178319 f5c22d f92b09 dd3415 2bc8ae f045e4

显示全部楼层 · 发表于 2007-9-6 13:10:07

antivir终于把算算数的bug改对了，不会再出现负数的问题了。。

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\6.zip'
C:\Documents and Settings\Administrator\My Documents\
  6.zip
[0] Archive type: ZIP
--> 5.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 6.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 1.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
--> 2.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 3.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 4.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

End of the scan: 2007年9月5日  22:09
Used time: 00:04 min

The scan has been done completely.

   0 Scanning directories
   7 Files were scanned
   5 viruses and/or unwanted programs were found
   1 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   1 Archives were scanned
   7 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-9-6 13:59:46

程序:
C:\DOCUMENTS AND SETTINGS\WINGCHEN\桌面\6\1.EXE
1) C:\DFD2244265.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\WINGCHEN\桌面\6\1.EXE
1) C:\DFD2244265.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\WINGCHEN\桌面\6\2.EXE
木马程序生成以下文件:
1) C:\WINDOWS\CMDBCS.EXE
2) C:\WINDOWS\SYSTEM32\CMDBCS.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\WINGCHEN\桌面\6\3.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\SERVET.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\WINGCHEN\桌面\6\4.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\SYSTEM6.JUP
2) C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\SYSTEM6.INS
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\WINGCHEN\桌面\6\5.EXE
木马程序生成以下文件:
1) C:\WINDOWS\MPPDS.EXE
2) C:\WINDOWS\SYSTEM32\MPPDS.DLL
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-9-6 14:50:49

Scan performed at: 2007-9-6 14:50:29
Scanning Log
NOD32 version 2508 (20070906) NT
Command line: C:\Documents and Settings\Don johnson\桌面\6.zip
Operating memory - is OK

Date: 6.9.2007 Time: 14:50:34
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\6.zip
C:\Documents and Settings\Don johnson\桌面\6.zip ?ZIP ?5.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\6.zip ?ZIP ?6.exe - probably a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Don johnson\桌面\6.zip ?ZIP ?1.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\6.zip ?ZIP ?2.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Don johnson\桌面\6.zip ?ZIP ?3.exe - probably a variant of Win32/TrojanDownloader.Delf.NSA trojan
C:\Documents and Settings\Don johnson\桌面\6.zip ?ZIP ?4.exe - a variant of Win32/PSW.Delf.NIY trojan
Number of scanned files: 7
Number of threats found: 6
Number of files cleaned: 1
Time of completion: 14:50:35 Total scanning time: 1 sec (00:00:01)

显示全部楼层 · 发表于 2007-9-6 15:09:49

VirSCAN.org Scanned Report :
Scanned time : 2007/09/06 15:07:17 (CST)
Scanner results: 74%的杀软(23/31)报告发现病毒
File Name    : 6.zip
File Size    : 96967 byte
File Type    : Zip archive data, at least v2.0 to extract
MD5          : 12a2b3bf5bbde500e66b4836d7a40489
SHA1          : 448d4b3221c9d0bb001c2483fe8504fd0d0f9ffe
Online report  : http://virscan.org/report.php?id=12a2b3bf5bbde500e66b4836d7a40489

