[MD5: 804A51 DF87F5 5164BC]

promised

promised

C:\ABC\1B9211AA.DLL - 特征码 'Win32.Worm.Winko.I' 被发现
C:\ABC\l6.EXE - 可疑代码段 被发现 (Level: 20)
C:\ABC\rss.dll - 特征码 'Trojan-PWS.Win32.OnLineGames.ccd' 被发现

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.IMMSG.Win32.TBMSG.ygd
病毒： Trojan.Win32.Agent.iex   

MAC地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：19.40.61

wangjay1980

deleted: Trojan program Trojan-Downloader.Win32.Flux.f        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/1B9211AA.DLL
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ccd        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/rss.dll

欠妳緈諨

残缺的唯美

2007-9-16 16:55:03        Scanning Log
2007-9-16 16:55:03        Version of virus signature database: 2532 (20070916)
2007-9-16 16:55:03        Date: 16.9.2007  Time: 16:55:03
2007-9-16 16:55:03        Scanned disks, folders and files: D:\Documents and Settings\EKINCHENG\桌面\样本.rar
2007-9-16 16:55:04        D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » l6.EXE - probably unknown NewHeur_PE virus [7]
2007-9-16 16:55:04        D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » rss.dll - probably a variant of Win32/StartPage trojan
2007-9-16 16:55:04        Number of scanned files: 4
2007-9-16 16:55:04        Number of threats found: 2
2007-9-16 16:55:04        Time of completion: 16:55:04  Total scanning time: 1 sec (00:00:01)
2007-9-16 16:55:04       
2007-9-16 16:55:04        Notes:
2007-9-16 16:55:04        [7] File is probably infected with an unknown virus.

nosferatu

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\��.rar'
C:\Documents and Settings\Administrator\桌面\��.rar
  [0] Archive type: RAR
  --> l6.EXE
      [DETECTION] Is the Trojan horse TR/Agent.ANB.10
  --> rss.dll
      [DETECTION] Is the Trojan horse TR/Starter.AEP
      [INFO]      The file was deleted!


End of the scan: 2007年9月16日  17:23
Used time: 00:11 min

The scan has been done completely.

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Paranoia Database - 5149
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder

C:\Documents and Settings\uhthn\Desktop\New Folder\1B9211AA.DLL - Suspicious of Trojan.Autorun.1
C:\Documents and Settings\uhthn\Desktop\New Folder\l6.EXE - Suspicious of MalwareSpy.Win32.Trojan-Downloader.Delf.1
C:\Documents and Settings\uhthn\Desktop\New Folder\rss.dll - Infected with PDB-a50 Malware program - Deleted

3 Files scanned
1 Infected files found
2 Suspicious files found
0 Files cured
1 Files deleted

king6808

F:\样本1.rar >>RAR >>l6.EXE - 未查明的 NewHeur_PE 病毒 [7]
F:\样本1.rar >>RAR >>rss.dll - 可能是 Win32/StartPage 木马 的一个变种