某毒招来的一堆

dikex

上一贴那个利用jpeg文件头的病毒激活后招来了一大堆

卡巴 6 2007-09-25 01:04:30砍剩的一些

密码virus

详情看：http://hi.baidu.com/dikex/blog/item/41fb43d9beec31ea38012f53.html

[ 本帖最后由 dikex 于 2007-9-25 02:14 编辑 ]

a750828

McAfee抓到5隻

The EQs

Scan performed at: 2007-9-25 2:09:04
Scanning Log
NOD32 version 2547 (20070924) NT
Command line: C:\Documents and Settings\Don johnson\桌面\re
Operating memory - is OK

Date: 25.9.2007  Time: 02:09:07
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\re\
C:\Documents and Settings\Don johnson\桌面\re\re\acpidisk.sys - a variant of Win32/Adware.Cinmus application
C:\Documents and Settings\Don johnson\桌面\re\re\dd.exe - probably a variant of Win32/Agent.NEO trojan
C:\Documents and Settings\Don johnson\桌面\re\re\DiskMan32.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Don johnson\桌面\re\re\hvevr64d.sys - a variant of Win32/Rootkit.Agent.NCK trojan
C:\Documents and Settings\Don johnson\桌面\re\re\logo_#3.exe - a variant of Win32/PSW.Agent.NEC trojan
C:\Documents and Settings\Don johnson\桌面\re\re\LYLOADER.EXE - a variant of Win32/PSW.Agent.NEC trojan
C:\Documents and Settings\Don johnson\桌面\re\re\mminstall.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\re\re\t7xg2.sys - a variant of Win32/Rootkit.Agent.NBQ trojan
Number of scanned files: 15
Number of threats found: 8
Number of files cleaned: 8
Time of completion: 02:09:10 Total scanning time: 3 sec (00:00:03)

buycard

F-prot

[Found possible virus] <W32/SecRisk-ProcessPatcher-Sml-based!Maximus>         \15vir!Win32Rootkit.Agent.NBQ\re\DiskMan32.exe->exefile
[Failed to disinfect]        \15vir!Win32Rootkit.Agent.NBQ\re\DiskMan32.exe
[Found worm] <W32/WormX.CQ (exact)>         \15vir!Win32Rootkit.Agent.NBQ\re\kmsinput.sys
[Deleted]        \15vir!Win32Rootkit.Agent.NBQ\re\kmsinput.sys
[Found downloader] <W32/Downloader.gen14>         \15vir!Win32Rootkit.Agent.NBQ\re\logo_#2.exe
[Deleted]        \15vir!Win32Rootkit.Agent.NBQ\re\logo_#2.exe
[Found possible virus] <W32/SecRisk-ProcessPatcher-Sml-based!Maximus>         \15vir!Win32Rootkit.Agent.NBQ\re\LYLOADER.EXE
[Failed to disinfect]        \15vir!Win32Rootkit.Agent.NBQ\re\LYLOADER.EXE
[Found possible virus] <W32/Downloader-SmlInject-based!Maximus>         \15vir!Win32Rootkit.Agent.NBQ\re\LYMANGR.DLL
[Failed to disinfect]        \15vir!Win32Rootkit.Agent.NBQ\re\LYMANGR.DLL

红心王子

2007-9-25        7:50:03        1190677803        Administrator        1300        Sign of "Win32:Cinmus-J [Rtk]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹\re\acpidisk.sys" file.  
2007-9-25        7:50:10        1190677810        Administrator        1300        Sign of "Win32:Agent-GPD [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹\re\dd.exe\[NsPack]" file.  
2007-9-25        7:50:13        1190677813        Administrator        1300        Sign of "Win32:Onlinegames-BBY [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹\re\DiskMan32.exe\[UPX]" file.  
2007-9-25        7:50:16        1190677816        Administrator        1300        Sign of "Win32:Onlinegames-BCE [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹\re\DiskMan32.dll" file.  
2007-9-25        7:50:20        1190677820        Administrator        1300        Sign of "Win32:Cinmus-G [Adw]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹\re\DoSSSetup.dll" file.  
2007-9-25        7:50:23        1190677823        Administrator        1300        Sign of "Win32:Agent-IWX [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹\re\logo_#2.exe" file.  
2007-9-25        7:50:26        1190677826        Administrator        1300        Sign of "Win32:OnLineGames-SR [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹\re\logo_#3.exe" file.  
2007-9-25        7:50:29        1190677829        Administrator        1300        Sign of "Win32:OnLineGames-SS [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹\re\LYLOADER.EXE\[Upack]" file.  
2007-9-25        7:50:31        1190677831        Administrator        1300        Sign of "Win32:OnLineGames-ST [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹\re\LYMANGR.DLL\[Upack]" file.  
2007-9-25        7:50:34        1190677834        Administrator        1300        Sign of "Win32:Onlinegames-ALF [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹\re\MSDEG32.DLL\[Upack]" file.  
2007-9-25        7:50:37        1190677837        Administrator        1300        Sign of "Win32:Delf-FOE [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹\re\service.exe\[UPX]" file.

