7个驱动[MD5: 2162DA C625FF BF297F E28124 BA6740 EBF1F1 BD674A]

promised

1

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： RootKit.Agent.zk         
病毒： RootKit.Win32.Agent.ngw  
病毒： RootKit.Win32.Agent.fn   

MAC地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：19.41.12

nosferatu

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\��.rar'
C:\Documents and Settings\Administrator\桌面\��.rar
  [0] Archive type: RAR
  --> jshelp.drv
      [DETECTION] Contains suspicious code HEUR/Malware
  --> jsshow.drv
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 64302l.sys
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> kqtohw21.sys
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/NewWeb.M.19
  --> q8ciw3ee.sys
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> acpidisk.sys
      [DETECTION] Contains detection pattern of the rootkit RKIT/Cinmus.M
  --> gaiabu08.sys
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [INFO]      The file was deleted!


End of the scan: 2007年9月18日  20:35
Used time: 00:17 min

The scan has been done completely.

scottxzt

Begin scan in 'C:\Documents and Settings\dell\桌面\样本.rar'
C:\Documents and Settings\dell\桌面\样本.rar
  [0] Archive type: RAR
  --> jshelp.drv
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 64302l.sys
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> kqtohw21.sys
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/NewWeb.M.19
  --> q8ciw3ee.sys
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> acpidisk.sys
      [DETECTION] Contains detection pattern of the rootkit RKIT/Cinmus.M
  --> gaiabu08.sys
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [INFO]      The file was successfully wiped!
      [INFO]      The file was deleted!


End of the scan: 2007年9月18日  20:36
Used time: 00:15 min

The scan has been done completely.

      0 Scanning directories
      8 Files were scanned
      5 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:

kp2006

avast!有2个没报

kp2006

avast!不报文件

64302l.sys q8ciw3ee.sys

残缺的唯美

D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » q8ciw3ee.sys - a variant of Win32/Rootkit.Agent.NCK trojan
D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » kqtohw21.sys - Win32/Adware.NewWeb application
D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » 64302l.sys - a variant of Win32/Rootkit.Agent.NBQ trojan
D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » jsshow.drv - a variant of Win32/Adware.MoKeAD application
D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » jshelp.drv - a variant of Win32/Adware.MoKeAD application
D:\Documents and Settings\EKINCHENG\桌面\样本.rar - multiple threats - deleted - quarantined
D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » gaiabu08.sys - Win32/Adware.NewWeb application
D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » acpidisk.sys - a variant of Win32/Adware.Cinmus application

wangjay1980

detected: Trojan program Trojan-Downloader.Win32.Hmir.e        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾4.rar/64302l.sys
detected: adware not-a-virus:AdWare.Win32.NewWeb.m        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾4.rar/kqtohw21.sys
detected: Trojan program Trojan-Downloader.Win32.Hmir.e        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾4.rar/q8ciw3ee.sys
detected: adware not-a-virus:AdWare.Win32.Cinmus.jq        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾4.rar/acpidisk.sys
detected: adware not-a-virus:AdWare.Win32.Agent.bz        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾4.rar/gaiabu08.sys

qqq000@qq.com

----------
              [凝逸反毒] (http://hi.baidu.com/503165656)

       [凝逸.扫描病毒引擎-日志]       2007.9.18 21:36:13

文件:F:\070918\样本\kqtohw21.sys | 感染:Adware.Newweb [5490>20070726_dw0001.axx]3(1.1)
操作:删除文件
文件:F:\070918\样本\acpidisk.sys | 感染:virus [542>20070910_ny0015.axx]3(1.1)
操作:删除文件
文件:F:\070918\样本\gaiabu08.sys | 感染:Adware.Baidu [6996>20070726_dw0001.axx]3(1.1)
操作:删除文件

扫描完成|病毒:3 文件:7|耗时:3635
----------

motnahp

反病毒专家 AntiVirusKit 2006 扫描病毒日志记录
版本 16.0.7
双引擎反病毒签名 2007-9-18
开始时间: 2007-9-18 phantom21:39
引擎: KAV 引擎 (AVK 17.7845), BD 引擎 (BD 17.5161)
高启发式: 打开
压缩文件: 打开
系统区域: 打开

扫描系统区域...
扫描所选择的目录和文件...
对象: kqtohw21.sys
        在压缩档案里: G:\Downloads\样本.rar
        Status: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.NewWeb.m (KAV 引擎)
对象: acpidisk.sys
        在压缩档案里: G:\Downloads\样本.rar
        Status: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.Cinmus.jq (KAV 引擎)
对象: gaiabu08.sys
        在压缩档案里: G:\Downloads\样本.rar
        Status: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.Agent.bz (KAV 引擎)
对象: jsshow.drv
        在压缩档案里: G:\Downloads\样本.rar
        Status: 可疑病毒
        病毒: BehavesLike:Trojan.ShellStartup (BD 引擎)
对象: 样本.rar
        路径: G:\Downloads
        Status: 病毒文件已删除
        病毒: not-a-virus:AdWare.Win32.NewWeb.m, not-a-virus:AdWare.Win32.Cinmus.jq, not-a-virus:AdWare.Win32.Agent.bz (KAV 引擎), BehavesLike:Trojan.ShellStartup (BD 引擎)
扫描完成: 2007-9-18 phantom21:39
    已检查 1 个文件
    已发现 1 个染毒文件