来15样本

gzg

扫扫看

promised

C:\ABC\样本1\5.EXE - 文件可能已损坏
C:\ABC\样本1\AUTORUN.EXE - 特征码 'Virus.Win32.AutoRun.bs' 被发现
C:\ABC\样本1\iexplore.exe - 可疑代码段 被发现 (Level: 245)
C:\ABC\样本1\KAQHACS.DLL
C:\ABC\样本1\KAQHDAZ.EXE - 特征码 'Trojan-Spy.Win32.Bancos.ha' 被发现
C:\ABC\样本1\KAQHDZY.DLL - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\样本1\PATCH23.DLL - 特征码 'Trojan.ZSKiller.B' 被发现
C:\ABC\样本1\RARJBPI.DLL - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\样本1\RARJBTL.EXE - 特征码 'Trojan-Spy.Win32.Bancos.ha' 被发现
C:\ABC\样本1\rsztafg.dll
C:\ABC\样本1\RSZTBPM.DLL - 可疑代码段 被发现 (Level: 50)
C:\ABC\样本1\RSZTBSP.EXE - 特征码 'Trojan-Spy.Win32.Bancos.ha' 被发现
C:\ABC\样本1\servet.exe - 特征码 'Backdoor.Win32.Agent.ahj' 被发现
C:\ABC\样本1\setup.exe - 特征码 'Trojan-PWS.Win32.Small.br' 被发现
C:\ABC\样本1\WINSYS74.SYS - 特征码 'Trojan-PWS.Win32.Nilage.bga' 被发现

1688388728

版本
双引擎反病毒签名 9/27/2007
开始时间: 9/27/2007 17:12
引擎: KAV 引擎 (AVK 17.8213), AVST 引擎 (AVKB 17.388)
高启发式: 打开
压缩文件: 打开
系统区域: 打开
扫描系统区域...
扫描所选择的目录和文件...
对象: AUTORUN.EXE
路径: C:\Documents and Settings\Administrator\桌面\样本1[1]
狀態: 病毒文件已删除
病毒: Virus.Win32.AutoRun.pi (KAV 引擎), Win32:Delf-FZG [Trj] (AVST 引擎)
对象: KAQHDAZ.EXE
路径: C:\Documents and Settings\Administrator\桌面\样本1[1]
狀態: 病毒文件已删除
病毒: Trojan-PSW.Win32.OnLineGames.drb (KAV 引擎)
对象: KAQHDZY.DLL
路径: C:\Documents and Settings\Administrator\桌面\样本1[1]
狀態: 病毒文件已删除
病毒: Trojan-PSW.Win32.OnLineGames.drb (KAV 引擎)
对象: PATCH23.DLL
路径: C:\Documents and Settings\Administrator\桌面\样本1[1]
狀態: 病毒文件已删除
病毒: Win32:Adware-gen. [Adw] (AVST 引擎)
对象: RARJBPI.DLL
路径: C:\Documents and Settings\Administrator\桌面\样本1[1]
狀態: 病毒文件已删除
病毒: Trojan-PSW.Win32.OnLineGames.drc (KAV 引擎)
对象: RARJBTL.EXE
路径: C:\Documents and Settings\Administrator\桌面\样本1[1]
狀態: 病毒文件已删除
病毒: Trojan-PSW.Win32.OnLineGames.drc (KAV 引擎)
对象: RSZTBPM.DLL
路径: C:\Documents and Settings\Administrator\桌面\样本1[1]
狀態: 病毒文件已删除
病毒: Trojan-PSW.Win32.OnLineGames.drd (KAV 引擎), Win32:Delf-FYG [Trj] (AVST 引擎)
对象: RSZTBSP.EXE
路径: C:\Documents and Settings\Administrator\桌面\样本1[1]
狀態: 病毒文件已删除
病毒: Trojan-PSW.Win32.OnLineGames.drd (KAV 引擎), Win32:Delf-FYG [Trj] (AVST 引擎)
对象: servet.exe
路径: C:\Documents and Settings\Administrator\桌面\样本1[1]
狀態: 病毒文件已删除
病毒: Trojan-Downloader.Win32.Baser.u (KAV 引擎), Win32:Delf-FYB [Trj] (AVST 引擎)
对象: setup.exe
路径: C:\Documents and Settings\Administrator\桌面\样本1[1]
狀態: 病毒文件已删除
病毒: Trojan-Downloader.Win32.Agent.dex (KAV 引擎), Win32:Delf-GAM (AVST 引擎)
对象: WINSYS74.SYS
路径: C:\Documents and Settings\Administrator\桌面\样本1[1]
狀態: 病毒文件已删除
病毒: Virus.Win32.AutoRun.pi (KAV 引擎), Win32:Delf-FZG [Trj] (AVST 引擎)
扫描完成: 9/27/2007 17:13
    已检查 15 个文件
    已发现 11 个染毒文件

