继续17只

promised

[MD5: 99E194 76FB46 DA5926 4C62FF 2D2D25 A84913 DE9893 84B2D6 AAA603 10293C 20C697 35CC31 71E760 AF3AF8 835CCB A8EAB5 63E8B6]

aziok

Begin scan in \桌面\样本.rar
  [0] Archive type: RAR
  --> 15.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 14.exe
      [DETECTION] Contains signature of the worm WORM/QQPass.N
  --> 13.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
  --> 12.exe
      [DETECTION] Is the Trojan horse TR/Spy.Delf.abi.3
  --> 11.exe
      [DETECTION] Is the Trojan horse TR/Agent.11112
  --> 10.exe
      [DETECTION] Is the Trojan horse TR/Agent.11212
  --> 9.exe
      [DETECTION] Is the Trojan horse TR/Spy.Delf.abi.2
  --> 8.exe
      [DETECTION] Is the Trojan horse TR/Agent.12334
  --> 7.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 6.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGame.YF
  --> 5.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 4.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 3.exe
      [DETECTION] Is the Trojan horse TR/Spy.Delf.abi.1
  --> 2.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 1.exe
      [DETECTION] Is the Trojan horse TR/Agent.17971.1
  --> 20.exe
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Agent.alh.32 Backdoor server programs
  --> 16.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was deleted!

wangjay1980

detected: Trojan program Trojan-Spy.Win32.Delf.abi        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/15.exe
detected: virus Worm.Win32.QQPass.n        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/14.exe//UPX
detected: Trojan program Trojan-PSW.Win32.OnLineGames.akj        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/13.exe//PE_Patch//UPack
detected: Trojan program Trojan-Spy.Win32.Delf.abi        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/12.exe
detected: Trojan program Trojan-Spy.Win32.Delf.abi        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/11.exe
detected: Trojan program Trojan-Spy.Win32.Delf.abi        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/10.exe
detected: Trojan program Trojan-Spy.Win32.Delf.abi        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/9.exe
detected: Trojan program Trojan-Spy.Win32.Delf.abi        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/8.exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.bjn        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/7.exe//PE_Patch.UPX//UPX
detected: Trojan program Trojan-PSW.Win32.OnLineGames.bjb        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/6.exe//PE_Patch.UPX//UPX
detected: Trojan program Trojan-PSW.Win32.WOW.un        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/5.exe//FSG
detected: Trojan program Trojan-PSW.Win32.OnLineGames.bjk        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/4.exe//UPack
detected: Trojan program Trojan-Spy.Win32.Delf.abi        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/3.exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.bjl        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/2.exe
detected: Trojan program Trojan-Spy.Win32.Delf.abi        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/1.exe
detected: Trojan program Backdoor.Win32.Agent.alh        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/20.exe//UPack
detected: Trojan program Trojan-Spy.Win32.Delf.abi        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/16.exe

The EQs

Scan performed at: 2007-9-1 19:36:41
Scanning Log
NOD32 version 2495 (20070901) NT
Command line: C:\Documents and Settings\Don johnson\桌面\样本.rar
Operating memory - is OK

Date: 1.9.2007  Time: 19:36:45
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\样本.rar
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?15.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?14.exe - a variant of Win32/AutoRun.Q worm
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?13.exe - a variant of Win32/PSW.Legendmir.NEP trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?12.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?11.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?10.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?9.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?8.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?7.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?6.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?4.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?3.exe - a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?2.exe - probably a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?1.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?20.exe - Win32/Agent.NEM trojan - was a part of the deleted object
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?16.exe - probably a variant of Win32/Genetik trojan
Number of scanned files: 18
Number of threats found: 16
Number of files cleaned: 1
Time of completion: 19:36:51 Total scanning time: 6 sec (00:00:06)

坐在墙头

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.WoWar.vn
病毒： Trojan.PSW.Win32.Agent.vcx
病毒： Trojan.PSW.Win32.OnlineGames.ydk
病毒： Trojan.PSW.Win32.OnlineGames.ycn
病毒： Trojan.PSW.Win32.OnlineGames.yda
病毒： Trojan.PSW.Win32.OnlineGames.yav
病毒： Trojan.PSW.Win32.OnlineGames.yaz
病毒： Trojan.PSW.Win32.OnlineGames.xzf
病毒： Worm.Win32.Pabug.n      
病毒： Hack.Win32.ArpCheater.d  
病毒： Trojan.PSW.Win32.OnlineGames.ybp
病毒： Trojan.PSW.Win32.RocOnline.cx



