27个【MD5略】

wangjay1980

如题，卡巴全杀

[ 本帖最后由 wangjay1980 于 2007-9-29 16:23 编辑 ]

碧水寒潭

Start of the scan: 2007年9月29日  16:18

Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\27.zip
  [0] Archive type: ZIP
  --> wl(1).exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 1(1)(1)(1).exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 1(1)(3).exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 1(3).exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 2(4).exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 02jh.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
  --> 3(2)(2).exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.ddm.1
  --> 4(1).exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 4(3).exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
  --> 04wl.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
  --> 5(3)(1).exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
  --> 6(2).exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 6.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 7.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 9(1).exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> 10(1).exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 14(2).exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> jh.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> mh(1).exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> mh.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> mminstall.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Hmir.Y
  --> moyu.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> qq.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> sms.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> svcos.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> tempO.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was deleted!


End of the scan: 2007年9月29日  16:18
Used time: 00:18 min

The scan has been done completely.

      1 Scanning directories
     28 Files were scanned
     14 viruses and/or unwanted programs were found
     12 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     14 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

The EQs

Scan performed at: 2007-9-29 16:22:13
Scanning Log
NOD32 version 2559 (20070929) NT
Command line: C:\Documents and Settings\Don johnson\桌面\27.zip
Operating memory - is OK

Date: 29.9.2007  Time: 16:22:16
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\27.zip
C:\Documents and Settings\Don johnson\桌面\27.zip ?ZIP ?wl(1).exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\27.zip ?ZIP ?1(1)(3).exe - a variant of Win32/PSW.Agent.NEC trojan
C:\Documents and Settings\Don johnson\桌面\27.zip ?ZIP ?1(3).exe - a variant of Win32/PSW.Agent.NEC trojan
C:\Documents and Settings\Don johnson\桌面\27.zip ?ZIP ?2(4).exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\27.zip ?ZIP ?3(2)(2).exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\27.zip ?ZIP ?4(1).exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\27.zip ?ZIP ?6(2).exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\27.zip ?ZIP ?7.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\27.zip ?ZIP ?9(1).exe - probably a variant of Win32/AutoRun.Q worm
C:\Documents and Settings\Don johnson\桌面\27.zip ?ZIP ?10(1).exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\27.zip ?ZIP ?14(2).exe - probably a variant of Win32/AutoRun.Q worm
C:\Documents and Settings\Don johnson\桌面\27.zip ?ZIP ?jh.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\27.zip ?ZIP ?mh(1).exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\27.zip ?ZIP ?mh.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\27.zip ?ZIP ?mminstall.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\27.zip ?ZIP ?moyu.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\27.zip ?ZIP ?qq.exe - probably a variant of Win32/AutoRun.Q worm
C:\Documents and Settings\Don johnson\桌面\27.zip ?ZIP ?sms.exe - a variant of Win32/PSW.Delf.NIY trojan
C:\Documents and Settings\Don johnson\桌面\27.zip ?ZIP ?svcos.exe - a variant of Win32/PSW.Delf.NIY trojan
Number of scanned files: 28
Number of threats found: 19
Number of files cleaned: 1
Time of completion: 16:22:22 Total scanning time: 6 sec (00:00:06)

scottxzt

里面的这个文件卡巴也报?

wangjay1980

Trojan-Downloader.JS.Agent.sy

残缺的唯美

fs 全部 pass

scottxzt

原帖由 wangjay1980 于 2007-9-29 16:50 发表
Trojan-Downloader.JS.Agent.sy

恩,我刚运行了没发现啥,上报看看.

FBAV

MicroVita AntiSpyware 100 C
_____________________________________________
                                          
             风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]                  
                   http://221.10.254.214/
----------------------------------------------
开始扫描……


正在检查启动……
[C:\Documents and Settings\Administrator\桌面\Virus\27\wl(1).exe]
                    …………发现Spy！报告:[1]
文件信息:  大小:14859  MD5:45a189e38b610dbc64243527eccff9ef


[C:\Documents and Settings\Administrator\桌面\Virus\27\1(1)(1)(1).exe]
                    …………发现Spy！报告:[1]
文件信息:  大小:19624  MD5:ba58c501e2f960a3427cb8c5122a2cf9


[C:\Documents and Settings\Administrator\桌面\Virus\27\02jh.exe]
                    …………发现Spy！报告:[1]
文件信息:  大小:19662  MD5:c105ae240b5a1f3523b97c2c39e21649


