.exe - a variant of Win32/AutoRun.K worm
D:\Documents and Settings\EKINCHENG\桌面\123.rar » RAR » QQ.exe - probably a variant of Win32/PSW.QQShou trojan
D:\Documents and Settings\EKINCHENG\桌面\123.rar » RAR » PPKart.exe - probably a variant of Win32/PSW.QQShou trojan
D:\Documents and Settings\EKINCHENG\桌面\123.rar » RAR » nn.exe - is OK
D:\Documents and Settings\EKINCHENG\桌面\123.rar » RAR » MM.exe - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\123.rar - multiple threats - deleted - quarantined
D:\Documents and Settings\EKINCHENG\桌面\123.rar » RAR » vv.exe » FSG v2.0 - internal error

[病毒样本] 6个[MD5: 5767AB 3469C5 32D7BC 110448 C58694 565ACD]

本帖子中包含更多资源

偶现在开了nod32的探测壳