前面转的东西下的27个

promised

[MD5: 289345 781D83 0A10E2 EA10F4 DC6259 59C0A0 654812 91AE78 471015 3FF5C5 E7456B CA4253 654966 12189E E1EF17 9A6AF8 A8761A 2C39BE C25D4C E16192 5CC1BC 850A3A D2E262 9FE6EF BE2AC8 4252C5 7CA467]

红心王子

2007-9-16        20:46:25        1189946785        Administrator        304        Sign of "Win32:Agent-LLM [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\jopen11.exe\[Upack]" file.  
2007-9-16        20:46:30        1189946790        Administrator        304        Sign of "Win32:Agent-LLL [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\jopen5.exe\[Upack]" file.  
2007-9-16        20:46:30        1189946790        Administrator        304        Sign of "Win32:Onlinegames-BCA [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\jopen4.exe\[Upack]\[Embedded#MUSIC]" file.  
2007-9-16        20:46:30        1189946790        Administrator        304        Sign of "Win32:Delf-FVM [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\avzxast.exe\[Upack]\[Embedded#MUSIC]" file.  
2007-9-16        20:46:30        1189946790        Administrator        304        Sign of "Win32:Delf-FVM [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\avwgbst.exe\[Upack]\[Embedded#MUSIC]" file.  
2007-9-16        20:46:30        1189946790        Administrator        304        Sign of "Win32:Delf-DQP [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\jopenarp.exe\[NsPack]" file.  
2007-9-16        20:46:30        1189946790        Administrator        304        Sign of "Win32:Onlinegames-BBU [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\jopen8.exe\[UPX]\[Embedded#2060]" file.  
2007-9-16        20:46:30        1189946790        Administrator        304        Sign of "Win32:Onlinegames-BCA [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\raqjapi.dll" file.  
2007-9-16        20:46:30        1189946790        Administrator        304        Sign of "Win32:Delf-FVM [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\avwgbmn.dll" file.  
2007-9-16        20:46:30        1189946790        Administrator        304        Sign of "Win32:Delf-FVM [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\avzxamn.dll" file.  
2007-9-16        20:46:30        1189946790        Administrator        304        Sign of "Win32:Onlinegames-BBZ [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\jopen3.exe\[Embedded#1a60]" file.  
2007-9-16        20:46:30        1189946790        Administrator        304        Sign of "Win32:Onlinegames-BBZ [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\jopen3.exe" file.  
2007-9-16        20:46:30        1189946790        Administrator        304        Sign of "Win32:Autorun-BS [Wrm]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\jopen1.exe\[UPX]\[Embedded#05ef8]" file.  
2007-9-16        20:46:31        1189946791        Administrator        304        Sign of "Win32:Autorun-BS [Wrm]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\WinSys64.Sys" file.

promised

C:\ABC\样本\arpkk.vbs - 特征码 'Backdoor.Win32.Agent.abj' 被发现
C:\ABC\样本\avwgbmn.dll - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\样本\avwgbst.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\样本\avzxamn.dll - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\样本\avzxast.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\样本\explorer.exe
C:\ABC\样本\Hosts.exe - 特征码 'Trojan-Spy.Win32.Delf.OR' 被发现
C:\ABC\样本\jopen.exe - 特征码 'Trojan-Downloader.Win32.Agent.blm' 被发现
C:\ABC\样本\jopen1.exe - 特征码 'Virus.Win32.AutoRun.bs' 被发现
C:\ABC\样本\jopen11.exe - 特征码 'Trojan-Spy.Win32.Bancos.ha' 被发现
C:\ABC\样本\jopen3.exe - 特征码 'Trojan-PWS.Win32.OnLineGames.cda' 被发现
C:\ABC\样本\jopen4.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\样本\jopen5.exe - 特征码 'Trojan-Spy.Win32.Bancos.ha' 被发现
C:\ABC\样本\jopen6.exe - 特征码 'Trojan-Spy.Win32.Bancos.ha' 被发现
C:\ABC\样本\jopen7.exe - 特征码 'Trojan-Spy.Win32.Bancos.ha' 被发现
C:\ABC\样本\jopen8.exe - 特征码 'Trojan-PWS.Win32.OnLineGames.wp' 被发现
C:\ABC\样本\jopen9.exe - 特征码 'Trojan-Spy.Win32.Bancos.ha' 被发现
C:\ABC\样本\jopenarp.exe - 特征码 'Trojan-PWS.Win32.Agent.BU' 被发现
C:\ABC\样本\kawdbzy.dll - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\样本\kvdxbma.dll - 特征码 'Trojan-Downloader.Agent.YJA' 被发现
C:\ABC\样本\kvmxcma.dll - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\样本\pcihdd.sys - 特征码 'Trojan-Downloader.Win32.Agent.blm' 被发现
C:\ABC\样本\raqjapi.dll - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\样本\ratbbpi.dll - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\样本\rsmyapm.dll - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\样本\ruixing.exe - 特征码 'Trojan-Downloader.Win32.Banload.bvk' 被发现
C:\ABC\样本\WinSys64.Sys - 特征码 'Trojan-Proxy.Win32.Delf.AN' 被发现

