再发一包病毒样本

gzg

大家扫扫看

平淡

绅博周幸

Starting the file scan:

Begin scan in 'D:\н¨Îļþ¼Ð[1].rar'
D:\н¨Îļþ¼Ð[1].rar
  [0] Archive type: RAR
  --> DA«"IŽ¬_¬D[1]\1.EXE
      [DETECTION] Is the Trojan horse TR/PSW.19610
  --> DA«"IŽ¬_¬D[1]\AVZXAMN.DLL.0DEL.VIR
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.cew.3
  --> DA«"IŽ¬_¬D[1]\AVZXAST.EXE
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.cew.1
  --> DA«"IŽ¬_¬D[1]\GH0ST.EXE
      [DETECTION] Is the Trojan horse TR/Proxy.Delf.CA
  --> DA«"IŽ¬_¬D[1]\KVDXBMA.DLL.0DEL.VIR
      [DETECTION] Is the Trojan horse TR/Spy.Delf.agk.1
  --> DA«"IŽ¬_¬D[1]\KVMXCMA.DLL.0DEL.VIR
      [DETECTION] Is the Trojan horse TR/Hijack.12462.A
  --> DA«"IŽ¬_¬D[1]\LOGO1_.EXE
      [DETECTION] Contains detection pattern of the worm WORM/Viking.DLL.2
  --> DA«"IŽ¬_¬D[1]\LYLOADER.EXE
      [DETECTION] Is the Trojan horse TR/PSW.5907
  --> DA«"IŽ¬_¬D[1]\LYLOADMR.EXE
      [DETECTION] Is the Trojan horse TR/PSW.OnLine.agb.2
  --> DA«"IŽ¬_¬D[1]\RAQJAPI.DLL.0DEL.VIR
      [DETECTION] Is the Trojan horse TR/FWDisable.20628
  --> DA«"IŽ¬_¬D[1]\RATBBPI.DLL.0DEL.VIR
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.cdb.1
  --> DA«"IŽ¬_¬D[1]\RICHDLL.DLL
      [DETECTION] Contains detection pattern of the worm WORM/Viking.DLL.2
  --> DA«"IŽ¬_¬D[1]\RUNDL132.EXE
      [DETECTION] Contains detection pattern of the worm WORM/Viking.DLL.2
  --> DA«"IŽ¬_¬D[1]\SHQ.DLL
      [DETECTION] Is the Trojan horse TR/PSW.OnLine.agb.2
  --> DA«"IŽ¬_¬D[1]\SHQMANGR.DLL
      [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
  --> DA«"IŽ¬_¬D[1]\UNINSTALL\RUNDL132.EXE
      [DETECTION] Contains detection pattern of the worm WORM/Viking.DLL.2
  --> DA«"IŽ¬_¬D[1]\UNINSTLL\RUNDL132.EXE
      [DETECTION] Contains detection pattern of the worm WORM/Viking.DLL.2
  --> DA«"IŽ¬_¬D[1]\WINDOWS\LOGO1_.EXE
      [DETECTION] Contains detection pattern of the worm WORM/Viking.DLL.2
      [WARNING]   The file was ignored!


End of the scan: 2007年9月15日  01:29
Used time: 00:12 min

The scan has been done completely.

      0 Scanning directories
     26 Files were scanned
     18 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      8 Files not concerned
      1 Archives were scanned
      1 Warnings
      0 Notes

