上报的21个

hahacomcn

Start of the scan: 2007年8月24日  09:11

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\virus.rar'
C:\Documents and Settings\Administrator\桌面\virus.rar
  [0] Archive type: RAR
  --> 13477420262.exe
      [DETECTION] Is the Trojan horse TR/Dldr.VB.FF.5.B
  --> 13477420265.exe
      [DETECTION] Is the Trojan horse TR/Agent.avl.7
  --> 1347742026A65461A2.EXE
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> 1347742026bw.exe
      [DETECTION] Is the Trojan horse TR/KillAV.JU
  --> 1347742026husjdd8s.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> Arcavi .dll
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Exaal.45056 Backdoor server programs
  --> 1347742026QQ2007¦Â3.exe
      [DETECTION] Is the Trojan horse TR/PSW.Steal.47216
  --> 1347742026RAVDHMON.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineG.MI.1
  --> ravwdmon.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineG.MI.1
  --> ravzxmon.exe
      [DETECTION] Is the Trojan horse TR/PSW.9157
  --> 1347742026svchos1t.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> 1347742026winsys16_070818.dll
      [DETECTION] Is the Trojan horse TR/KillAV.JU
  --> 1347742026xxx.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> 2114485656AVPDH.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineG.MI.1
  --> VQJMON.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineG.MI.1
  --> 2114485656ravwdmon.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen


End of the scan: 2007年8月24日  09:11
Used time: 00:03 min

The scan has been done completely.

      0 Scanning directories
     18 Files were scanned
     16 viruses and/or unwanted programs were found

hahacomcn

Begin scan in 'C:\Documents and Settings\Administrator\桌面\Almanahe.rar'
C:\Documents and Settings\Administrator\桌面\Almanahe.rar
  [0] Archive type: RAR
  --> W32.Alman.cd-1.exe
      [DETECTION] Contains code of the Windows virus W32/Almanahe.A
  --> W32.Alma.exe
      [DETECTION] Contains code of the Windows virus W32/Almanahe.A
  --> Almanahe.A .exe
      [DETECTION] Contains code of the Windows virus W32/Almanahe.A
  --> Almanahe .exe
      [DETECTION] Contains code of the Windows virus W32/Almanahe.A


End of the scan: 2007年8月24日  09:12
Used time: 00:03 min

The scan has been done completely.

      0 Scanning directories
      6 Files were scanned
      4 viruses and/or unwanted programs were found

碧水寒潭

Start of the scan: 2007年8月24日  09:13

Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\Almanahe.rar
  [0] Archive type: RAR
  --> W32.Alman.cd-1.exe
      [DETECTION] Contains code of the Windows virus W32/Almanahe.A
  --> W32.Alma.exe
      [DETECTION] Contains code of the Windows virus W32/Almanahe.A
  --> Almanahe.A .exe
      [DETECTION] Contains code of the Windows virus W32/Almanahe.A
  --> Almanahe .exe
      [DETECTION] Contains code of the Windows virus W32/Almanahe.A
      [INFO]      The file was deleted!
H:\AV-TEST\virus.rar
  [0] Archive type: RAR
  --> 13477420262.exe
      [DETECTION] Is the Trojan horse TR/Dldr.VB.FF.5.B
  --> 13477420265.exe
      [DETECTION] Is the Trojan horse TR/Agent.avl.7
  --> 1347742026A65461A2.EXE
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> 1347742026bw.exe
      [DETECTION] Is the Trojan horse TR/KillAV.JU
  --> 1347742026husjdd8s.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> Arcavi .dll
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Exaal.45056 Backdoor server programs
  --> 1347742026QQ2007¦Â3.exe
      [DETECTION] Is the Trojan horse TR/PSW.Steal.47216
  --> 1347742026RAVDHMON.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineG.MI.1
  --> ravwdmon.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineG.MI.1
  --> ravzxmon.exe
      [DETECTION] Is the Trojan horse TR/PSW.9157
  --> 1347742026svchos1t.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> 1347742026winsys16_070818.dll
      [DETECTION] Is the Trojan horse TR/KillAV.JU
  --> 1347742026xxx.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> 2114485656AVPDH.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineG.MI.1
  --> VQJMON.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineG.MI.1
  --> 2114485656ravwdmon.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [INFO]      The file was deleted!


End of the scan: 2007年8月24日  09:13
Used time: 00:23 min

The scan has been done completely.