用户来源：局域网

软件版本：19.38.52

promised

卡巴终于17只了
PS:最近王版好像有些漏上报的，还是我上报的

shaw530

Nod报了16个，5.exe没报
卡巴全部报了

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Paranoia Database - 1414
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder

C:\Documents and Settings\uhthn\Desktop\New Folder\15.exe - Suspicious of Trojan-Spy.Delf.2
C:\Documents and Settings\uhthn\Desktop\New Folder\14.exe - Infected with Win32.Malware.1284
C:\Documents and Settings\uhthn\Desktop\New Folder\13.exe - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder\12.exe - Suspicious of Trojan-Spy.Delf.2
C:\Documents and Settings\uhthn\Desktop\New Folder\11.exe - Suspicious of Trojan-Spy.Delf.2
C:\Documents and Settings\uhthn\Desktop\New Folder\10.exe - Suspicious of Trojan-Spy.Delf.2
C:\Documents and Settings\uhthn\Desktop\New Folder\9.exe - Suspicious of Trojan-Spy.Delf.2
C:\Documents and Settings\uhthn\Desktop\New Folder\8.exe - Suspicious of Trojan-Spy.Delf.2
C:\Documents and Settings\uhthn\Desktop\New Folder\7.exe - Infected with Malware.465
C:\Documents and Settings\uhthn\Desktop\New Folder\6.exe - Suspicious of Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\New Folder\5.exe - Infected with Malware.1075
C:\Documents and Settings\uhthn\Desktop\New Folder\4.exe - Suspicious of Trojan-Spy.Delf.2
C:\Documents and Settings\uhthn\Desktop\New Folder\3.exe - Suspicious of Trojan-Spy.Delf.2
C:\Documents and Settings\uhthn\Desktop\New Folder\2.exe - Infected with Malware.154
C:\Documents and Settings\uhthn\Desktop\New Folder\1.exe - Infected with Malware.293
C:\Documents and Settings\uhthn\Desktop\New Folder\20.exe - Infected with Malware.1071
C:\Documents and Settings\uhthn\Desktop\New Folder\16.exe - Suspicious of Trojan-Spy.Delf.2

17 Files scanned
6 Infected files found
11 Suspicious files found
0 Files cured
6 Files deleted

微点卫士

微点：
蠕虫名称:Worm.Win32.QQPass.g

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\14.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Spy.Win32.Delf.dqf

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\12.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Spy.Win32.Delf.dqj

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\10.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Spy.Win32.Delf.dqg

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\9.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Spy.Win32.Delf.dpv

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\8.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.WOW.axs

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\5.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan.Win32.Genetik.byb

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\4.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Spy.Win32.Delf.dqp

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\3.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Spy.Win32.Delf.dox

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\1.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
蠕虫名称:Worm.Win32.Agent.dew

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\20.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Spy.Win32.Delf.dqo

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\16.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\2.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\UPXDND.EXE
2) C:\WINDOWS.0\SYSTEM32\UPXDND.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\6.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\DBGHLP32.EXE
2) C:\WINDOWS.0\SYSTEM32\DBGHLP32.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\7.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\CMDBCS.EXE
2) C:\WINDOWS.0\SYSTEM32\CMDBCS.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\11.EXE
1) C:\DFD1518437.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\11.EXE
1) C:\DFD1518437.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\15.EXE
1) C:\DFD1548390.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\15.EXE
1) C:\DFD1548390.BAT
是否删除可疑程序?

13挂了，上报

taihuxian

--> 15.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 14.exe
      [DETECTION] Contains signature of the worm WORM/QQPass.N
  --> 13.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
  --> 12.exe
      [DETECTION] Is the Trojan horse TR/Spy.Delf.abi.3
  --> 11.exe
      [DETECTION] Is the Trojan horse TR/Agent.11112
  --> 10.exe
      [DETECTION] Is the Trojan horse TR/Agent.11212
  --> 9.exe
      [DETECTION] Is the Trojan horse TR/Spy.Delf.abi.2
  --> 8.exe
      [DETECTION] Is the Trojan horse TR/Agent.12334
  --> 7.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 6.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGame.YF
  --> 5.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 4.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 3.exe
      [DETECTION] Is the Trojan horse TR/Spy.Delf.abi.1
  --> 2.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 1.exe
      [DETECTION] Is the Trojan horse TR/Agent.17971.1
  --> 20.exe
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Agent.alh.32 Backdoor server programs
  --> 16.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      A backup was created as '47085853.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!


End of the scan: 2007年9月1日  20:17
Used time: 00:12 min

The scan has been done completely.

      0 Scanning directories
     18 Files were scanned
     17 viruses and/or unwanted programs were found
      3 classified as suspicious:
      1 files were deleted