[ 本帖最后由 1688388728 于 2007-9-27 17:14 编辑 ]

红心王子

小a漏掉两个DLL

2007-9-27 17:09:59 1190884199 Administrator 2888 Sign of "Win32:Delf-FYB [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本1.part1.rar\servet.exe\[NsPack]" file.  
2007-9-27 17:10:02 1190884202 Administrator 2888 Sign of "Win32:Delf-GAM" has been found in "C:\Documents and Settings\Administrator\桌面\样本1.part1.rar\setup.exe\[Upack]" file.  
2007-9-27 17:10:02 1190884202 Administrator 2888 Sign of "Win32:Adware-gen. [Adw]" has been found in "C:\Documents and Settings\Administrator\桌面\样本1.part1.rar\PATCH23.DLL\[Embedded#5a60]" file.  
2007-9-27 17:10:02 1190884202 Administrator 2888 Sign of "Win32:Adware-gen. [Adw]" has been found in "C:\Documents and Settings\Administrator\桌面\样本1.part1.rar\PATCH23.DLL" file.  
2007-9-27 17:10:03 1190884203 Administrator 2888 Sign of "Win32:Delf-FZG [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本1.part1.rar\WINSYS74.SYS" file.  
2007-9-27 17:10:04 1190884204 Administrator 2888 Sign of "Win32:Delf-FYG [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本1.part2.rar\RSZTBPM.DLL" file.  
2007-9-27 17:10:04 1190884204 Administrator 2888 Sign of "Win32:Delf-FYG [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本1.part2.rar\RSZTBSP.EXE\[Upack]\[Embedded#MUSIC]" file.  
2007-9-27 17:10:04 1190884204 Administrator 2888 Sign of "Win32:Delf-FZG [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本1.part2.rar\AUTORUN.EXE\[UPX]\[Embedded#05ef8]" file.

906mbc

费尔报三个木马，都在part1，

gho

2007-9-27        17:25:45        Moved (Clean failed because the file isn't cleanable)         WHUT-D9193C067E\gho        WinRAR.exe        C:\Documents and Settings\gho\My Documents\servet.exe        New Malware.u (Trojan)
2007-9-27        17:25:46        Moved (Clean failed because the file isn't cleanable)         WHUT-D9193C067E\gho        WinRAR.exe        C:\Documents and Settings\gho\My Documents\setup.exe        New Malware.n (Trojan)
2007-9-27        17:25:47        Moved (Clean failed because the file isn't cleanable)         WHUT-D9193C067E\gho        WinRAR.exe        C:\Documents and Settings\gho\My Documents\iexplore.exe        New Malware.fc (Trojan)
2007-9-27        17:25:47        Deleted         WHUT-D9193C067E\gho        WinRAR.exe        C:\Documents and Settings\gho\My Documents\WINSYS74.SYS        PWS-QQGame (Trojan)
2007-9-27        17:25:47        Moved (Clean failed because the file isn't cleanable)         WHUT-D9193C067E\gho        WinRAR.exe        C:\Documents and Settings\gho\My Documents\KAQHDAZ.EXE        New Malware.n (Trojan)
2007-9-27        17:25:47        Moved (Clean failed because the file isn't cleanable)         WHUT-D9193C067E\gho        WinRAR.exe        C:\Documents and Settings\gho\My Documents\RARJBTL.EXE        New Malware.n (Trojan)
2007-9-27        17:25:47        Moved (Clean failed because the file isn't cleanable)         WHUT-D9193C067E\gho        WinRAR.exe        C:\Documents and Settings\gho\My Documents\RSZTBSP.EXE        New Malware.n (Trojan)
2007-9-27        17:25:47        Deleted         WHUT-D9193C067E\gho        WinRAR.exe        C:\Documents and Settings\gho\My Documents\AUTORUN.EXE        PWS-QQGame (Trojan)

