昨天遗漏的[MD5: 4DB60B CD7DB2 3DDF32]

promised

1

The EQs

Scan performed at: 2007-9-6 16:51:42
Scanning Log
NOD32 version 2508 (20070906) NT
Command line: C:\Documents and Settings\Don johnson\桌面\样本1.rar
Operating memory - is OK

Date: 6.9.2007  Time: 16:51:46
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\样本1.rar
C:\Documents and Settings\Don johnson\桌面\样本1.rar ?RAR ?wow.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\Don johnson\桌面\样本1.rar ?RAR ?zt.exe - probably a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\样本1.rar ?RAR ?4.exe - probably unknown NewHeur_PE virus [7]
Number of scanned files: 4
Number of threats found: 3
Number of files cleaned: 1
Time of completion: 16:51:47 Total scanning time: 1 sec (00:00:01)

Notes:
[7] File is probably infected with an unknown virus.

wangjay1980

detected: Trojan program Trojan-Spy.Win32.Delf.acg        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/zt.exe//UPack//#
detected: Trojan program Trojan-PSW.Win32.OnLineGames.box        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/4.exe//UPack
这个也漏

FBAV

MicroVita AntiSpyware 100 C
_____________________________________________
                                          
             风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]                  
                   http://221.10.254.214/
----------------------------------------------
开始扫描……


[C:\Documents and Settings\Administrator\桌面\virus\样本1.rar]
                    …………引擎[3]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\样本1.rar]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\样本1.rar]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\样本1.rar]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\样本1.rar]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\样本1.rar]
                    …………引擎[2]发现病毒:Win32.Unknow
OK  扫描完毕！[:1:]

hahacomcn

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本1.rar'
C:\Documents and Settings\Administrator\桌面\样本1.rar
  [0] Archive type: RAR
  --> wow.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agen.26778.A
  --> zt.exe
      [DETECTION] Is the Trojan horse TR/Agent.13352
  --> 4.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agen.26778.A

king6808

F:\样本1.rar >>RAR >>wow.exe - 未查明的 NewHeur_PE 病毒 [7]
F:\\样本1.rar >>RAR >>zt.exe - 可能是 Win32/PSW.OnLineGames.NEN 木马 的一个变种
F:\样本1.rar >>RAR >>4.exe - 未查明的 NewHeur_PE 病毒 [7]

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Paranoia Database - 3303
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\2

C:\Documents and Settings\uhthn\Desktop\2\wow.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\2\zt.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\2\4.exe - Suspicious of Trojan-PSW.Game.3

3 Files scanned
0 Infected files found
3 Suspicious files found
0 Files cured
0 Files deleted

微点卫士

微点：
木马名称:Trojan-PSW.Win32.OnLineGames.kau

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\4.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\WOW.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\WINOW.EXE
2) C:\WINDOWS.0\WINOW.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ZT.EXE
1) C:\DFD4448703.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ZT.EXE
1) C:\DFD4448703.BAT
是否删除可疑程序?

残缺的唯美

symantec1个

ssy275

结果: 找到 2 恶意软件
Trojan-Spy.Win32.Delf.acg (病毒)
C:\Documents and Settings\ssy\桌面\3.rar\zt.exe
Trojan-PSW.Win32.OnLineGames.box (病毒)
C:\Documents and Settings\ssy\桌面\3.rar\4.exe