        28 文件被扫描
          (0 压缩档 0 文件)
        26 特征码被侦测
        0 可疑代码段被发现
        耗时: 0:00.328

The EQs

Scan performed at: 2007-9-16 20:53:21
Scanning Log
NOD32 version 2532 (20070916) NT
Command line: C:\Documents and Settings\Don johnson\桌面\样本.rar
Operating memory - is OK
Date: 16.9.2007  Time: 20:53:24
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\样本.rar
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?pcihdd.sys - Win32/TrojanDownloader.Agent.BLM trojan - was a part of the deleted object
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?Hosts.exe - Win32/TrojanDownloader.SMW.A trojan - was a part of the deleted object
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?jopen9.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?jopen11.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?jopen5.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?jopen6.exe - probably a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?jopen4.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?avzxast.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?avwgbst.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?jopen7.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?ratbbpi.dll - a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?kawdbzy.dll - a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?kvdxbma.dll - a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?jopen8.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?kvmxcma.dll - probably a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?explorer.exe - a variant of Win32/Agent.NLW trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?rsmyapm.dll - probably a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?jopen3.exe - probably a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?jopen1.exe - probably a variant of Win32/AutoRun.Q worm
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?WinSys64.Sys - probably a variant of Win32/AutoRun.Q worm
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?jopen.exe - a variant of Win32/Agent.NLW trojan
Number of scanned files: 28
Number of threats found: 21
Number of files cleaned: 1
Time of completion: 20:53:27 Total scanning time: 3 sec (00:00:03)

浪滔天

卡巴 7.0.0.125 高启发
25个

已删除: 木马程序 Trojan-Spy.Win32.Delf.ago 文件: F:\病毒样本\样本\kawdbzy.dll
已删除: 木马程序 Trojan-Spy.Win32.Delf.ago 文件: F:\病毒样本\样本\jopen11.exe//UPack
已删除: 木马程序 Trojan-Spy.Win32.Delf.agk 文件: F:\病毒样本\样本\jopen5.exe//UPack
已删除: 木马程序 Trojan-Spy.Win32.Delf.agk 文件: F:\病毒样本\样本\kvdxbma.dll
已删除: 木马程序 Trojan-Spy.Win32.Delf.afv 文件: F:\病毒样本\样本\avwgbmn.dll
已删除: 木马程序 Trojan-Spy.Win32.Delf.afu 文件: F:\病毒样本\样本\avwgbst.exe//UPack
已删除: 木马程序 Trojan-Spy.Win32.Delf.acg 文件: F:\病毒样本\样本\rsmyapm.dll
已删除: 木马程序 Trojan-Spy.Win32.Delf.acg 文件: F:\病毒样本\样本\jopen7.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.cyj 文件: F:\病毒样本\样本\raqjapi.dll
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.cwe 文件: F:\病毒样本\样本\jopen6.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.cwd 文件: F:\病毒样本\样本\kvmxcma.dll
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.cey 文件: F:\病毒样本\样本\jopen4.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.cdb 文件: F:\病毒样本\样本\ratbbpi.dll
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.cdb 文件: F:\病毒样本\样本\jopen9.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.cda 文件: F:\病毒样本\样本\jopen3.exe
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.caz 文件: F:\病毒样本\样本\jopen8.exe//PE_Patch.UPX//UPX
已删除: 木马程序 Trojan-PSW.Win32.Delf.zn 文件: F:\病毒样本\样本\avzxast.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.Delf.aap 文件: F:\病毒样本\样本\avzxamn.dll
已删除: 木马程序 Trojan-Downloader.Win32.Delf.aas 文件: F:\病毒样本\样本\Hosts.exe//UPX
已删除: 木马程序 Trojan-Downloader.Win32.Agent.blm 文件: F:\病毒样本\样本\pcihdd.sys
已删除: 木马程序 Trojan-Downloader.Win32.Agent.blm 文件: F:\病毒样本\样本\explorer.exe//UPX
已删除: 木马程序 Trojan-Downloader.Win32.Agent.blm 文件: F:\病毒样本\样本\jopen.exe
已删除: 风险软件 not-a-virus:NetTool.Win32.Agent.b 文件: F:\病毒样本\样本\jopenarp.exe
已删除: 病毒 Worm.Win32.QQPass.r 文件: F:\病毒样本\样本\WinSys64.Sys
已删除: 病毒 Worm.Win32.QQPass.r 文件: F:\病毒样本\样本\jopen1.exe//UPX