红心王子

2007-9-15        16:49:12        1189846152        Administrator        2844        Sign of "Win32:Viking-BD [Wrm]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹.part1.rar\UNINSTALL\RUNDL132.EXE\[Embedded#DLL1]\[Petite]" file.  
2007-9-15        16:49:18        1189846158        Administrator        2844        Sign of "Win32:Lineage-377 [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹.part1.rar\UNINSTALL\RUNDL132.EXE" file.  
2007-9-15        16:49:18        1189846158        Administrator        2844        Sign of "Win32:Agent-ITS [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹.part1.rar\GH0ST.EXE" file.  
2007-9-15        16:49:18        1189846158        Administrator        2844        Sign of "Win32:OnLineGames-ST [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹.part1.rar\LYLOADER.EXE\[Upack]\[Embedded#5158]\[Upack]" file.  
2007-9-15        16:49:18        1189846158        Administrator        2844        Sign of "Win32:OnLineGames-TM [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹.part1.rar\SHQ.DLL" file.  
2007-9-15        16:49:18        1189846158        Administrator        2844        Sign of "Win32:Onlinegames-AUY [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹.part1.rar\SHQMANGR.DLL\[Upack]" file.  
2007-9-15        16:49:18        1189846158        Administrator        2844        Sign of "Win32:Onlinegames-AUY [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹.part1.rar\LYLOADMR.EXE\[Upack]\[Embedded#4150]\[Upack]" file.  
2007-9-15        16:49:18        1189846158        Administrator        2844        Sign of "Win32:Viking-BD [Wrm]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹.part1.rar\UNINSTLL\RUNDL132.EXE\[Embedded#DLL1]\[Petite]" file.  
2007-9-15        16:49:18        1189846158        Administrator        2844        Sign of "Win32:Lineage-377 [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹.part1.rar\UNINSTLL\RUNDL132.EXE" file.  
2007-9-15        16:49:18        1189846158        Administrator        2844        Sign of "Win32:Viking-BD [Wrm]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹.part1.rar\RICHDLL.DLL\[Petite]" file.  
2007-9-15        16:49:18        1189846158        Administrator        2844        Sign of "Win32:Viking-BD [Wrm]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹.part1.rar\WINDOWS\LOGO1_.EXE\[Embedded#DLL1]\[Petite]" file.  
2007-9-15        16:49:18        1189846158        Administrator        2844        Sign of "Win32:Lineage-377 [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹.part1.rar\WINDOWS\LOGO1_.EXE" file.  
2007-9-15        16:49:19        1189846159        Administrator        2844        Sign of "Win32:Viking-BD [Wrm]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹.part2.rar\RUNDL132.EXE\[Embedded#DLL1]\[Petite]" file.  