[C:\Documents and Settings\Administrator\桌面\Virus\27\4(1).exe]
                    …………发现Spy！报告:[1]
文件信息:  大小:14086  MD5:b65281be0a96cf714aa9293c11f3acb9


[C:\Documents and Settings\Administrator\桌面\Virus\27\4(3).exe]
                    …………发现Spy！报告:[1]
文件信息:  大小:14496  MD5:80e6c37ce8ff3d08c8b7a888de054a09


[C:\Documents and Settings\Administrator\桌面\Virus\27\04wl.exe]
                    …………发现Spy！报告:[1]
文件信息:  大小:14697  MD5:d8421da8a349a71c057bc29296b7b728


[C:\Documents and Settings\Administrator\桌面\Virus\27\5(3)(1).exe]
                    …………发现Spy！报告:[1]
文件信息:  大小:16404  MD5:b39b0709468dc210785f3c6dafa0b22e


[C:\Documents and Settings\Administrator\桌面\Virus\27\6(2).exe]
                    …………发现Spy！报告:[1]
文件信息:  大小:14701  MD5:63bd3bf11e81cba1906c9627071d6816


[C:\Documents and Settings\Administrator\桌面\Virus\27\6.exe]
                    …………发现Spy！报告:[1]
文件信息:  大小:14948  MD5:08e41f9912bdbade726dcedbbdc0ca2b


[C:\Documents and Settings\Administrator\桌面\Virus\27\7.exe]
                    …………发现Spy！报告:[1]
文件信息:  大小:14062  MD5:e8488bbc8e0b72080e9bbd844875eba4


[C:\Documents and Settings\Administrator\桌面\Virus\27\9(1).exe]
                    …………发现Spy！报告:[2]
文件信息:  大小:32361  MD5:c91f863a9855fcf3e298ea37dad2a377


[C:\Documents and Settings\Administrator\桌面\Virus\27\10(1).exe]
                    …………发现Spy！报告:[1]
文件信息:  大小:14845  MD5:912489831dd9c63b7188af55ddb40b4a


[C:\Documents and Settings\Administrator\桌面\Virus\27\14(2).exe]
                    …………发现Spy！报告:[2]
文件信息:  大小:32360  MD5:164e7cd92be68e6cddd02018d3cbf87e


[C:\Documents and Settings\Administrator\桌面\Virus\27\jh.exe]
                    …………发现Spy！报告:[1]
文件信息:  大小:14276  MD5:2cb6d73d393cd0e1b30041840ad8f740


[C:\Documents and Settings\Administrator\桌面\Virus\27\mh(1).exe]
                    …………发现Spy！报告:[1]
文件信息:  大小:14149  MD5:e9ac4f91d21192263f0363f969adf74e


[C:\Documents and Settings\Administrator\桌面\Virus\27\mh.exe]
                    …………发现Spy！报告:[1]
文件信息:  大小:14149  MD5:ea62397c88d58721de4c43adecc1f716


[C:\Documents and Settings\Administrator\桌面\Virus\27\moyu.exe]
                    …………发现Spy！报告:[1]
文件信息:  大小:14699  MD5:adbf9bf2c20791387fb140b98662a580


[C:\Documents and Settings\Administrator\桌面\Virus\27\qq.exe]
                    …………发现Spy！报告:[2]
文件信息:  大小:32379  MD5:62fad2431dcfb964f24fd9c9b4c841aa


[C:\Documents and Settings\Administrator\桌面\Virus\27\sms.exe]
                    …………发现Spy！报告:[2]
文件信息:  大小:22677  MD5:5170aa4548021a51c53e7869ca8ecf49


[C:\Documents and Settings\Administrator\桌面\Virus\27\svcos.exe]
                    …………发现Spy！报告:[2]
文件信息:  大小:22670  MD5:20d313d13bc20f0d9fbd6ab6bec2732a


[C:\Documents and Settings\Administrator\桌面\Virus\27\tempO.exe]
                    …………发现Spy！报告:[1]
文件信息:  大小:13912  MD5:15e26a8db141a0a00d0d2085ea53dd44


文件数:27   病毒数:21  比重:0.7777777777778
OK  扫描完毕！

  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎   
[2] 文件特征码引擎
[1] 文件启发式引擎

