继续更新16个

promised

[MD5: E446F1 860361 4A91E3 485BDA 43DB27 E9AA47 57F1A0 58314D 52A7AF 876EED BF5B83 3E56CE 4FD6A6 35A098 CC17B6 C3DF61]

The EQs

Scan performed at: 2007-9-1 19:44:29
Scanning Log
NOD32 version 2495 (20070901) NT
Command line: C:\Documents and Settings\Don johnson\桌面\样本1.rar
Operating memory - is OK

Date: 1.9.2007  Time: 19:44:33
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\样本1.rar
C:\Documents and Settings\Don johnson\桌面\样本1.rar ?RAR ?qqhx.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
C:\Documents and Settings\Don johnson\桌面\样本1.rar ?RAR ?mir.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
C:\Documents and Settings\Don johnson\桌面\样本1.rar ?RAR ?cs.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\样本1.rar ?RAR ?wl.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\样本1.rar ?RAR ?fy.exe - Win32/Delf.NFD trojan - was a part of the deleted object
C:\Documents and Settings\Don johnson\桌面\样本1.rar ?RAR ?wd.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
C:\Documents and Settings\Don johnson\桌面\样本1.rar ?RAR ?tl.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\样本1.rar ?RAR ?mh.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\样本1.rar ?RAR ?qj.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\样本1.rar ?RAR ?my.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\样本1.rar ?RAR ?dh.exe - a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\样本1.rar ?RAR ?wow.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\Don johnson\桌面\样本1.rar ?RAR ?qst.exe - a variant of Win32/AutoRun.Q worm
C:\Documents and Settings\Don johnson\桌面\样本1.rar ?RAR ?jh.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\样本1.rar ?RAR ?zx.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\样本1.rar ?RAR ?zt.exe - probably a variant of Win32/Genetik trojan
Number of scanned files: 17
Number of threats found: 16
Number of files cleaned: 1
Time of completion: 19:44:37 Total scanning time: 4 sec (00:00:04)

Notes:
[7] File is probably infected with an unknown virus.

wangjay1980

detected: virus Heur.Trojan.Generic (modification)        File: E:\Ñù±¾\bingdu\qqhx.exe//PE_Patch//UPack
detected: virus Heur.Trojan.Generic (modification)        File: E:\Ñù±¾\bingdu\mir.exe//PE_Patch//UPack
detected: Trojan program Trojan-Spy.Win32.Delf.aao        File: E:\Ñù±¾\bingdu\cs.exe//UPack//#
detected: Trojan program Backdoor.Win32.Delf.awy        File: E:\Ñù±¾\bingdu\fy.exe
detected: virus Heur.Trojan.Generic (modification)        File: E:\Ñù±¾\bingdu\wd.exe//PE_Patch//UPack
detected: Trojan program Trojan-Spy.Win32.Delf.aao        File: E:\Ñù±¾\bingdu\tl.exe//UPack//#
detected: Trojan program Trojan-Spy.Win32.Delf.abt        File: E:\Ñù±¾\bingdu\mh.exe//UPack
detected: Trojan program Trojan-Spy.Win32.Delf.aao        File: E:\Ñù±¾\bingdu\qj.exe//UPack//#
detected: Trojan program Trojan-PSW.Win32.OnLineGames.bjk        File: E:\Ñù±¾\bingdu\my.exe//UPack
detected: Trojan program Trojan-Spy.Win32.Delf.abi        File: E:\Ñù±¾\bingdu\dh.exe
detected: Trojan program Trojan-Spy.Win32.Delf.aao        File: E:\Ñù±¾\bingdu\jh.exe//UPack//#
detected: Trojan program Trojan-Spy.Win32.Delf.aao        File: E:\Ñù±¾\bingdu\zx.exe//UPack//#
detected: Trojan program Trojan-Spy.Win32.Delf.aao        File: E:\Ñù±¾\bingdu\zt.exe//UPack//#

微点卫士

微点：
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\CS.EXE
1) C:\DFD685812.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\CS.EXE
1) C:\DFD685812.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\DH.EXE
1) C:\DFD705734.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\DH.EXE
1) C:\DFD705734.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\JH.EXE
1) C:\DFD752296.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\JH.EXE
1) C:\DFD752296.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\MH.EXE
1) C:\DFD768921.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\MH.EXE
1) C:\DFD768921.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\FY.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\PACKET.DLL
2) C:\WINDOWS.0\SYSTEM32\WANPACKET.DLL
3) C:\WINDOWS.0\SYSTEM32\WPCAP.DLL
4) C:\WINDOWS.0\SYSTEM32\DRIVERS\SVCHOST.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\MIR.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\NETMEETING\RAVCQMON.EXE
2) C:\PROGRAM FILES\NETMEETING\RAVCQMON.DAT
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\MY.EXE
1) C:\DFD810875.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\MY.EXE
1) C:\DFD810875.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\QJ.EXE
1) C:\DFD824421.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\QJ.EXE
1) C:\DFD824421.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\QQHX.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\NETMEETING\RAVDTHXMON.EXE
2) C:\PROGRAM FILES\NETMEETING\RAVDTHXMON.DAT
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\QST.EXE
由
E:\AUTORUN.INF
自启动运行!
并生成以下文件:
1) E:\AUTORUN.EXE
2) E:\AUTORUN.INF
以及可由此INF文件引导自启的文件:
E:\AUTORUN.EXE

