再来几个样本

gzg

扫扫看

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\SYSTEM32.rar'
C:\Documents and Settings\Administrator\My Documents\
  SYSTEM32.rar
    [0] Archive type: RAR
    --> KBFZ.DLL
        [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> KBFZ.EXE
        [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> WMIDS.EXE
        [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> IEXPLORE32.IME
        [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> CHOSTBL.EXE
    --> 1
        [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.GA
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!


End of the scan: 2007年9月20日  23:38
Used time: 00:03 min

The scan has been done completely.

      0 Scanning directories
      7 Files were scanned
      5 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      1 Archives were scanned
      6 Warnings
      0 Notes

红心王子

2007-9-21        14:45:20        1190357120        Administrator        1760        Sign of "Win32:Qqrob-BK [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\SYSTEM32.rar\KBFZ.DLL" file.  
2007-9-21        14:45:23        1190357123        Administrator        1760        Sign of "Win32:Qqrob-BK [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\SYSTEM32.rar\KBFZ.EXE\[PolyCryptPE]\[Embedded#MYDLL]" file.  
2007-9-21        14:45:23        1190357123        Administrator        1760        Sign of "Win32:Qqrob-BK [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\SYSTEM32.rar\KBFZ.EXE\[Embedded#MYDLL]" file.  
2007-9-21        14:45:23        1190357123        Administrator        1760        Sign of "Win32:Qqrob-BK [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\SYSTEM32.rar\KBFZ.EXE" file.  
2007-9-21        14:45:23        1190357123        Administrator        1760        Sign of "Win32:Trojan-gen. {UPX!}" has been found in "C:\Documents and Settings\Administrator\桌面\SYSTEM32.rar\WMIDS.EXE" file.  
2007-9-21        14:45:23        1190357123        Administrator        1760        Sign of "Win32:Delf-DUO [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\SYSTEM32.rar\IEXPLORE32.IME\[UPX]\[Embedded#4cf0]" file.  
2007-9-21        14:45:23        1190357123        Administrator        1760        Sign of "Win32:Agent-BQC [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\SYSTEM32.rar\1" file.

lvjie

NOD32

zszzd

KILL7.1 报了四个，这次好强呀

啊弥陀佛

木马名称:Trojan-Downloader.Win32.Delf.fuu
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SYSTEM32\WMIDS.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Rootkit.Win32.Agent.gh
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SYSTEM32\1
是木马程序!
已成功阻止其运行,是否要删除此文件?


木马名称:未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SYSTEM32\KBFZ.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

wangjay1980

detected: Trojan program Backdoor.Win32.Delf.bkt        File: C:\Documents and Settings\Owner\×ÀÃæ\SYSTEM32.rar/KBFZ.DLL
detected: Trojan program Backdoor.Win32.Delf.bmp        File: C:\Documents and Settings\Owner\×ÀÃæ\SYSTEM32.rar/KBFZ.EXE//PolyCrypt
detected: Trojan program Trojan-Downloader.Win32.Delf.bki        File: C:\Documents and Settings\Owner\×ÀÃæ\SYSTEM32.rar/WMIDS.EXE//PE_Patch.UPX//UPX
detected: Trojan program Trojan-Spy.Win32.Delf.ajc        File: C:\Documents and Settings\Owner\×ÀÃæ\SYSTEM32.rar/IEXPLORE32.IME//UPX
detected: Trojan program Rootkit.Win32.Agent.ga        File: C:\Documents and Settings\Owner\×ÀÃæ\SYSTEM32.rar/1

欠妳緈諨

AVAST5只

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 164
Paranoia Database - 5417
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\o

C:\Documents and Settings\uhthn\Desktop\o\KBFZ.DLL - Suspicious of Win32.Backdoor.Hupigon.5
C:\Documents and Settings\uhthn\Desktop\o\KBFZ.EXE - Suspicious of Win32.Backdoor.Hupigon.5
C:\Documents and Settings\uhthn\Desktop\o\WMIDS.EXE - Suspicious of Win32.Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\o\IEXPLORE32.IME - Suspicious of Win32.Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\o\CHOSTBL.EXE - OK
C:\Documents and Settings\uhthn\Desktop\o\1 - OK

6 Files scanned
0 Infected files found
4 Suspicious files found
0 Files cured
0 Files deleted

qqq000@qq.com

----------
              [凝逸反毒] (http://hi.baidu.com/503165656)

       [凝逸.扫描病毒引擎-日志]       2007.8.21 19:34:18

文件:F:\070921\SYSTEM32\KBFZ.DLL | 感染:virus [460>20070822_ny0010.axx]3(1.5)
操作:清除病毒
文件:F:\070921\SYSTEM32\KBFZ.EXE | 感染:virus [389>20070822_ny0010.axx]3(1.2)
操作:删除文件
文件:F:\070921\SYSTEM32\WMIDS.EXE | 感染:virus [10897>20070726_dw0001.axx]3(1.1)
操作:删除文件
文件:F:\070921\SYSTEM32\1 | 感染:Win32.Alman [6199>20070726_dw0001.axx]3(1.1)
操作:删除文件

扫描完成|病毒:4 文件:6|耗时:2423
----------