移动硬盘上的东西

qwerasdf123

绅博周幸

Starting the file scan:

Begin scan in 'D:\virus.rar'
D:\virus.rar
  [0] Archive type: RAR
  --> Blood.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Zhidao
  --> A0090622.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> A0092792.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> A0093965.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> A0191091.dll
      [DETECTION] Is the Trojan horse TR/Agent.BTD
  --> A0191103.exe
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Fesa.A
  --> A0195103.pif
      [DETECTION] Is the Trojan horse TR/PSW.Delf.WH.2
      [WARNING]   The file was ignored!


End of the scan: 2007年9月13日  13:10
Used time: 00:08 min

The scan has been done completely.

      0 Scanning directories
      8 Files were scanned
      4 viruses and/or unwanted programs were found
      3 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      4 Files not concerned
      1 Archives were scanned
      1 Warnings
      0 Notes

1688388728

检测到：病毒 Virus.Win32.Delf.bz        URL: http://bbs.kafan.cn/attachment.php?aid=127390//Blood.exe

taihuxian

BitDefender

This web page has been blocked by BitDefender Antivirus Real-time Protection!

The blocked web page included objects that were either infected or likely to be infected with a virus. Your system has NOT been infected.

xffsfy

NIS2008的界面很华丽....

残缺的唯美

Scan performed at: 2007-9-14 7:58:33
Scanning Log
NOD32 version 2529 (20070913) NT
Command line: D:\Documents and Settings\EKINCHENG\桌面\virus.rar

Date: 14.9.2007  Time: 07:58:34
Anti-Stealth technology is enabled.
Scanned disks, folders and files: D:\Documents and Settings\EKINCHENG\桌面\virus.rar
D:\Documents and Settings\EKINCHENG\桌面\virus.rar ?RAR ?Blood.exe - Win32/Drowor.C virus - was a part of the deleted object
D:\Documents and Settings\EKINCHENG\桌面\virus.rar ?RAR ?A0093965.exe - probably unknown NewHeur_PE virus [7]
D:\Documents and Settings\EKINCHENG\桌面\virus.rar ?RAR ?A0195103.pif - Win32/PSW.Delf.NHI trojan - was a part of the deleted object
Number of scanned files: 8
Number of threats found: 3
Number of files cleaned: 1
Time of completion: 07:58:35 Total scanning time: 1 sec (00:00:01)

Notes:
[7] File is probably infected with an unknown virus.

欠妳緈諨

wangjay1980

detected: virus Virus.Win32.Delf.bz        File: C:\Documents and Settings\Owner\×ÀÃæ\virus.rar/Blood.exe
detected: virus Heur.Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\virus.rar/A0093965.exe//PE_Patch.Pex//Pex
detected: Trojan program Trojan-PSW.Win32.Delf.wh        File: C:\Documents and Settings\Owner\×ÀÃæ\virus.rar/A0195103.pif//PE_Patch.UPX//UPX

微点卫士

微点：
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\A0093965.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\SYSTEM.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\A0195103.PIF
由
C:\AUTORUN.INF
自启动运行!
并生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\NEWTEMP.BAK
2) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\NEWTEMP.DLL
3) C:\PEGEFILE.PIF4) D:\PEGEFILE.PIF
5) C:\AUTORUN.INF
以及可由此INF文件引导自启的文件:
C:\PEGEFILE.PIF

是否删除木马程序及其衍生物?

剩下的需要上报

tracydk

2007-09-14 15:52:21    运行应用程序      操作:允许
进程路径:C:\WINDOWS\Explorer.EXE
文件路径:F:\病毒样本\virus\A0195103.pif
触发规则:所有程序规则->*


2007-09-14 15:52:23    创建文件      操作:阻止
进程路径:F:\病毒样本\virus\A0195103.pif
文件路径:C:\PegeFile.pif
触发规则:所有程序规则->系统文件->%SystemDrive%\*


2007-09-14 15:52:24    创建文件      操作:阻止
进程路径:F:\病毒样本\virus\A0195103.pif
文件路径:C:\PegeFile.pif
触发规则:所有程序规则->系统文件->%SystemDrive%\*


2007-09-14 15:52:24    创建文件      操作:阻止
进程路径:F:\病毒样本\virus\A0195103.pif
文件路径:C:\PegeFile.pif
触发规则:所有程序规则->系统文件->%SystemDrive%\*


2007-09-14 15:52:25    创建文件      操作:阻止
进程路径:F:\病毒样本\virus\A0195103.pif
文件路径:C:\autorun.inf
触发规则:所有程序规则->系统文件->?:\autorun.inf


2007-09-14 15:52:26    创建文件      操作:阻止
进程路径:F:\病毒样本\virus\A0195103.pif
文件路径:D:\autorun.inf
触发规则:所有程序规则->系统文件->?:\autorun.inf


2007-09-14 15:52:26    创建文件      操作:阻止
进程路径:F:\病毒样本\virus\A0195103.pif
文件路径:E:\autorun.inf
触发规则:所有程序规则->系统文件->?:\autorun.inf


2007-09-14 15:52:27    创建文件      操作:阻止
进程路径:F:\病毒样本\virus\A0195103.pif
文件路径:F:\autorun.inf
触发规则:所有程序规则->系统文件->?:\autorun.inf


2007-09-14 15:52:27    创建文件      操作:阻止
进程路径:F:\病毒样本\virus\A0195103.pif
文件路径:G:\autorun.inf
触发规则:所有程序规则->系统文件->?:\autorun.inf


2007-09-14 15:52:29    安装全局钩子      操作:阻止
进程路径:F:\病毒样本\virus\A0195103.pif
文件路径:C:\Program Files\Internet Explorer\PLUGINS\NewTemp.dll
触发规则:所有程序规则->*