瑞星2008主动防御报的malicious code

kp2006

快杀

scottxzt

Begin scan in 'C:\Documents and Settings\dell\桌面\瑞星.rar'
C:\Documents and Settings\dell\桌面\瑞星.rar
  [0] Archive type: RAR
  --> avwlast.exe
      [DETECTION] Contains code of the Windows virus W32/Virut.W
  --> kulionrx.dll
      [DETECTION] Is the Trojan horse TR/PSW.Steal.31232
  --> logogo.exe
      [DETECTION] Contains code of the Windows virus W32/Virut.W
  --> DbgHlp32.exe
      [DETECTION] Contains code of the Windows virus W32/Virut.W
  --> dat3.tmp
      [DETECTION] Contains suspicious code HEUR/Malware
  --> dat1C.tmp
      [DETECTION] Contains suspicious code HEUR/Malware
  --> ravwdmon.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineG.TF.1
      [INFO]      The file was successfully wiped!
      [INFO]      The file was deleted!

六月的雪

刚换了个温柔女声报警来试下效果呵呵

xzthink

扫描进行于：2007-9-15 1:08:18
扫描日志
NOD32版本 2530 (20070914) NT
命令行： F:\virus test\瑞星.rar
d:\Eset\nod32.exe - 是正常的
系统内存  - 是正常的
1 的MBR区.物理磁盘 - 是正常的
1 的启动引导区.物理磁盘 - 是正常的

日期： 15.9.2007  时间：01:08:25
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：F:\virus test\瑞星.rar
F:\virus test\瑞星.rar >>RAR >>avwlast.exe - 可能是 Win32/Genetik 木马 的一个变种
F:\virus test\瑞星.rar >>RAR >>kulionrx.dll - 是正常的
F:\virus test\瑞星.rar >>RAR >>logogo.exe - 可能是 Win32/Drowor 病毒 的一个变种
F:\virus test\瑞星.rar >>RAR >>DbgHlp32.exe - Win32/PSW.OnLineGames.YA 木马的变种
F:\virus test\瑞星.rar >>RAR >>dat3.tmp >>UPX v12_m2_dll - 是正常的
F:\virus test\瑞星.rar >>RAR >>dat1C.tmp >>UPX v12_m2_dll - 是正常的
F:\virus test\瑞星.rar >>RAR >>ravwdmon.exe - 可能是 Win32/PSW.OnLineGames.NEP 木马 的一个变种
已扫描的文件数目：8
已发现的病毒数目：4
已清除病毒的文件数目：1
完成时间： 01:08:26 总扫描时间：1 秒 (00:00:01)

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\瑞星.rar'
C:\Documents and Settings\Administrator\My Documents\
  瑞星.rar
    [0] Archive type: RAR
    --> avwlast.exe
        [DETECTION] Contains code of the Windows virus W32/Virut.W
        [WARNING]   Infected files in archives cannot be repaired!
    --> kulionrx.dll
        [DETECTION] Is the Trojan horse TR/PSW.Steal.31232
        [WARNING]   Infected files in archives cannot be repaired!
    --> logogo.exe
        [DETECTION] Contains code of the Windows virus W32/Virut.W
        [WARNING]   Infected files in archives cannot be repaired!
    --> DbgHlp32.exe
        [DETECTION] Contains code of the Windows virus W32/Virut.W
        [WARNING]   Infected files in archives cannot be repaired!
    --> dat3.tmp
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> dat1C.tmp
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> ravwdmon.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineG.TF.1
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!


End of the scan: 2007年9月14日  11:42
Used time: 00:03 min

The scan has been done completely.