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\re'
C:\Users\morgan\Documents\re\
  acpidisk.sys
      [DETECTION] Contains detection pattern of the rootkit RKIT/Cinmus.M
      [INFO]      The file was deleted!
  dd.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [INFO]      The file was deleted!
  DiskMan32.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '476b696c.qua'!
  DiskMan32.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [INFO]      The file was deleted!
  DoSSSetup.dll
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Cinmus.JH
      [INFO]      The file was deleted!
  hvevr64d.sys
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [INFO]      The file was deleted!
  kmsinput.sys
  logo_#2.exe
      [DETECTION] Is the Trojan horse TR/PSW.Onlineg.TF.1
      [INFO]      The file was deleted!
  logo_#3.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [INFO]      The file was deleted!
  LYLOADER.EXE
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [INFO]      The file was deleted!
  LYMANGR.DLL
      [DETECTION] Is the Trojan horse TR/PSW.Online.agb.2
      [INFO]      The file was deleted!
  mminstall.exe
  MSDEG32.DLL
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [INFO]      The file was deleted!
  service.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [INFO]      The file was moved to '476a6968.qua'!
  t7xg2.sys
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [INFO]      The file was deleted!


End of the scan: 2007年9月24日  18:48
Used time: 00:04 min

The scan has been done completely.

      1 Scanning directories
     15 Files were scanned
     11 viruses and/or unwanted programs were found
      2 Files were classified as suspicious:
     11 files were deleted
      0 files were repaired
      2 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      4 Files not concerned
      0 Archives were scanned
      0 Warnings
      0 Notes

wangjay1980

detected: virus Heur.Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\re\DiskMan32.exe//PE_Patch.UPX
detected: Trojan program Trojan-PSW.Win32.OnLineGames.dmr        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\re\logo_#3.exe//#//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.dmr        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\re\LYLOADER.EXE//PE_Patch//UPack//#//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.dmr        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\re\LYMANGR.DLL//UPack
detected: Trojan program Trojan.Win32.Agent.brd        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\re\MSDEG32.DLL//UPack
detected: virus Heur.Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\re\service.exe//PE_Patch.UPX

kp2006

江民杀毒软件报告文件

        北京江民新科技术有限公司

        扫描引擎 11.00.702
        病毒库日期 2007-09-24
        更新日期 2007-09-25

扫描目标 D:\Documents and Settings\Administrator\桌面\re[1]\

开始时间 2007-09-25 10:06:38

在 D:\Documents and Settings\Administrator\桌面\re[1]\re\acpidisk.sys 中发现 Adware/Clicker.eey 病毒, 已删除
在 D:\Documents and Settings\Administrator\桌面\re[1]\re\dd.exe 中发现 Trojan/DiskAutorun.td 病毒, 已删除
在 D:\Documents and Settings\Administrator\桌面\re[1]\re\service.exe 中发现 Trojan/Agent.nfz 病毒, 已删除
正常结束。

扫描结果:
                 文件数 :484                                 病毒体 :3         
                   删除 :3                                     解毒 :0         
    扫描速度(千字节/秒) :20291                             扫描时间 :00:00:06
    扫描文件速度(个/秒) :80

啊弥陀佛

木马名称:未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\RE[1]\RE\LYLOADER.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\RE[1]\RE\LYMANGR.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\RE[1]\RE\MSDEG32.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\RE[1]\RE\DISKMAN32.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\RE[1]\RE\LOGO_#2.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TEMPAQ
2) C:\WINDOWS\SYSTEM32\DRIVERS\WU9DN7TQVN.SYS
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\RE[1]\RE\SERVICE.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\SERVICE.EXE
是否删除木马程序及其衍生物?

欠妳緈諨