[ 本帖最后由 浪滔天 于 2007-9-16 21:08 编辑 ]

tracydk

14个

F:\病毒样本\样本.rar\...\[Upack] 感染: Win32:Agent-LLM [Trj] 成功删除文件...
F:\病毒样本\样本.rar\...\[Upack] 感染: Win32:Agent-LLL [Trj] 成功删除文件...
F:\病毒样本\...\[Embedded#MUSIC] 感染: Win32:Onlinegames-BCA [Trj] 成功删除文件...
F:\病毒样本\...\[Embedded#MUSIC] 感染: Win32:Delf-FVM [Trj] 成功删除文件...
F:\病毒样本\...\[Embedded#MUSIC] 感染: Win32:Delf-FVM [Trj] 成功删除文件...
F:\病毒样本\样本.rar\...\[NsPack] 感染: Win32:Delf-DQP [Trj] 成功删除文件...
F:\病毒样本\...\[Embedded#2060] 感染: Win32:Onlinegames-BBU [Trj] 成功删除文件...
F:\病毒样本\样本.rar\raqjapi.dll 感染: Win32:Onlinegames-BCA [Trj] 成功删除文件...
F:\病毒样本\样本.rar\avwgbmn.dll 感染: Win32:Delf-FVM [Trj] 成功删除文件...
F:\病毒样本\样本.rar\avzxamn.dll 感染: Win32:Delf-FVM [Trj] 成功删除文件...
F:\病毒样本\...\[Embedded#1a60] 感染: Win32:Onlinegames-BBZ [Trj] 成功删除文件...
F:\病毒样本\样本.rar\jopen3.exe 感染: Win32:Onlinegames-BBZ [Trj] 删除文件时产生错误: 没有更多文件。
F:\病毒样本\...\[Embedded#05ef8] 感染: Win32:Autorun-BS [Wrm] 成功删除文件...
F:\病毒样本\样本.rar\WinSys64.Sys 感染: Win32:Autorun-BS [Wrm] 成功删除文件...