Scanner       Engine Ver    Sig Ver          Sig Date Time Scan result
a-squared    3.0.0.123    2007.09.05       2007-09-05  3.81 -
小红伞       7.6.0.5       6.39.1.95       2007-09-06  2.41 DR/Delphi.Gen
Arcavir       1.0.4          200709051809    2007-09-05  2.00 -
AVAST       1.0.8          000773-0       2007-09-05  3.04 Win32:Delf-FFN [Trj]
AVG          7.5.48.442    269.13.6/991    2007-09-05  1.76 Generic7.FKD
BitDefender 7.60825.862078  7.14639          2007-09-06  3.35 Generic.PWStealer.C7B5136F
CA (VET)    8.4.0.24       31.1.5113       2007-09-06  0.99 Win32/Frethog!generic trojan.
ClamAV       0.91.1       4169             2007-09-06  1.23 Trojan.Spy-12339
Comodo       2.11          2.0.0.276       2007-09-06  1.41 -
大蜘蛛       4.33          2007.09.05       2007-09-05  5.11 MULDROP.Trojan
ewido       4.0.0.2       2007.09.05       2007-09-05  2.17 -
冰岛杀毒    3.16.16       2007.09.06       2007-09-06  1.11 W32/Downloader-WebExe-based!Maximus
F-SECURE    5.51.6100    2007.09.05.08    2007-09-05  3.20 -
IKARUS       T3.1.1.12    2007.09.06.69456  2007-09-06  1.69 Trojan-Dropper.Win32.Agent.ane
江民杀毒    10.00.650    2007.09.04       2007-09-04  0.85 Trojan/Agent.ohn
卡巴斯基    5.5.10       2007.09.06       2007-09-06  0.23 Trojan-PSW.Win32.Delf.aak
金山毒霸    2007.6.20.249 2007.9.6       2007-09-06  2.30 -
迈克菲       5.2.00       5113             2007-09-05  1.80 New Malware.n
MKS_VIR       2.01          2007.09.05       2007-09-05  2.62 -
NOD32       2.70.8       2508             2007-09-06  0.43 a variant of Win32/PSW.Delf.NIY trojan
诺曼          5.91.07       5.90             2007-09-05  2.96 W32/Suspicious_U.gen
熊猫卫士    9.04.03.0001 2007.09.05       2007-09-05  3.99 Suspicious file
趋势          8.500-1001    4.695.00       2007-09-04  0.56 TSPY_ONLINEG.GDJ
QuickHeal    9.00          2007.09.05       2007-09-05  2.48 Suspicious - DNAScan
瑞星          19.0          19.39.31.00    2007-09-06  3.50 -
SOPHOS       2.49.1       4.21             2007-09-06  2.93 Mal/Dloadr-B
赛门铁克    1.3.0.24       20070905.023    2007-09-05  1.45 Downloader
nProtect    2007-09-06.00 43495          2007-09-06  14.48  Generic.Malware.SBdldg.A7E2DD84
The Hacker    6.1.9          v00178          2007-09-05  1.12 W32/Behav-Heuristic-60
VBA32       3.12.2.4       20070906.0441    2007-09-06  2.77 MalwareScope.Trojan-PSW.Game.7
VirusBuster 4.3.19:9       9.101.2/11.0    2007-09-05  1.65 Packed/Upack

显示全部楼层 · 发表于 2007-9-6 15:25:44

MicroVita AntiSpyware 100 C
_____________________________________________

         风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]
               http://221.10.254.214/
----------------------------------------------
开始扫描……

正在检查启动……
[C:\Documents and Settings\Administrator\桌面\virus\6\5.exe]
                  …………引擎[3]发现Suspicious file
[C:\Documents and Settings\Administrator\桌面\virus\6\1.exe]
                  …………引擎[3]发现Suspicious file
[C:\Documents and Settings\Administrator\桌面\virus\6\2.exe]
                  …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\6\3.exe]
                  …………引擎[3]发现Suspicious file
[C:\Documents and Settings\Administrator\桌面\virus\6\4.exe]
                  …………引擎[3]发现Suspicious file
[C:\Documents and Settings\Administrator\桌面\virus\6\5.exe]
                  …………特征码引擎[1]发现病毒
文件数:6 病毒数:6
OK  扫描完毕！

显示全部楼层 · 发表于 2007-9-6 17:56:26

F:\6.zip >>ZIP >>5.exe - 可能是 Win32/Genetik 木马的一个变种
F:\6.zip >>ZIP >>6.exe - 可能是 Win32/PSW.OnLineGames.YA 木马的一个变种
F:\6.zip >>ZIP >>1.exe - 可能是 Win32/Genetik 木马的一个变种
F:\6.zip >>ZIP >>2.exe - Win32/PSW.OnLineGames.YA 木马的变种
F:\6.zip >>ZIP >>3.exe - 可能是 Win32/TrojanDownloader.Delf.NSA 木马的一个变种
F:\6.zip >>ZIP >>4.exe - Win32/PSW.Delf.NIY 木马的变种

显示全部楼层 · 发表于 2007-9-6 18:30:23

Starting the file scan:

Begin scan in 'C:\Documents and Settings\tim\桌面\6.zip'
C:\Documents and Settings\tim\桌面\6.zip
  [0] Archive type: ZIP
  --> 5.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 6.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 1.exe
   [DETECTION] Is the Trojan horse TR/Spy.Delf.afu
  --> 2.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 3.exe
   [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> 4.exe
   [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
   [INFO]    A backup was created as '4759d6e4.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-9-6 18:32:23

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Paranoia Database - 3295
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder

C:\Documents and Settings\uhthn\Desktop\New Folder\5.exe - Suspicious of Trojan-PSW.OnLineGames.1
C:\Documents and Settings\uhthn\Desktop\New Folder\6.exe - Suspicious of Trojan-Downloader.Small.2
C:\Documents and Settings\uhthn\Desktop\New Folder\1.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\2.exe - Suspicious of Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\New Folder\3.exe - Suspicious of Win32.Trojan-Downloader.Zlob.1
C:\Documents and Settings\uhthn\Desktop\New Folder\4.exe - Suspicious of Win32.Trojan-PSW.Game.1

6 Files scanned
0 Infected files found
6 Suspicious files found
0 Files cured
0 Files deleted

[病毒样本] 178319 f5c22d f92b09 dd3415 2bc8ae f045e4

本帖子中包含更多资源

本帖子中包含更多资源