2007-9-15        16:49:19        1189846159        Administrator        2844        Sign of "Win32:Lineage-377 [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹.part2.rar\RUNDL132.EXE" file.  
2007-9-15        16:49:19        1189846159        Administrator        2844        Sign of "Win32:Viking-BD [Wrm]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹.part2.rar\LOGO1_.EXE\[Embedded#DLL1]\[Petite]" file.  
2007-9-15        16:49:19        1189846159        Administrator        2844        Sign of "Win32:Lineage-377 [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹.part2.rar\LOGO1_.EXE" file.  
2007-9-15        16:49:19        1189846159        Administrator        2844        Sign of "Win32:Delf-FVM [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹.part3.rar\AVZXAMN.DLL.0DEL.VIR" file.  
2007-9-15        16:49:19        1189846159        Administrator        2844        Sign of "Win32:Delf-FVM [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹.part3.rar\AVZXAST.EXE\[Upack]\[Embedded#MUSIC]" file.  
2007-9-15        16:49:19        1189846159        Administrator        2844        Sign of "Win32:Onlinegames-BCA [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹.part3.rar\RAQJAPI.DLL.0DEL.VIR" file.

浪滔天

卡巴 7.0.0.125
15个

已删除: 病毒 Worm.Win32.Fujack.ao        文件: F:\病毒样本\新建文件夹[1]\GH0ST.EXE
已删除: 病毒 Worm.Win32.Viking.mc        文件: F:\病毒样本\新建文件夹[1]\WINDOWS\LOGO1_.EXE//PE_Patch
已删除: 病毒 Worm.Win32.Viking.mc        文件: F:\病毒样本\新建文件夹[1]\UNINSTLL\RUNDL132.EXE//PE_Patch
已删除: 病毒 Worm.Win32.Viking.mc        文件: F:\病毒样本\新建文件夹[1]\RUNDL132.EXE//PE_Patch
已删除: 病毒 Worm.Win32.Viking.mc        文件: F:\病毒样本\新建文件夹[1]\RICHDLL.DLL//Petite
已删除: 病毒 Worm.Win32.Viking.mc        文件: F:\病毒样本\新建文件夹[1]\LOGO1_.EXE//PE_Patch
已删除: 病毒 Worm.Win32.Viking.mc        文件: F:\病毒样本\新建文件夹[1]\UNINSTALL\RUNDL132.EXE//PE_Patch
已删除: 木马程序 Trojan-Dropper.Win32.Agent.bvh        文件: F:\病毒样本\新建文件夹[1]\LYLOADMR.EXE//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.cdb        文件: F:\病毒样本\新建文件夹[1]\RATBBPI.DLL.0DEL.VIR
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.cew        文件: F:\病毒样本\新建文件夹[1]\AVZXAMN.DLL.0DEL.VIR
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.cew        文件: F:\病毒样本\新建文件夹[1]\AVZXAST.EXE//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.cnz        文件: F:\病毒样本\新建文件夹[1]\KVMXCMA.DLL.0DEL.VIR
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.cvz        文件: F:\病毒样本\新建文件夹[1]\LYLOADER.EXE//PE_Patch//UPack
已删除: 木马程序 Trojan-Spy.Win32.Delf.agk        文件: F:\病毒样本\新建文件夹[1]\KVDXBMA.DLL.0DEL.VIR
已删除: 木马程序 Trojan.Win32.Agent.bkw        文件: F:\病毒样本\新建文件夹[1]\1.EXE//UPack