nosferatu

红伞26

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本.rar'
C:\Documents and Settings\Administrator\桌面\样本.rar
  [0] Archive type: RAR
  --> pcihdd.sys
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.blm.3
  --> arpkk.vbs
      [DETECTION] Contains detection pattern of the VBS script virus VBS/Agent.abj.A
  --> Hosts.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> jopen9.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.cdb
  --> jopen11.exe
      [DETECTION] Is the Trojan horse TR/Spy.Delf.ago
  --> jopen5.exe
      [DETECTION] Is the Trojan horse TR/Spy.Delf.agk
  --> jopen6.exe
      [DETECTION] Is the Trojan horse TR/Agent.12472
  --> jopen4.exe
      [DETECTION] Is the Trojan horse TR/Agent.12910
  --> avzxast.exe
      [DETECTION] Is the Trojan horse TR/Agent.13023
  --> avwgbst.exe
      [DETECTION] Is the Trojan horse TR/Spy.Delf.afu
  --> jopen7.exe
      [DETECTION] Is the Trojan horse TR/Agent.13496
  --> jopenarp.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> ratbbpi.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.cdb.1
  --> kawdbzy.dll
      [DETECTION] Is the Trojan horse TR/Spy.Delf.ago.1
  --> kvdxbma.dll
      [DETECTION] Is the Trojan horse TR/Spy.Delf.agk.1
  --> jopen8.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> kvmxcma.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> explorer.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.blm.3
  --> raqjapi.dll
      [DETECTION] Is the Trojan horse TR/FWDisable.20628
  --> rsmyapm.dll
      [DETECTION] Is the Trojan horse TR/Spy.Delf.acg
  --> avwgbmn.dll
      [DETECTION] Is the Trojan horse TR/Spy.Delf.afv
  --> avzxamn.dll
      [DETECTION] Is the Trojan horse TR/PSW.Delf.aap
  --> jopen3.exe
      [DETECTION] Contains detection pattern of the dropper DR/Cinmus.RJ
  --> jopen1.exe
      [DETECTION] Is the Trojan horse TR/PSW.QQPass.UP.41
  --> WinSys64.Sys
      [DETECTION] Contains detection pattern of the worm WORM/QQPass.R
  --> jopen.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.blm.3
      [INFO]      The file was deleted!


End of the scan: 2007年9月16日  21:13
Used time: 00:38 min

The scan has been done completely.

      0 Scanning directories
     29 Files were scanned
     25 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      4 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Paranoia Database - 5180
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder

C:\Documents and Settings\uhthn\Desktop\New Folder\pcihdd.sys - OK
C:\Documents and Settings\uhthn\Desktop\New Folder\arpkk.vbs - OK
C:\Documents and Settings\uhthn\Desktop\New Folder\Hosts.exe - Suspicious of Win32.Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\New Folder\jopen9.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\jopen11.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\jopen5.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\jopen6.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\jopen4.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\avzxast.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\avwgbst.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\jopen7.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\jopenarp.exe - Suspicious of MalwareSpy.Trojan-Downloader.Delf.1
C:\Documents and Settings\uhthn\Desktop\New Folder\ratbbpi.dll - Suspicious of Win32.Trojan-PSW.OnLineGames.3
C:\Documents and Settings\uhthn\Desktop\New Folder\kawdbzy.dll - Suspicious of Win32.Trojan-PSW.OnLineGames.3
C:\Documents and Settings\uhthn\Desktop\New Folder\kvdxbma.dll - Suspicious of Win32.Trojan-PSW.OnLineGames.3
C:\Documents and Settings\uhthn\Desktop\New Folder\jopen8.exe - Suspicious of Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\New Folder\kvmxcma.dll - Suspicious of Win32.Trojan-PSW.OnLineGames.3
C:\Documents and Settings\uhthn\Desktop\New Folder\explorer.exe - Suspicious of Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\New Folder\raqjapi.dll - Suspicious of Win32.Trojan-PSW.OnLineGames.3
C:\Documents and Settings\uhthn\Desktop\New Folder\rsmyapm.dll - Suspicious of Win32.Trojan-PSW.OnLineGames.3
C:\Documents and Settings\uhthn\Desktop\New Folder\avwgbmn.dll - Suspicious of Win32.Trojan-PSW.OnLineGames.3
C:\Documents and Settings\uhthn\Desktop\New Folder\avzxamn.dll - Suspicious of Win32.Trojan-PSW.OnLineGames.3
C:\Documents and Settings\uhthn\Desktop\New Folder\jopen3.exe - Suspicious of Trojan-PSW.OnLineGames.1
C:\Documents and Settings\uhthn\Desktop\New Folder\jopen1.exe - Suspicious of Win32.Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\New Folder\ruixing.exe - Suspicious of Win32.Backdoor.Hupigon.5
C:\Documents and Settings\uhthn\Desktop\New Folder\WinSys64.Sys - Suspicious of Win32.Trojan-PSW.QQPass.1
C:\Documents and Settings\uhthn\Desktop\New Folder\jopen.exe - Suspicious of Trojan-Downloader.VB.1

27 Files scanned
0 Infected files found
25 Suspicious files found
0 Files cured
0 Files deleted

chenrui19930

bitdefender 24个

tracydk

25个