[MD5: C8ABA5 DDC0FF 39CEDB E4AE4B 472850 9BDBDA 59FF43 87D821]

qianwenxiang

[MD5: C8ABA5 DDC0FF 39CEDB E4AE4B 472850 9BDBDA 59FF43 87D821]

The EQs

Scan performed at: 2007-8-30 18:55:39
Scanning Log
NOD32 version 2491 (20070830) NT
Command line: C:\Documents and Settings\Don johnson\桌面\0830.rar
Operating memory - is OK

Date: 30.8.2007  Time: 18:55:44
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\0830.rar
C:\Documents and Settings\Don johnson\桌面\0830.rar ?RAR ?d03.exe ?NSIS ?cpush.dll - probably a variant of Win32/Adware.BHO.AV application - was a part of the deleted object
C:\Documents and Settings\Don johnson\桌面\0830.rar ?RAR ?sys169.exe - a variant of Win32/PSW.Delf.NIY trojan
C:\Documents and Settings\Don johnson\桌面\0830.rar ?RAR ?~Temp7525.tmp - Win32/PSW.OnLineGames.NBR trojan - was a part of the deleted object
C:\Documents and Settings\Don johnson\桌面\0830.rar ?RAR ?13d012.exe ?NSIS ?netdde32.exe - probably unknown NewHeur_PE virus [7] - was a part of the deleted object
C:\Documents and Settings\Don johnson\桌面\0830.rar ?RAR ?13d012.exe ?NSIS ?d03.exe ?NSIS ?cpush.dll - probably a variant of Win32/Adware.BHO.AV application - was a part of the deleted object
Number of scanned files: 10
Number of threats found: 5
Number of files cleaned: 1
Time of completion: 18:55:45 Total scanning time: 1 sec (00:00:01)

Notes:
[7] File is probably infected with an unknown virus.

FBAV

MicroVita AntiSpyware 100 C
_____________________________________________
                                          
             风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]                  
                   http://221.10.254.214/
----------------------------------------------
开始扫描……


正在检查启动……
[C:\Documents and Settings\Administrator\桌面\virus\0830\bbsj.exe]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\0830\sys169.exe]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\0830\task.exe]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\0830\~Temp7525.tmp]
                    …………特征码引擎[1]发现病毒
文件数:8   病毒数:4  比重:0.5
OK  扫描完毕！

tracydk

Starting the file scan:

Begin scan in 'F:\病毒样本\0830.rar'
F:\病毒样本\0830.rar
  [0] Archive type: RAR
  --> sys169.exe
      [DETECTION] Is the Trojan horse TR/PWS.Banker.27637
  --> TIMHost.dll
      [DETECTION] Is the Trojan horse TR/PSW.Nilage.blr.1
  --> ~Temp7525.tmp
      [DETECTION] Is the Trojan horse TR/Autorun.BK
  --> 13d012.exe
      [DETECTION] Contains signature of the dropper DR/Dldr.QQHelper.YD.2
      [INFO]      The file was deleted!

uhthn2002

C:\Documents and Settings\uhthn\Desktop\virus\
C:\Documents and Settings\uhthn\Desktop\virus\sys169.exe : infected MalwareScope.Trojan-PSW.Game.7
C:\Documents and Settings\uhthn\Desktop\virus\TIMHost.dll : infected MalwareScope.Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\virus\~Temp7525.tmp : infected Trojan.Win32.PSW.OnLineGames.NBR


Directories       : 0       Files in archives:      Files on disks:
Archives:                   - total       : 0       - total       : 8     
- scanned         : 0       -  scanned    : 0       - scanned     : 8     
- contain viruses : 0       -  infected   : 0       - infected    : 3     
- deleted         : 0       -  suspicious : 0       - suspicious  : 0     


Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Heuristics - OPEN
Scan in - C:\Documents and Settings\uhthn\Desktop\virus

C:\Documents and Settings\uhthn\Desktop\virus\bbsj.exe - Suspicious of Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\virus\CDAC11BA.EXE - Suspicious file
C:\Documents and Settings\uhthn\Desktop\virus\d03.exe - Suspicious of Trojan-PSW.OnLineGames.3
C:\Documents and Settings\uhthn\Desktop\virus\sys169.exe - Suspicious of Win32.Trojan-Downloader.Zlob.1
C:\Documents and Settings\uhthn\Desktop\virus\task.exe - Suspicious of Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\virus\TIMHost.dll - Suspicious of Trojan-PSW.OnLineGames.1
C:\Documents and Settings\uhthn\Desktop\virus\~Temp7525.tmp - Suspicious of Win32.Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\virus\13d012.exe - Suspicious of Trojan-PSW.OnLineGames.3

