再来9个[MD5: BDE381 D2244F 9753BA AD18F5 FAF462 D61CEF 858F9E F785B6 3BB51A]

promised

[MD5: BDE381 D2244F 9753BA AD18F5 FAF462 D61CEF 858F9E F785B6 3BB51A]

微点卫士

微点：
蠕虫名称:Worm.Win32.Agent.dzh

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本2\3.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?
蠕虫名称:Worm.Win32.Agent.djq

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本2\6.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Downloader.Win32.AdLoad.alj

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本2\7.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Downloader.Win32.Small.khr

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本2\5.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Downloader.Win32.LoadAdv.an

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本2\4.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本2\0.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\7B70EAC1.EXE
2) C:\WINDOWS.0\SYSTEM32\94F7F36A.DLL
是否删除木马程序及其衍生物?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本2\0.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本2\1.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:1825
远端地址:60.217.234.139(山东)
远端端口:80
程序:
C:\WINDOWS.0\SYSTEM32\BF11.DLL
是可疑程序，是否阻止该进程继续运行?
程序:
C:\WINDOWS.0\SYSTEM32\BF11.DLL
是否删除病毒程序?
程序:
C:\WINDOWS.0\SYSTEM32\BF11.DLL
是可疑程序，是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本2\1.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\_PLAY.DLL
2) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\_INST.DLL
3) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\_BHO.DLL
4) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\_SER.EXE
5) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\NSTE.TMP\SYSTEM.DLL
6) C:\WINDOWS.0\SYSTEM32\3B1.DLL
7) C:\WINDOWS.0\4F1.BMP
8) C:\WINDOWS.0\F671.EXE
9) C:\WINDOWS.0\SYSTEM32\F15F1.EXE
10) C:\WINDOWS.0\67341.TXT    看这里，TXT也杀 ，第一次看到
是否删除木马程序及其衍生物?
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本2\8.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:1979
远端地址:194.90.224.86(以色列)
远端端口:80


上报2和8

wangjay1980

detected: Trojan program Trojan-Downloader.Win32.Agent.djc        URL: http://bbs.kafan.cn/attachment.php?aid=127640//0.exe//ASPack
detected: Trojan program Trojan-Downloader.Win32.Agent.djc        URL: http://bbs.kafan.cn/attachment.php?aid=127640//2.exe//ASPack
detected: Trojan program Backdoor.Win32.Agent.bmt        URL: http://bbs.kafan.cn/attachment.p ... .exe//UPack//ASPack
detected: virus Worm.Win32.Agent.t        URL: http://bbs.kafan.cn/attachment.p ... ecBundle//PECompact
detected: Trojan program Trojan-Downloader.Win32.Adload.kl        URL: http://bbs.kafan.cn/attachment.php?aid=127640//7.exe//ASPack
detected: Trojan program Trojan-Downloader.Win32.Small.fgr        URL: http://bbs.kafan.cn/attachment.php?aid=127640//5.exe
detected: Trojan program Trojan-Downloader.Win32.LoadAdv.gen        URL: http://bbs.kafan.cn/attachment.p ... //PE_Patch.UPX//UPX
detected: Trojan program Trojan-Downloader.Win32.Small.fox        URL: http://bbs.kafan.cn/attachment.p ... //PE_Patch.UPX//UPX

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.IMMSG.Win32.TBMSG.yga
病毒： Trojan.DL.Win32.Autorun.iot
病毒： Trojan.DL.Win32.Agent.xfj
病毒： Adware.Win32.AdMoke.nyq  
病毒： Trojan.DL.Win32.Agent.xet
病毒： Trojan.DL.Win32.LoadAdv.h

MAC地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：19.40.42

小邪邪

AVK全杀9个

清凉世界

扫描进行于：2007-9-14 21:15:46
扫描日志
NOD32版本 2530 (20070914) NT
命令行： C:\Documents and Settings\Administrator.0CDC92BBFF714E5\桌面\样本2.rar

