4个[MD5: DCC361 D9B533 327A23 591955]

promised

红心王子

Start of the scan: 2007年9月8日  17:24

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本2.rar'
C:\Documents and Settings\Administrator\桌面\样本2.rar
  [0] Archive type: RAR
  --> 0908.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> zsmscc070906.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was moved to '4714d15f.qua'!


End of the scan: 2007年9月8日  17:24
Used time: 00:07 min

The scan has been done completely.

      0 Scanning directories
      5 Files were scanned
      2 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

平淡

promised

C:\ABC\样本2.rar:\0908.exe - 特征码 'Trojan-Spy.Win32.Agent.pn' 被发现
C:\ABC\样本2.rar:\zsmscc070908.dll - 特征码 'Trojan-Spy.Win32.Delf.uh' 被发现
C:\ABC\样本2.rar:\zsmscc070906.exe - 特征码 'Trojan-Spy.Win32.Agent.pn' 被发现
C:\ABC\样本2.rar:\zsmscc070906.dll - 特征码 'Trojan-Spy.Win32.Delf.uh' 被发

The EQs

Scan performed at: 2007-9-8 18:32:52
Scanning Log
NOD32 version 2514 (20070908) NT
Command line: C:\Documents and Settings\Don johnson\桌面\样本2.rar
Operating memory - is OK

Date: 8.9.2007  Time: 18:32:55
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\样本2.rar
C:\Documents and Settings\Don johnson\桌面\样本2.rar ?RAR ?0908.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\样本2.rar ?RAR ?zsmscc070906.exe - probably a variant of Win32/Genetik trojan
Number of scanned files: 5
Number of threats found: 2
Number of files cleaned: 1
Time of completion: 18:32:57 Total scanning time: 2 sec (00:00:02)

微点卫士

微点：
木马名称:Trojan.Win32.Genetik.ccu

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ZSMSCC070906.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\0908.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\ZSMSCC070908.EXE
2) C:\WINDOWS.0\SYSTEM32\ZSMSCC32.DLL
3) C:\WINDOWS.0\SYSTEM32\ZSMSCC070908.DLL
是否删除木马程序及其衍生物?

woai_jolin

已删除：木马程序 Trojan-Downloader.Win32.Agent.czu        文件　: F:\v\样本2.rar/0908.exe//PE_Patch//UPack
已删除：木马程序 Trojan-Downloader.Win32.Agent.czu        文件　: F:\v\样本2.rar/zsmscc070906.exe//PE_Patch//UPack
已删除：木马程序 Trojan-Downloader.Win32.Agent.czu        文件　: F:\v\样本2.rar/zsmscc070906.dll

zzx129

Virus infection found

File which you are trying download contains virus. Loading has been interrupted.
Technical data:
Error name: Virus Alert
Virus description Generic7.FMG
Error code: -1602
Requested URL: /attachment.php?aid=125287
Requested HTTP method: GET
Requested ContentType: application/octet-stream
Requested IP: 211.136.18.143

wangjay1980

detected: Trojan program Trojan-Downloader.Win32.Agent.czu        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾2.rar/0908.exe//PE_Patch//UPack
detected: Trojan program Trojan-Downloader.Win32.Agent.czu        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾2.rar/zsmscc070906.exe//PE_Patch//UPack
detected: Trojan program Trojan-Downloader.Win32.Agent.czu        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾2.rar/zsmscc070906.dll

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Paranoia Database - 3925
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder (2)

C:\Documents and Settings\uhthn\Desktop\New Folder (2)\0908.exe - Suspicious of Trojan-PSW.Game.4
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\zsmscc070908.dll - Suspicious file
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\zsmscc070906.exe - Infected with PDB-42 Malware program - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\zsmscc070906.dll - Suspicious file

4 Files scanned
1 Infected files found
3 Suspicious files found
0 Files cured
1 Files deleted