欠妳緈諨

AVAST14个

IllusionWing

UGuard Log (Digital Fox - gankeyu@126.com)
UGuarduu.exe = 3.7.5
HC0.rlb = 2.8.9
HC2.rlb = 2.4.0
FN0.rlb = 2.3.1
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\1.EXE
[扫描] [Level 1] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\1.EXE 检测到 Generic.Virus
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\AUTORUN.INF
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\AUTORUN.INF 检测到 Win32.AutorunU
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\AVWLAIN.DLL
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\AVWLAIN.DLL 检测到 Trojan.Delf.uv
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\AVZXAMN.DLL.0DEL.VIR
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\AVZXAMN.DLL.0DEL.VIR 检测到
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\AVZXAST.EXE
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\AVZXAST.EXE 检测到 Generic.Upack -> Dwing
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\DD2.EXE
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\GH0ST.EXE
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\GH0ST.EXE 检测到
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\KAPJACS.DLL
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\KAPJACS.DLL 检测到 Backdoor.Unknown.SettingFile
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\KVDXACF.DLL
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\KVDXACF.DLL 检测到 Backdoor.Unknown.SettingFile
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\KVDXBMA.DLL.0DEL.VIR
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\KVDXBMA.DLL.0DEL.VIR 检测到
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\KVMXCMA.DLL.0DEL.VIR
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\KVMXCMA.DLL.0DEL.VIR 检测到
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\LOGO1_.EXE
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\LOGO1_.EXE//Stream_01
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\LOGO1_.EXE//Stream_01 检测到 Worm.Viking.ma
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\LOGO1_.EXE//Stream_02
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\LOGO1_.EXE//Stream_02 检测到 Worm.Viking.vc
[扫描] [捆绑检测] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\LOGO1_.EXE 检测到 Generic.Binder
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\LYLOADER.EXE
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\LYLOADER.EXE 检测到 Generic.Upack -> Dwing
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\LYLOADMR.EXE
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\LYLOADMR.EXE 检测到 Generic.Upack -> Dwing
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\RACVSVC.EXE
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\RAQJAPI.DLL.0DEL.VIR
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\RAQJAPI.DLL.0DEL.VIR 检测到
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\RATBBPI.DLL.0DEL.VIR
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\RATBBPI.DLL.0DEL.VIR 检测到 Trojan.Delf.uw
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\RICHDLL.DLL
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\RUNDL132.EXE
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\RUNDL132.EXE//Stream_01
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\RUNDL132.EXE//Stream_01 检测到 Worm.Viking.ma
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\RUNDL132.EXE//Stream_02
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\RUNDL132.EXE//Stream_02 检测到 Worm.Viking.vc
[扫描] [捆绑检测] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\RUNDL132.EXE 检测到 Generic.Binder
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\SHQ.DLL
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\SHQMANGR.DLL
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\SHQMANGR.DLL 检测到 Generic.Upack -> Dwing
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\SRDSHOW.EXE
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\UNINSTALL\RUNDL132.EXE
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\UNINSTALL\RUNDL132.EXE//Stream_01
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\UNINSTALL\RUNDL132.EXE//Stream_01 检测到 Worm.Viking.ma
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\UNINSTALL\RUNDL132.EXE//Stream_02
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\UNINSTALL\RUNDL132.EXE//Stream_02 检测到 Worm.Viking.vc
[扫描] [捆绑检测] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\UNINSTALL\RUNDL132.EXE 检测到 Generic.Binder
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\UNINSTLL\RUNDL132.EXE
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\UNINSTLL\RUNDL132.EXE//Stream_01
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\UNINSTLL\RUNDL132.EXE//Stream_01 检测到 Worm.Viking.ma
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\UNINSTLL\RUNDL132.EXE//Stream_02
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\UNINSTLL\RUNDL132.EXE//Stream_02 检测到 Worm.Viking.vc
[扫描] [捆绑检测] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\UNINSTLL\RUNDL132.EXE 检测到 Generic.Binder
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\WINDOWS\LOGO1_.EXE
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\WINDOWS\LOGO1_.EXE//Stream_01
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\WINDOWS\LOGO1_.EXE//Stream_01 检测到 Worm.Viking.ma
[扫描] 开始 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\WINDOWS\LOGO1_.EXE//Stream_02
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\WINDOWS\LOGO1_.EXE//Stream_02 检测到 Worm.Viking.vc
[扫描] [捆绑检测] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\WINDOWS\LOGO1_.EXE 检测到 Generic.Binder
检测到了 12 个未知的恶意程序，请上报。
任务 扫描 完成。共耗费的时间：0-00-00 00:00:01:0642，共扫描的文件数量：35，共扫描到的威胁数量：30，威胁率：0.85714286
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\1.EXE
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\AUTORUN.INF
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\AVWLAIN.DLL
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\AVZXAMN.DLL.0DEL.VIR
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\AVZXAST.EXE
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\GH0ST.EXE
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\KAPJACS.DLL
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\KVDXACF.DLL
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\KVDXBMA.DLL.0DEL.VIR
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\KVMXCMA.DLL.0DEL.VIR
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\LOGO1_.EXE
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\LOGO1_.EXE
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\LOGO1_.EXE
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\LYLOADER.EXE
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\LYLOADMR.EXE
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\RAQJAPI.DLL.0DEL.VIR
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\RATBBPI.DLL.0DEL.VIR
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\RUNDL132.EXE
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\RUNDL132.EXE
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\RUNDL132.EXE
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\SHQMANGR.DLL
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\UNINSTALL\RUNDL132.EXE
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\UNINSTALL\RUNDL132.EXE
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\UNINSTALL\RUNDL132.EXE
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\UNINSTLL\RUNDL132.EXE
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\UNINSTLL\RUNDL132.EXE
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\UNINSTLL\RUNDL132.EXE
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\WINDOWS\LOGO1_.EXE
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\WINDOWS\LOGO1_.EXE
[处理] 正在处理 C:\Documents and Settings\Administrator\桌面\新建文件夹 (3)\新建文件夹[1]\WINDOWS\LOGO1_.EXE