8 Files scanned
0 Infected files found
8 Suspicious files found
0 Files cured
0 Files deleted

tiedan2

Ikarus:
30:08:2007 19:17:56 SEARCHTASK "USER_DEFINED" started...
scan item: C:\Documents and Settings\zhenjia\桌面\0830.rar
File scanned: C:\Documents and Settings\zhenjia\桌面\0830.rar - SIGNATURE FOUND "Trojan-Spy.Win32.Delf.OG"
30:08:2007 19:17:57 SEARCHTASK "USER_DEFINED" FINISHED...
----------------------------------------------------
Directories scanned: 0
Files scanned: 1
Virus found: 1
----------------------------------------------------

ssy275

Result: 5 malware found
AdWare.Win32.BHO.dg (adware)
C:\Documents and Settings\ssy\×ÀÃæ\0830.rar\d03.exe
Trojan-PSW.Win32.Delf.qc (virus)
C:\Documents and Settings\ssy\×ÀÃæ\0830.rar\sys169.exe
Trojan-PSW.Win32.Nilage.blr (virus)
C:\Documents and Settings\ssy\×ÀÃæ\0830.rar\TIMHost.dll
Virus.Win32.AutoRun.ji (virus)
C:\Documents and Settings\ssy\×ÀÃæ\0830.rar\~Temp7525.tmp
Trojan-Downloader.Win32.QQHelper.yd (virus)
C:\Documents and Settings\ssy\×ÀÃæ\0830.rar\13d012.exe

微点卫士

微点：
木马名称:Trojan-PSW.Win32.Delf.ely

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\0830\SYS169.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.gpf

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\0830\~TEMP7525.TMP
是木马程序!
已成功阻止其运行,是否要删除此文件?
广告软件名称:AdWare.Win32.BHO.oz

程序:
C:\PROGRAM FILES\COMMON FILES\CPUSH\CPUSH.DLL
是广告软件!
已成功阻止其运行,是否要删除此文件?
广告软件名称:AdWare.Win32.BHO.oz

程序:
C:\PROGRAM FILES\COMMON FILES\CPUSH\CPUSH.TMP
是广告软件!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\0830\D03.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\COMMON FILES\CPUSH\UNINST.EXE
2) C:\PROGRAM FILES\COMMON FILES\CPUSH\CPUSH.TMP
是否删除木马程序及其衍生物?
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\0830\D03.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Downloader.Win32.QQHelper.fre

程序:
C:\WINDOWS.0\SYSTEM32\NETDDE32.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知木马

程序:
C:\WINDOWS.0\SYSTEM32\D03.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?


bbsj.exe和task.exe是什么东西啊

woai_jolin

2007-8-30 21:21:51        Scanning Log
2007-8-30 21:21:51        Version of virus signature database: 2492 (20070830)
2007-8-30 21:21:51        Date: 30.8.2007  Time: 21:21:51
2007-8-30 21:21:51        Scanned disks, folders and files: F:\v\0830.rar
2007-8-30 21:21:53        F:\v\0830.rar » RAR » bbsj.exe » UPX v12_m2 - is OK
2007-8-30 21:21:53        F:\v\0830.rar » RAR » CDAC11BA.EXE - is OK
2007-8-30 21:21:53        F:\v\0830.rar » RAR » d03.exe » NSIS » cpush.dll - probably a variant of Win32/Adware.BHO.AV application
2007-8-30 21:21:53        F:\v\0830.rar » RAR » d03.exe » NSIS » Uninst.exe » NSIS
2007-8-30 21:21:53        F:\v\0830.rar » RAR » sys169.exe - a variant of Win32/PSW.Delf.NIY trojan
2007-8-30 21:21:53        F:\v\0830.rar » RAR » task.exe » UPX v12_m2 - is OK
2007-8-30 21:21:53        F:\v\0830.rar » RAR » TIMHost.dll - is OK
2007-8-30 21:21:53        F:\v\0830.rar » RAR » ~Temp7525.tmp - Win32/PSW.OnLineGames.NBR trojan
2007-8-30 21:21:53        F:\v\0830.rar » RAR » 13d012.exe » NSIS » netdde32.exe - probably unknown NewHeur_PE virus [7]
2007-8-30 21:21:53        F:\v\0830.rar » RAR » 13d012.exe » NSIS » d03.exe » NSIS » cpush.dll - probably a variant of Win32/Adware.BHO.AV application
2007-8-30 21:21:53        F:\v\0830.rar » RAR » 13d012.exe » NSIS » d03.exe » NSIS » Uninst.exe » NSIS
2007-8-30 21:21:53        Number of scanned files: 13
2007-8-30 21:21:53        Number of threats found: 5
2007-8-30 21:21:53        Time of completion: 21:21:53  Total scanning time: 2 sec (00:00:02)
2007-8-30 21:21:53       
2007-8-30 21:21:53        Notes:
2007-8-30 21:21:53        [7] File is probably infected with an unknown virus.

欠妳緈諨