日期： 14.9.2007  时间：21:15:50
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\Administrator.0CDC92BBFF714E5\桌面\样本2.rar
C:\Documents and Settings\Administrator.0CDC92BBFF714E5\桌面\样本2.rar >>RAR >>0.exe - 可能是 Win32/Agent.NEO 木马 的一个变种
C:\Documents and Settings\Administrator.0CDC92BBFF714E5\桌面\样本2.rar >>RAR >>2.exe - 可能是 Win32/Agent.NEO 木马 的一个变种
C:\Documents and Settings\Administrator.0CDC92BBFF714E5\桌面\样本2.rar >>RAR >>3.exe - 可能是 Win32/Agent.NEO 木马 的一个变种
C:\Documents and Settings\Administrator.0CDC92BBFF714E5\桌面\样本2.rar >>RAR >>6.exe - Win32/Agent.NAU 蠕虫的变种
C:\Documents and Settings\Administrator.0CDC92BBFF714E5\桌面\样本2.rar >>RAR >>5.exe - Win32/TrojanDownloader.Small.DXM 木马
C:\Documents and Settings\Administrator.0CDC92BBFF714E5\桌面\样本2.rar >>RAR >>4.exe - Win32/TrojanDownloader.Small.NUS 木马的变种
C:\Documents and Settings\Administrator.0CDC92BBFF714E5\桌面\样本2.rar >>RAR >>8.exe - 可能是 Win32/TrojanDownloader.Small.EQN 木马 的一个变种
已扫描的文件数目：9
已发现的病毒数目：7
完成时间： 21:15:56 总扫描时间：6 秒 (00:00:06)

欠妳緈諨

AVAST杀8个

残缺的唯美

Scan performed at: 2007-9-14 21:33:43
Scanning Log
NOD32 version 2530 (20070914) NT
Command line: D:\Documents and Settings\EKINCHENG\桌面\样本2.rar

Date: 14.9.2007  Time: 21:33:44
Anti-Stealth technology is enabled.
Scanned disks, folders and files: D:\Documents and Settings\EKINCHENG\桌面\样本2.rar
D:\Documents and Settings\EKINCHENG\桌面\样本2.rar ?RAR ?0.exe - probably a variant of Win32/Agent.NEO trojan
D:\Documents and Settings\EKINCHENG\桌面\样本2.rar ?RAR ?2.exe - probably a variant of Win32/Agent.NEO trojan
D:\Documents and Settings\EKINCHENG\桌面\样本2.rar ?RAR ?3.exe - probably a variant of Win32/Agent.NEO trojan
D:\Documents and Settings\EKINCHENG\桌面\样本2.rar ?RAR ?6.exe - a variant of Win32/Agent.NAU worm
D:\Documents and Settings\EKINCHENG\桌面\样本2.rar ?RAR ?5.exe - Win32/TrojanDownloader.Small.DXM trojan - was a part of the deleted object
D:\Documents and Settings\EKINCHENG\桌面\样本2.rar ?RAR ?4.exe - a variant of Win32/TrojanDownloader.Small.NUS trojan
D:\Documents and Settings\EKINCHENG\桌面\样本2.rar ?RAR ?8.exe - probably a variant of Win32/TrojanDownloader.Small.EQN trojan
Number of scanned files: 10
Number of threats found: 7
Number of files cleaned: 1
Time of completion: 21:33:48 Total scanning time: 4 sec (00:00:04)

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Paranoia Database - 4909
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder

C:\Documents and Settings\uhthn\Desktop\New Folder\0.exe - Suspicious of Trojan-PSW.Game.8
C:\Documents and Settings\uhthn\Desktop\New Folder\1.exe - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder\2.exe - Suspicious of Trojan-PSW.Game.8
C:\Documents and Settings\uhthn\Desktop\New Folder\3.exe - Infected with PDB-7aa Malware program - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\6.exe - Infected with Win32.PDB-8f2 Malware program - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\7.exe - Infected with Win32.PDB-dd2 Malware program - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\5.exe - Infected with PDB-c89 Malware program - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\4.exe - Suspicious of Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\New Folder\8.exe - Suspicious of Trojan-Downloader.Small.2

9 Files scanned
4 Infected files found
5 Suspicious files found
0 Files cured
4 Files deleted

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\样本2.rar'
C:\Documents and Settings\Administrator\My Documents\
  样本2.rar
    [0] Archive type: RAR
    --> 0.exe
        [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Exaal.45056 Backdoor server programs
        [WARNING]   Infected files in archives cannot be repaired!
    --> 1.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> 2.exe
        [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Exaal.45056 Backdoor server programs
        [WARNING]   Infected files in archives cannot be repaired!
    --> 3.exe
        [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.bmt Backdoor server programs
        [WARNING]   Infected files in archives cannot be repaired!
    --> 6.exe
        [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 7.exe
        [DETECTION] Is the Trojan horse TR/Dldr.Adload.KL
        [WARNING]   Infected files in archives cannot be repaired!
    --> 5.exe
        [DETECTION] Is the Trojan horse TR/Dldr.Small.dxm.4
        [WARNING]   Infected files in archives cannot be repaired!
    --> 4.exe
        [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 8.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!


End of the scan: 2007年9月14日  07:53
Used time: 00:03 min

The scan has been done completely.

      0 Scanning directories
     10 Files were scanned
      8 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      1 Archives were scanned
     10 Warnings
      0 Notes