      0 Scanning directories
      8 Files were scanned
      5 viruses and/or unwanted programs were found
      2 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      1 Archives were scanned
      8 Warnings
      0 Notes

残缺的唯美

Scan performed at: 2007-9-15 6:51:44
Scanning Log
NOD32 version 2530 (20070914) NT
Command line: D:\Documents and Settings\EKINCHENG\桌面\瑞星.rar

Date: 15.9.2007  Time: 06:51:45
Anti-Stealth technology is enabled.
Scanned disks, folders and files: D:\Documents and Settings\EKINCHENG\桌面\瑞星.rar
D:\Documents and Settings\EKINCHENG\桌面\瑞星.rar ?RAR ?avwlast.exe - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\瑞星.rar ?RAR ?logogo.exe - probably a variant of Win32/Drowor virus
D:\Documents and Settings\EKINCHENG\桌面\瑞星.rar ?RAR ?DbgHlp32.exe - a variant of Win32/PSW.OnLineGames.YA trojan
D:\Documents and Settings\EKINCHENG\桌面\瑞星.rar ?RAR ?ravwdmon.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
Number of scanned files: 8
Number of threats found: 4
Number of files cleaned: 1
Time of completion: 06:51:47 Total scanning time: 2 sec (00:00:02)

红心王子

小A 5个

2007-9-15        8:02:21        1189814541        Administrator        3644        Sign of "Win32:Delf-FVM [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\瑞星.rar\avwlast.exe\[Upack]\[Embedded#MUSIC]" file.  
2007-9-15        8:02:24        1189814544        Administrator        3644        Sign of "Win32:Delf-FFM [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\瑞星.rar\kulionrx.dll" file.  
2007-9-15        8:02:24        1189814544        Administrator        3644        Sign of "Win32:Agent-ISZ [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\瑞星.rar\logogo.exe\[Upack]" file.  
2007-9-15        8:02:24        1189814544        Administrator        3644        Sign of "Win32:Onlinegames-BBR [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\瑞星.rar\DbgHlp32.exe\[UPX]\[Embedded#2060]" file.  
2007-9-15        8:02:24        1189814544        Administrator        3644        Sign of "Win32:Onlinegames-AUQ [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\瑞星.rar\ravwdmon.exe\[Upack]\[Embedded#9060]\[Upack]" file.

微点卫士

微点：
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\AVWLAST.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DBGHLP32.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\LOGOGO.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\RAVWDMON.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\NETMEETING\RAVWDMON.EXE
2) C:\PROGRAM FILES\NETMEETING\RAVWDMON.DAT
是否删除木马程序及其衍生物?


消灭能运行的

promised

C:\ABC\瑞星.rar:\avwlast.exe - 特征码 'Trojan-Downloader.Win32.VB.bbi' 被发现
C:\ABC\瑞星.rar:\kulionrx.dll - 特征码 'Trojan-PWS.Win32.Nilage.bga' 被发现
C:\ABC\瑞星.rar:\logogo.exe - 特征码 'Trojan-Downloader.Win32.VB.bbi' 被发现
C:\ABC\瑞星.rar:\DbgHlp32.exe - 特征码 'Trojan-Downloader.Win32.VB.bbi' 被发现
C:\ABC\瑞星.rar:\dat3.tmp - 特征码 'Backdoor.Win32.Agent.aex' 被发现
C:\ABC\瑞星.rar:\dat1C.tmp - 特征码 'Backdoor.Win32.Agent.aex' 被发现
C:\ABC\瑞星.rar:\ravwdmon.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\瑞星.rar

wangjay1980

detected: virus Heur.Invader (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\ÈðÐÇ.rar/avwlast.exe
detected: Trojan program Trojan-PSW.Win32.WOW.wo        File: C:\Documents and Settings\Owner\×ÀÃæ\ÈðÐÇ.rar/kulionrx.dll
detected: virus Heur.Invader (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\ÈðÐÇ.rar/logogo.exe
detected: virus Heur.Invader (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\ÈðÐÇ.rar/DbgHlp32.exe
detected: Trojan program Trojan.Win32.Obfuscated.hw        File: C:\Documents and Settings\Owner\×ÀÃæ\ÈðÐÇ.rar/ravwdmon.exe//PE_Patch//UPack