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Paranoia Database - 4962
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder

C:\Documents and Settings\uhthn\Desktop\New Folder\AUTORUN.INF - OK
C:\Documents and Settings\uhthn\Desktop\New Folder\GH0ST.EXE - Suspicious file
C:\Documents and Settings\uhthn\Desktop\New Folder\DD2.EXE - Suspicious of Trojan-Downloader.VB.1
C:\Documents and Settings\uhthn\Desktop\New Folder\LYLOADER.EXE - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder\SHQ.DLL - Suspicious of Trojan-Downloader.VB.1
C:\Documents and Settings\uhthn\Desktop\New Folder\SHQMANGR.DLL - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\LYLOADMR.EXE - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder\RICHDLL.DLL - Infected with Win32.PDB-c75 Malware program - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\SRDSHOW.EXE - Suspicious of Win32.Worm.Viking.2
C:\Documents and Settings\uhthn\Desktop\New Folder\KAPJACS.DLL - Suspicious of Trojan-Spy.Delf.2
C:\Documents and Settings\uhthn\Desktop\New Folder\AVWLAIN.DLL - Suspicious of Trojan-Spy.Delf.2
C:\Documents and Settings\uhthn\Desktop\New Folder\KVDXACF.DLL - Suspicious of Trojan-Spy.Delf.2
C:\Documents and Settings\uhthn\Desktop\New Folder\1.EXE - Infected with PDB-e2a Malware program - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\AVZXAMN.DLL.0DEL.VIR - Suspicious of Win32.Trojan-PSW.OnLineGames.3
C:\Documents and Settings\uhthn\Desktop\New Folder\AVZXAST.EXE - Infected with PDB-aa5 Malware program - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\KVDXBMA.DLL.0DEL.VIR - Suspicious of Win32.Trojan-PSW.OnLineGames.3
C:\Documents and Settings\uhthn\Desktop\New Folder\KVMXCMA.DLL.0DEL.VIR - Suspicious of Win32.Trojan-PSW.OnLineGames.3
C:\Documents and Settings\uhthn\Desktop\New Folder\RACVSVC.EXE - Suspicious of Trojan-PSW.Game.27
C:\Documents and Settings\uhthn\Desktop\New Folder\RAQJAPI.DLL.0DEL.VIR - Suspicious of Win32.Trojan-PSW.OnLineGames.3
C:\Documents and Settings\uhthn\Desktop\New Folder\RATBBPI.DLL.0DEL.VIR - Suspicious of Win32.Trojan-PSW.OnLineGames.3
C:\Documents and Settings\uhthn\Desktop\New Folder\UNINSTALL\RUNDL132.EXE - Suspicious of Win32.Worm.Viking.2
C:\Documents and Settings\uhthn\Desktop\New Folder\UNINSTLL\RUNDL132.EXE - Suspicious of Win32.Worm.Viking.2
C:\Documents and Settings\uhthn\Desktop\New Folder\WINDOWS\LOGO1_.EXE - Suspicious of Win32.Worm.Viking.2

23 Files scanned
3 Infected files found
19 Suspicious files found
0 Files cured
3 Files deleted

woai_jolin

扫描报告
2007年9月16日 9:42:51 - 9:42:52
计算机名称: C3EF58622174424
扫描类型: 扫描目标
目标: G:\v


--------------------------------------------------------------------------------

结果: 找到 11 恶意软件
Trojan.Win32.Agent.bkw (病毒)
G:\v\1.EXE 操作: 删除
Trojan-PSW.Win32.OnLineGames.cew (病毒)
G:\v\AVZXAST.EXE 操作: 删除
Worm.Win32.Fujack.ao (病毒)
G:\v\GH0ST.EXE 操作: 删除
Worm.Win32.Viking.mc (病毒)
G:\v\LOGO1_.EXE 操作: 删除
G:\v\RICHDLL.DLL 操作: 删除
G:\v\RUNDL132.EXE 操作: 删除
G:\v\WINDOWS\LOGO1_.EXE 操作: 删除
G:\v\UNINSTLL\RUNDL132.EXE 操作: 删除
G:\v\UNINSTALL\RUNDL132.EXE 操作: 删除
Trojan-PSW.Win32.OnLineGames.cvz (病毒)
G:\v\LYLOADER.EXE 操作: 删除
Trojan-Dropper.Win32.Agent.bvh (病毒)
G:\v\LYLOADMR.EXE 操作: 删除




--------------------------------------------------------------------------------

统计信息
已扫描:
文件: 20
未扫描: 0
结果:
病毒: 11
间谍软件: 0
可疑项目: 0
危险软件: 0
操作:
已杀毒: 0
已重命名: 0
删除: 11
已隔离: 0
失败: 0
启动扇区:
已扫描: 0
受感染: 0
可疑项目: 0
已杀毒: 0


--------------------------------------------------------------------------------

选项
定义版本:
病毒: 2007-09-15_01
间谍软件: 2007-09-15_01
扫描引擎:
F-Secure AVP: 7.00.171, 2007-09-15
F-Secure Libra: 2.04.01, 2007-09-14
F-Secure Orion: 1.02.37, 2007-09-15
F-Secure Draco: 1.00.35, 2007-09-03
扫描选项:
扫描定义的文件: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ANI AVB BAT CEO CMD LSP MAP MHT MIF PHP POT WMF NWS TAR TGZ ZIP JAR ARJ LZH TAR TGZ GZ CAB RAR BZ2 HQX
扫描内部存档
操作:
病毒: 扫描后询问
间谍软件: 扫描后询问

chenrui19930

BIT 13个