2007-09-15 微风求助帖看到的

Tenki

2007-09-15 微风求助帖看到的
http://61.152.169.194/vip.exe
http://read.xwdl.com/files/article/html/0/8/537119.html
http://read.xwdl.com/files/article/html/0/8/537119.html
http://gua.ns2go.com/dir/index_pic/pp.htm
http://www.book-online.com.cn/
http://read.xwdl.com/files/article/html/0/8/946618.html
http://205.209.155.139/Images/Hide/5.exe
http://205.209.155.139/Images/Hide/6.exe
http://205.209.155.139/Images/Hide/7.exe
http://205.209.155.139/Images/Hide/8.exe
http://205.209.155.139/Images/Hide/10.exe
http://205.209.155.139/Images/Hide/11.exe
http://205.209.155.139/Images/Hide/12.exe
http://205.209.155.139/Images/Hide/15.exe
http://205.209.155.139/Images/Hide/16.exe
http://205.209.155.139/Images/Hide/M1.exe
http://m2126.com/web/exe/data/a11/1.jpg
http://gua.ns2go.com/dir/index_pic/title.jpg
http://gua.ns2go.com/dir/index_pic/body.jpg

还有一些我不会抓
原帖在
http://bbs.wefong.com/viewthread.php?tid=1626583 extra=page%3D1

特别是
http://61.152.169.194/vip.exe
http://m2126.com/web/exe/data/a11/1.jpg
http://gua.ns2go.com/dir/index_pic/title.jpg
http://gua.ns2go.com/dir/index_pic/body.jpg
这几个
都抓不下来
开title和body时
防火墙会警告

Tenki

外加一个 http://gua.ns2go.com/dir/index_pic/1.js

mofunzone

只要exe，抓到16个

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\TDDOWNLOAD.rar'
C:\Documents and Settings\Administrator\My Documents\
  TDDOWNLOAD.rar
    [0] Archive type: RAR
    --> 16.exe
        [DETECTION] Is the Trojan horse TR/Spy.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 1.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> 2.exe
        [DETECTION] Is the Trojan horse TR/Spy.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 3.exe
        [DETECTION] Is the Trojan horse TR/Spy.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 5.exe
        [DETECTION] Is the Trojan horse TR/Spy.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 6.exe
        [DETECTION] Is the Trojan horse TR/Spy.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 7.exe
        [DETECTION] Is the Trojan horse TR/Spy.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 8.exe
        [DETECTION] Is the Trojan horse TR/Spy.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 9.exe
        [DETECTION] Is the Trojan horse TR/Spy.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 10.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.aci.92
        [WARNING]   Infected files in archives cannot be repaired!
    --> 11.exe
        [DETECTION] Is the Trojan horse TR/Spy.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 12.exe
        [DETECTION] Is the Trojan horse TR/Spy.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 13.exe
        [DETECTION] Is the Trojan horse TR/Spy.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 14.exe
        [DETECTION] Is the Trojan horse TR/PSW.10188
        [WARNING]   Infected files in archives cannot be repaired!
    --> 15.exe
        [DETECTION] Is the Trojan horse TR/Spy.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> M1.exe
        [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.11887 Backdoor server programs
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!


End of the scan: 2007年9月14日  12:01
Used time: 00:04 min

The scan has been done completely.

      0 Scanning directories
     17 Files were scanned
     15 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      1 Archives were scanned
     17 Warnings
      0 Notes

残缺的唯美

Scan performed at: 2007-9-15 6:51:02
Scanning Log
NOD32 version 2530 (20070914) NT
Command line: D:\Documents and Settings\EKINCHENG\桌面\TDDOWNLOAD.exe

Date: 15.9.2007  Time: 06:51:03
Anti-Stealth technology is enabled.
Scanned disks, folders and files: D:\Documents and Settings\EKINCHENG\桌面\TDDOWNLOAD.exe
D:\Documents and Settings\EKINCHENG\桌面\TDDOWNLOAD.exe ?RAR ?16.exe - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\TDDOWNLOAD.exe ?RAR ?1.exe - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\TDDOWNLOAD.exe ?RAR ?2.exe - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\TDDOWNLOAD.exe ?RAR ?3.exe - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\TDDOWNLOAD.exe ?RAR ?5.exe - probably a variant of Win32/PSW.OnLineGames.NDV trojan
D:\Documents and Settings\EKINCHENG\桌面\TDDOWNLOAD.exe ?RAR ?6.exe - probably a variant of Win32/PSW.OnLineGames.NDV trojan
D:\Documents and Settings\EKINCHENG\桌面\TDDOWNLOAD.exe ?RAR ?7.exe - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\TDDOWNLOAD.exe ?RAR ?8.exe - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\TDDOWNLOAD.exe ?RAR ?9.exe - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\TDDOWNLOAD.exe ?RAR ?10.exe - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\TDDOWNLOAD.exe ?RAR ?11.exe - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\TDDOWNLOAD.exe ?RAR ?12.exe - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\TDDOWNLOAD.exe ?RAR ?13.exe - probably a variant of Win32/PSW.OnLineGames.NDV trojan
D:\Documents and Settings\EKINCHENG\桌面\TDDOWNLOAD.exe ?RAR ?14.exe - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\TDDOWNLOAD.exe ?RAR ?15.exe - probably unknown NewHeur_PE virus [7]
D:\Documents and Settings\EKINCHENG\桌面\TDDOWNLOAD.exe ?RAR ?M1.exe - a variant of Win32/PSW.OnLineGames.NBR trojan
Number of scanned files: 17
Number of threats found: 16
Number of files cleaned: 1
Time of completion: 06:51:06 Total scanning time: 3 sec (00:00:03)

Notes:
[7] File is probably infected with an unknown virus.