      1 Scanning directories
     22 Files were scanned
     20 viruses and/or unwanted programs were found
      0 classified as suspicious:
      2 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      2 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

sbbdms

卡巴杀19个，剩下的2个一个是空文件，另一个——
Hello,

ravwdmon.exed - Trojan-PSW.Win32.OnLineGames.ajc

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Denis Maslennikov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: 2114485656ravwdmon.exe

>

欠妳緈諨

金山9只

欠妳緈諨

AVAST15个

afengflmx

我的NOD32
查出17个
扫描开始时间: 2007-8-24 10:33:16
扫描日志
NOD32 版本 2481 (20070823) NT
命令行: F:\工具\杀毒\样本\virus.rar F:\工具\杀毒\样本\Almanahe.rar

日期: 2007年8月24日  时间: 10:33:18
反 Rookits 技术已启用。
已扫描磁盘、文件夹和文件: F:\工具\杀毒\样本\virus.rar; F:\工具\杀毒\样本\Almanahe.rar
F:\工具\杀毒\样本\virus.rar ?RAR ?13477420265.exe<病毒 - 未知的 NewHeur_PE 病毒 [7]>
F:\工具\杀毒\样本\virus.rar ?RAR ?1347742026A65461A2.EXE<病毒 - 可能是 Win32/Agent.NEO 木马 变种>
F:\工具\杀毒\样本\virus.rar ?RAR ?1347742026bw.exe<病毒 - 可能是 Win32/Genetik 木马 变种>
F:\工具\杀毒\样本\virus.rar ?RAR ?1347742026husjdd8s.exe<病毒 - 可能是 Win32/Genetik 木马 变种>
F:\工具\杀毒\样本\virus.rar ?RAR ?1347742026QQ2007β3.exe<病毒 - Win32/AutoRun.Q 蠕虫 变种>
F:\工具\杀毒\样本\virus.rar ?RAR ?1347742026RAVDHMON.exe<病毒 - Win32/PSW.OnLineGames.NEP 木马 变种>
F:\工具\杀毒\样本\virus.rar ?RAR ?ravwdmon.exe<病毒 - Win32/PSW.OnLineGames.NEP 木马 变种>
F:\工具\杀毒\样本\virus.rar ?RAR ?ravzxmon.exe<病毒 - Win32/PSW.OnLineGames.NEP 木马 变种>
F:\工具\杀毒\样本\virus.rar ?RAR ?1347742026svchos1t.exe<病毒 - 可能是 Win32/Genetik 木马 变种>
F:\工具\杀毒\样本\virus.rar ?RAR ?1347742026xxx.exe<病毒 - 可能是 Win32/Agent.NEO 木马 变种>
F:\工具\杀毒\样本\virus.rar ?RAR ?2114485656AVPDH.exe<病毒 - 可能是 Win32/Genetik 木马 变种>
F:\工具\杀毒\样本\virus.rar ?RAR ?VQJMON.exe<病毒 - Win32/PSW.OnLineGames.NEP 木马 变种>
F:\工具\杀毒\样本\virus.rar ?RAR ?2114485656ravwdmon.exe<病毒 - Win32/PSW.OnLineGames.NEP 木马 变种>
F:\工具\杀毒\样本\Almanahe.rar ?RAR ?W32.Alman.cd-1.exe<病毒 - Win32/Alman.A 病毒>
F:\工具\杀毒\样本\Almanahe.rar ?RAR ?W32.Alma.exe<病毒 - Win32/Alman.A 病毒>
F:\工具\杀毒\样本\Almanahe.rar ?RAR ?Almanahe.A .exe<病毒 - Win32/Alman.A 病毒>
F:\工具\杀毒\样本\Almanahe.rar ?RAR ?Almanahe .exe<病毒 - Win32/Alman.A 病毒>
已扫描文件数量: 21
已发现病毒数量: 17
完成时间: 10:33:23 总共扫描时间: 5 秒 (00:00:05)

注意:
[7] 文件可能感染了未知病毒。

uhthn2002

C:\Documents and Settings\uhthn\Desktop\virus\W32.Alman.cd-1.exe : is suspected of Embedded.Backdoor.Win32.Agent.anp
C:\Documents and Settings\uhthn\Desktop\virus\W32.Alma.exe : is suspected of Embedded.Backdoor.Win32.Agent.anp
C:\Documents and Settings\uhthn\Desktop\virus\Almanahe.A .exe : is suspected of Embedded.Backdoor.Win32.Agent.anp
C:\Documents and Settings\uhthn\Desktop\virus\Almanahe .exe : is suspected of Embedded.Backdoor.Win32.Agent.anp
C:\Documents and Settings\uhthn\Desktop\virus\13477420262.exe : is suspected of Malware.VB.60 (paranoid heuristics)
C:\Documents and Settings\uhthn\Desktop\virus\13477420265.exe : infected Trojan.Win32.Agent.awf
C:\Documents and Settings\uhthn\Desktop\virus\1347742026A65461A2.EXE : is suspected of Trojan-PSW.Game.63 (paranoid heuristics)
C:\Documents and Settings\uhthn\Desktop\virus\1347742026bw.exe : is suspected of Trojan-PSW.Game.39 (paranoid heuristics)
C:\Documents and Settings\uhthn\Desktop\virus\1347742026QQ2007β3.exe : infected MalwareScope.Trojan-PSW.Game.7
C:\Documents and Settings\uhthn\Desktop\virus\1347742026winsys16_070818.dll : is suspected of Trojan-PSW.Game.39 (paranoid heuristics)
C:\Documents and Settings\uhthn\Desktop\virus\1347742026xxx.exe : is suspected of Trojan-PSW.Game.63 (paranoid heuristics)
C:\Documents and Settings\uhthn\Desktop\virus\2114485656AVPDH.exe : infected Trojan-PSW.Win32.OnLineGames.afc