nosferatu

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本1'
C:\Documents and Settings\Administrator\桌面\样本1\5.EXE
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!
C:\Documents and Settings\Administrator\桌面\样本1\AUTORUN.EXE
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\样本1\iexplore.exe
      [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\样本1\KAQHDAZ.EXE
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '474c7b7a.qua'!
C:\Documents and Settings\Administrator\桌面\样本1\KAQHDZY.DLL
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '474c7b7b.qua'!
C:\Documents and Settings\Administrator\桌面\样本1\PATCH23.DLL
      [DETECTION] Is the Trojan horse TR/Drop.ZSKiller.2
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\样本1\RARJBPI.DLL
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '474d7b7d.qua'!
C:\Documents and Settings\Administrator\桌面\样本1\RARJBTL.EXE
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '474d7b7e.qua'!
C:\Documents and Settings\Administrator\桌面\样本1\RSZTBPM.DLL
      [DETECTION] Is the Trojan horse TR/Banker.FXS
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\样本1\RSZTBSP.EXE
      [DETECTION] Is the Trojan horse TR/Banker.FXS
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\样本1\servet.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\样本1\setup.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Small.GOC.1
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\样本1\WINSYS74.SYS
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '47497b8c.qua'!


End of the scan: 2007年9月27日  17:43
Used time: 00:31 min

The scan has been done completely.

      1 Scanning directories
     15 Files were scanned
      7 viruses and/or unwanted programs were found
      6 Files were classified as suspicious:

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.QQHX.tqd
病毒： Trojan.PSW.Win32.QQHX.tqc
病毒： Trojan.DL.Win32.Autorun.ytn
病毒： Worm.Win32.Agent.vji     
病毒： Trojan.Clicker.Win32.Agent.agm

MAC地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：19.42.32

浪滔天

卡巴 7.0.0.125
11个

已删除: 病毒 Virus.Win32.AutoRun.pi        文件: F:\病毒样本\样本1[1]\WINSYS74.SYS
已删除: 病毒 Virus.Win32.AutoRun.pi        文件: F:\病毒样本\样本1[1]\AUTORUN.EXE//UPX
已删除: 病毒 Virus.Win32.AutoRun.pj        文件: F:\病毒样本\样本1[1]\iexplore.exe//RCryptor
已删除: 木马程序 Trojan-Downloader.Win32.Agent.dex        文件: F:\病毒样本\样本1[1]\setup.exe//UPack
已删除: 木马程序 Trojan-Downloader.Win32.Baser.u        文件: F:\病毒样本\样本1[1]\servet.exe//NSPack//PE_Patch.MaskPE
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.drb        文件: F:\病毒样本\样本1[1]\KAQHDAZ.EXE//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.drb        文件: F:\病毒样本\样本1[1]\KAQHDZY.DLL
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.drc        文件: F:\病毒样本\样本1[1]\RARJBTL.EXE//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.drc        文件: F:\病毒样本\样本1[1]\RARJBPI.DLL
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.drd        文件: F:\病毒样本\样本1[1]\RSZTBSP.EXE//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.drd        文件: F:\病毒样本\样本1[1]\RSZTBPM.DLL

PlayWill

FS只扫除了2个