红心王子

2007-9-15        8:04:18        1189814658        Administrator        3512        Sign of "Win32:Onlinegames-ARG [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar\1.exe\[Upack]\[Embedded#2070]" file.  
2007-9-15        8:04:21        1189814661        Administrator        3512        Sign of "Win32:Agent-KGX [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar\2.exe\[Upack]\[Embedded#2070]" file.  
2007-9-15        8:04:21        1189814661        Administrator        3512        Sign of "Win32:Agent-KIB [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar\3.exe\[Upack]\[Embedded#3070]" file.  
2007-9-15        8:04:21        1189814661        Administrator        3512        Sign of "Win32:OnLineGames-FN [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar\5.exe\[Upack]\[Embedded#2070]" file.  
2007-9-15        8:04:21        1189814661        Administrator        3512        Sign of "Win32:Onlinegames-ALM [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar\6.exe\[Upack]\[Embedded#2070]" file.  
2007-9-15        8:04:21        1189814661        Administrator        3512        Sign of "Win32:Agent-INA [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar\7.exe\[Upack]\[Embedded#2070]" file.  
2007-9-15        8:04:21        1189814661        Administrator        3512        Sign of "Win32:Agent-KGW [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar\8.exe\[Upack]\[Embedded#2070]" file.  
2007-9-15        8:04:21        1189814661        Administrator        3512        Sign of "Win32:Onlinegames-ARI [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar\10.exe\[Upack]\[Embedded#2070]" file.  
2007-9-15        8:04:21        1189814661        Administrator        3512        Sign of "Win32:Onlinegames-ALL [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar\12.exe\[Upack]\[Embedded#2070]" file.  
2007-9-15        8:04:21        1189814661        Administrator        3512        Sign of "Win32:Autorun-U" has been found in "C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar\M1.exe\[Upack]\[Embedded#DATAINFO]\[Upack]" file.

chenrui19930

扫描路径        : C:\Documents and Settings\我的电脑\桌面\virus.rar
文件夹        : 0
文件        :  77
内存扫描        : 0
文档        : 1
压缩文件        : 0
确认病毒        : 58
染毒文件        : 73
内存感染        : 0
可疑文件        : 1
警告        : 0
杀毒文件        : 0
删除文件        : 74
移动文件        : 0
I/O 错误        : 0
扫描时间        : 00:00:49
扫描速度 (文件/秒)        : 1

FBAV

MicroVita AntiSpyware 100 C
_____________________________________________
                                          
             风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]                  
                   http://221.10.254.214/
----------------------------------------------
开始扫描……


正在检查启动……
[C:\Documents and Settings\Administrator\桌面\virus\TDDOWNLOAD\16.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\TDDOWNLOAD\1.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\TDDOWNLOAD\2.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\TDDOWNLOAD\3.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\TDDOWNLOAD\5.exe]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\TDDOWNLOAD\5.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\TDDOWNLOAD\6.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\TDDOWNLOAD\7.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\TDDOWNLOAD\8.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\TDDOWNLOAD\9.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\TDDOWNLOAD\10.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\TDDOWNLOAD\11.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\TDDOWNLOAD\12.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\TDDOWNLOAD\13.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\TDDOWNLOAD\14.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\TDDOWNLOAD\15.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\TDDOWNLOAD\M1.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
文件数:16   病毒数:16 比重:1
OK  扫描完毕！

a256886572008

還有

http://gua.ns2go.com/dir/index_pic/dir.exe

微点卫士

微点：
木马名称:Trojan-PSW.Win32.OnLineGames.iev

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\G5IV8XAB\5[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.kxq

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\O1E34H6J\6[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.fg

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\JQHUY934\7[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.fg

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\7.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.kij

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\JQHUY934\8[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.jmy

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\G9QZ85QN\10[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\11.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\WDDOOR0.DLL
是否删除木马程序及其衍生物?
木马名称:Trojan-PSW.Win32.OnLineGames.kgx

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\O1E34H6J\12[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.jyq

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\JQHUY934\15[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\16.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\CQDOOR0.DLL
是否删除木马程序及其衍生物?
木马名称:Trojan-PSW.Win32.OnLineGames.kob

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\O1E34H6J\M1[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Downloader.Win32.Agent.jtx

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\G9QZ85QN\DIR[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Downloader.Win32.Agent.jtx

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DIR.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

promised

C:\ABC\TDDOWNLOAD\1.exe - 特征码 'Generic.PWS.Games.1' 被发现
C:\ABC\TDDOWNLOAD\10.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\TDDOWNLOAD\11.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\TDDOWNLOAD\12.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\TDDOWNLOAD\13.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\TDDOWNLOAD\14.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\TDDOWNLOAD\15.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\TDDOWNLOAD\16.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\TDDOWNLOAD\2.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\TDDOWNLOAD\3.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\TDDOWNLOAD\5.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\TDDOWNLOAD\6.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\TDDOWNLOAD\7.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\TDDOWNLOAD\8.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\TDDOWNLOAD\9.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\TDDOWNLOAD\M1.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现

        16 文件被扫描
          (0 压缩档 0 文件)
        16 特征码被侦测
        0 可疑代码段被发现
        耗时: 0:00.094