Directories       : 0       Files in archives:      Files on disks:
Archives:                   - total       : 0       - total       : 21   
- scanned         : 0       -  scanned    : 0       - scanned     : 21   
- contain viruses : 0       -  infected   : 0       - infected    : 3     
- deleted         : 0       -  suspicious : 0       - suspicious  : 9

小飞侠.net

McAfee VirusScan for Win32 v5.20.0
Copyright (c) 1992-2005 Networks Associates Technology Inc. All rights reserved.
(408) 988-3832  LICENSED COPY - Jun  5 2007
Scan engine v5.2.00 for Win32.
Virus data file v4100 created Aug 24 2007
Scanning for 316947 viruses, trojans and variants.
Using C:\Documents and Settings\小飞侠.net\桌面\桌面\McAfee VirusScan\EXTRA.DAT to scan for 0 additional virus(es).

08/25/2007  16:59:08

Options:
"V:\VIRUSDOC20070825\056" /MIME /SUB /UNZIP /ALL /RPTALL /RPTCOR /RPTERR /STREAMS /REPORT C:\DOCUME~1\小飞侠.NET\LOCALS~1\TEMP\SCAN.TXT /PROGRAM /ANALYZE /MAILBOX
Scanning V: [V盘]
Scanning V:\VIRUSDOC20070825\056\*.*
V:\VIRUSDOC20070825\056\Almanahe.rar ... is OK.
V:\VIRUSDOC20070825\056\Almanahe.rar\W32.ALMAN.CD-1.EXE ... Found the W32/Almanahe.b virus !!!
V:\VIRUSDOC20070825\056\Almanahe.rar\W32.ALMA.EXE ... Found the W32/Almanahe.b virus !!!
V:\VIRUSDOC20070825\056\Almanahe.rar\ALMANAHE.A .EXE ... Found the W32/Almanahe.b virus !!!
V:\VIRUSDOC20070825\056\Almanahe.rar\ALMANAHE .EXE ... Found the W32/Almanahe.b virus !!!
V:\VIRUSDOC20070825\056\Almanahe.rar:Zone.Identifier ... is OK.
V:\VIRUSDOC20070825\056\virus.rar ... is OK.
V:\VIRUSDOC20070825\056\virus.rar\13477420262.EXE ... is OK.
V:\VIRUSDOC20070825\056\virus.rar\13477420262.EXE\13477420262.EXE ... Found virus or variant New PE-c !!!
        Please send a copy of the file to McAfee
V:\VIRUSDOC20070825\056\virus.rar\13477420265.EXE ... is OK.
V:\VIRUSDOC20070825\056\virus.rar\13477420265.EXE\13477420265.EXE ... is OK.
V:\VIRUSDOC20070825\056\virus.rar\13477420265.EXE\13477420265.EXE\000154c0.EXE ... is OK.
V:\VIRUSDOC20070825\056\virus.rar\13477420265.EXE\13477420265.EXE\000154c0.EXE\000154c0.EXE ... is OK.
V:\VIRUSDOC20070825\056\virus.rar\13477420265.EXE\13477420265.EXE\0000a0c0.EXE ... is OK.
V:\VIRUSDOC20070825\056\virus.rar\13477420265.EXE\13477420265.EXE\0000a0c0.EXE\0000a0c0.EXE ... is OK.
V:\VIRUSDOC20070825\056\virus.rar\1347742026A65461A2.EXE ... Found trojan or variant New Malware.dw !!!
        Please send a copy of the file to McAfee
V:\VIRUSDOC20070825\056\virus.rar\1347742026BW.EXE ... Found trojan or variant New Malware.aj !!!
        Please send a copy of the file to McAfee
V:\VIRUSDOC20070825\056\virus.rar\1347742026HUSJDD8S.EXE ... Found virus or variant W32/Winko.worm.gen !!!
        Please send a copy of the file to McAfee
V:\VIRUSDOC20070825\056\virus.rar\ARCAVI .DLL ... Found the BackDoor-DKA trojan !!!
V:\VIRUSDOC20070825\056\virus.rar\1347742026QQ2007β3.EXE ... is OK.
V:\VIRUSDOC20070825\056\virus.rar\1347742026QQ2007β3.EXE\1347742026QQ2007β3.EXE ... is OK.
V:\VIRUSDOC20070825\056\virus.rar\1347742026QQ2007β3.EXE\1347742026QQ2007β3.EXE\0000b4f8.EXE ... Found the PWS-QQGame trojan !!!
V:\VIRUSDOC20070825\056\virus.rar\1347742026RAVDHMON.EXE ... Found trojan or variant New Malware.aj !!!
        Please send a copy of the file to McAfee
V:\VIRUSDOC20070825\056\virus.rar\RAVWDMON.EXE ... Found trojan or variant New Malware.aj !!!
        Please send a copy of the file to McAfee
V:\VIRUSDOC20070825\056\virus.rar\RAVZXMON.EXE ... Found trojan or variant New Malware.aj !!!
        Please send a copy of the file to McAfee
V:\VIRUSDOC20070825\056\virus.rar\1347742026SVCHOS1T.EXE ... Found trojan or variant New Malware.dm !!!
        Please send a copy of the file to McAfee
V:\VIRUSDOC20070825\056\virus.rar\1347742026WINSYS16_070818.DLL ... is OK.
V:\VIRUSDOC20070825\056\virus.rar\1347742026XXX.EXE ... Found trojan or variant New Malware.dw !!!
        Please send a copy of the file to McAfee
V:\VIRUSDOC20070825\056\virus.rar\2114485656AVPDH.EXE ... Found trojan or variant New Malware.aj !!!
        Please send a copy of the file to McAfee
V:\VIRUSDOC20070825\056\virus.rar\2114485656RAVJZMON.EXE ... is OK.
V:\VIRUSDOC20070825\056\virus.rar\VQJMON.EXE ... Found trojan or variant New Malware.aj !!!
        Please send a copy of the file to McAfee
V:\VIRUSDOC20070825\056\virus.rar\2114485656RAVWDMON.EXE ... Found trojan or variant New Malware.aj !!!
        Please send a copy of the file to McAfee
V:\VIRUSDOC20070825\056\virus.rar:Zone.Identifier ... is OK.
Summary report on V:\VIRUSDOC20070825\056\*.*
File(s)
        Total files: ...........      33
        Clean: .................      15
        Possibly Infected: .....      18