是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\TL.EXE
1) C:\DFD859218.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\TL.EXE
1) C:\DFD859218.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\WD.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\NETMEETING\RAVWDMON.EXE
2) C:\PROGRAM FILES\NETMEETING\RAVWDMON.DAT
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\WL.EXE
1) C:\DFD879906.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\WL.EXE
1) C:\DFD879906.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\WOW.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\WINOW.EXE
2) C:\WINDOWS.0\WINOW.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\ZT.EXE
1) C:\DFD902500.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\ZT.EXE
1) C:\DFD902500.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\ZX.EXE
1) C:\DFD916500.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\ZX.EXE
1) C:\DFD916500.BAT
是否删除可疑程序?

全杀咯

aziok

Begin scan in桌面\样本1.rar
  [0] Archive type: RAR
  --> qqhx.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> mir.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> cs.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> wl.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> fy.exe
      [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.1
  --> wd.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> tl.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> mh.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> qj.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> my.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> dh.exe
      [DETECTION] Is the Trojan horse TR/Spy.Delf.abi.1
  --> wow.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agen.26778.A
  --> qst.exe
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
  --> jh.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> zx.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> zt.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was deleted!


End of the scan: 2007年9月1日  19:51
Used time: 00:10 min

The scan has been done completely.

      0 Scanning directories
     18 Files were scanned
     16 viruses and/or unwanted programs were found
     12 classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
    -10 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

promised

红伞一帮高启发

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Paranoia Database - 1425
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder

C:\Documents and Settings\uhthn\Desktop\New Folder\qqhx.exe - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder\mir.exe - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder\cs.exe - Suspicious of Trojan-Spy.Delf.2
C:\Documents and Settings\uhthn\Desktop\New Folder\wl.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\fy.exe - Infected with Win32.Malware.650
C:\Documents and Settings\uhthn\Desktop\New Folder\wd.exe - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder\tl.exe - Suspicious of Trojan-Spy.Delf.2
C:\Documents and Settings\uhthn\Desktop\New Folder\mh.exe - Suspicious of Trojan-Spy.Delf.2
C:\Documents and Settings\uhthn\Desktop\New Folder\qj.exe - Suspicious of Trojan-Spy.Delf.2
C:\Documents and Settings\uhthn\Desktop\New Folder\my.exe - Suspicious of Trojan-Spy.Delf.2
C:\Documents and Settings\uhthn\Desktop\New Folder\dh.exe - Suspicious of Trojan-Spy.Delf.2
C:\Documents and Settings\uhthn\Desktop\New Folder\wow.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\qst.exe - Suspicious of Win32.Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\New Folder\jh.exe - Suspicious of Trojan-Spy.Delf.2
C:\Documents and Settings\uhthn\Desktop\New Folder\zx.exe - Suspicious of Trojan-Spy.Delf.2
C:\Documents and Settings\uhthn\Desktop\New Folder\zt.exe - Suspicious of Trojan-Spy.Delf.2

16 Files scanned
1 Infected files found
15 Suspicious files found
0 Files cured
1 Files deleted

tracydk

Starting the file scan:

Begin scan in 'F:\病毒样本\样本1.rar'
F:\病毒样本\样本1.rar
  [0] Archive type: RAR
  --> qqhx.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> mir.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> cs.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> wl.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> fy.exe
      [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.1
  --> wd.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> tl.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> mh.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> qj.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> my.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> dh.exe
      [DETECTION] Is the Trojan horse TR/Spy.Delf.abi.1
  --> wow.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agen.26778.A
  --> qst.exe
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
  --> jh.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> zx.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> zt.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was deleted!

taihuxian

--> qqhx.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> mir.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> cs.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> wl.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> fy.exe
      [WARNING]   The file could not be opened!
      [1] Archive type: ZIP SFX (self extracting)
        [WARNING]   Error opening the file
  --> wd.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> tl.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> mh.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> qj.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> my.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> dh.exe
      [DETECTION] Is the Trojan horse TR/Spy.Delf.abi.1
  --> wow.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agen.26778.A
  --> qst.exe
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
  --> jh.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> zx.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> zt.exe
      [DETECTION] Contains suspicious code HEUR/Malware

碧水寒潭

Start of the scan: 2007年9月1日  20:54

Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\样本1.rar
  [0] Archive type: RAR
  --> qqhx.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> mir.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> cs.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> wl.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> fy.exe
      [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.1
  --> wd.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> tl.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> mh.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> qj.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> my.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> dh.exe
      [DETECTION] Is the Trojan horse TR/Spy.Delf.abi.1
  --> wow.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agen.26778.A
  --> qst.exe
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
  --> jh.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> zx.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> zt.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was deleted!


End of the scan: 2007年9月1日  20:54
Used time: 00:11 min

The scan has been done completely.

      1 Scanning directories
     17 Files were scanned
     16 viruses and/or unwanted programs were found
     12 classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
    -11 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found