Time: 00:00.11

tracydk

Starting the file scan:

Begin scan in 'F:\病毒样本\Almanahe.rar'
F:\病毒样本\Almanahe.rar
  [0] Archive type: RAR
  --> W32.Alman.cd-1.exe
      [DETECTION] Contains code of the Windows virus W32/Almanahe.A
  --> W32.Alma.exe
      [DETECTION] Contains code of the Windows virus W32/Almanahe.A
  --> Almanahe.A .exe
      [DETECTION] Contains code of the Windows virus W32/Almanahe.A
  --> Almanahe .exe
      [DETECTION] Contains code of the Windows virus W32/Almanahe.A
      [INFO]      The file was deleted!
Begin scan in 'F:\病毒样本\virus.rar'
F:\病毒样本\virus.rar
  [0] Archive type: RAR
  --> 13477420262.exe
      [DETECTION] Is the Trojan horse TR/Dldr.VB.FF.5.B
  --> 13477420265.exe
      [DETECTION] Is the Trojan horse TR/Agent.avl.7
  --> 1347742026A65461A2.EXE
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> 1347742026bw.exe
      [DETECTION] Is the Trojan horse TR/KillAV.JU
  --> 1347742026husjdd8s.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> Arcavi .dll
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Exaal.45056 Backdoor server programs
  --> 1347742026QQ2007&brvbar;&Acirc;3.exe
      [DETECTION] Is the Trojan horse TR/PSW.Steal.47216
  --> 1347742026RAVDHMON.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineG.MI.1
  --> ravwdmon.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineG.MI.1
  --> ravzxmon.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Tiny.CK.2
  --> 1347742026svchos1t.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> 1347742026winsys16_070818.dll
      [DETECTION] Is the Trojan horse TR/KillAV.JU
  --> 1347742026xxx.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> 2114485656AVPDH.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineG.MI.1
  --> VQJMON.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineG.MI.1
  --> 2114485656ravwdmon.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Tiny.CK.2
      [INFO]      The file was deleted!


End of the scan: 2007年8月25日  17:17
Used time: 00:07 min

The scan has been done completely.

      0 Scanning directories
     24 Files were scanned
     20 viruses and/or unwanted programs were found
      0 classified as suspicious:
      2 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      4 Files not concerned
      2 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found