[ 本帖最后由 FBAV 于 2007-9-29 16:57 编辑 ]

红心王子

小a  18个



2007-9-29        18:25:54        1191061554        Administrator        2104        Sign of "Win32:Delf-FVM [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\27.zip\wl(1).exe\[Upack]\[Embedded#MUSIC]" file.  
2007-9-29        18:25:58        1191061558        Administrator        2104        Sign of "Win32:Agent-LNC [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\27.zip\1(1)(1)(1).exe\[Upack]" file.  
2007-9-29        18:25:58        1191061558        Administrator        2104        Sign of "Win32:OnLineGames-ST [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\27.zip\1(1)(3).exe\[Embedded#0c80]\[Upack]\[Embedded#5158]\[Upack]" file.  
2007-9-29        18:25:58        1191061558        Administrator        2104        Sign of "Win32:OnLineGames-SR [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\27.zip\1(1)(3).exe" file.  
2007-9-29        18:25:58        1191061558        Administrator        2104        Sign of "Win32:OnLineGames-ST [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\27.zip\1(3).exe\[Embedded#0c80]\[Upack]\[Embedded#5158]\[Upack]" file.  
2007-9-29        18:25:58        1191061558        Administrator        2104        Sign of "Win32:OnLineGames-SR [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\27.zip\1(3).exe" file.  
2007-9-29        18:25:58        1191061558        Administrator        2104        Sign of "Win32:Agent-IYU [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\27.zip\02jh.exe\[Upack]\[Embedded#60e0]\[Upack]" file.  
2007-9-29        18:25:58        1191061558        Administrator        2104        Sign of "Win32:Onlinegames-AUU [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\27.zip\4(3).exe\[Upack]\[Embedded#5090]\[Upack]" file.  
2007-9-29        18:25:58        1191061558        Administrator        2104        Sign of "Win32:Onlinegames-AUT [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\27.zip\04wl.exe\[Upack]\[Embedded#6090]\[Upack]" file.  
2007-9-29        18:25:58        1191061558        Administrator        2104        Sign of "Win32:Onlinegames-BBH [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\27.zip\5(3)(1).exe\[Upack]\[Embedded#5090]\[Upack]" file.  
2007-9-29        18:25:58        1191061558        Administrator        2104        Sign of "Win32:Delf-FYG [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\27.zip\6(2).exe\[Upack]\[Embedded#MUSIC]" file.  
2007-9-29        18:25:58        1191061558        Administrator        2104        Sign of "Win32:Onlinegames-AUU [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\27.zip\6.exe\[Upack]\[Embedded#5090]\[Upack]" file.  
2007-9-29        18:25:58        1191061558        Administrator        2104        Sign of "Win32:Delf-FZG [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\27.zip\9(1).exe\[UPX]\[Embedded#05ef8]" file.  
2007-9-29        18:25:58        1191061558        Administrator        2104        Sign of "Win32:Delf-FVM [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\27.zip\10(1).exe\[Upack]\[Embedded#MUSIC]" file.  
2007-9-29        18:25:58        1191061558        Administrator        2104        Sign of "Win32:Delf-FZG [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\27.zip\14(2).exe\[UPX]\[Embedded#060f8]" file.  
2007-9-29        18:25:59        1191061559        Administrator        2104        Sign of "Win32:Delf-FYG [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\27.zip\moyu.exe\[Upack]\[Embedded#MUSIC]" file.  
2007-9-29        18:25:59        1191061559        Administrator        2104        Sign of "Win32:Delf-FZG [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\27.zip\qq.exe\[UPX]\[Embedded#05ef8]" file.  
2007-9-29        18:25:59        1191061559        Administrator        2104        Sign of "Win32:Delf-FFN [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\27.zip\sms.exe\[UPX]\[Embedded#54f0]" file.  
2007-9-29        18:25:59        1191061559        Administrator        2104        Sign of "Win32:Delf-FFN [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\27.zip\svcos.exe\[UPX]\[Embedded#54f0]" file.  
2007-9-29        18:25:59        1191061559        Administrator        2104        Sign of "Win32:Onlinegames-BEG [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\27.zip\tempO.exe\[Upack]\[Embedded#5090]\[Upack]" file.

残缺的唯美

汗  fs又 杀了
Result: 27 malware found
Trojan-PSW.Win32.OnLineGames.dtw (virus)
C:\Users\Administrator\Desktop\27.zip\wl(1).exe
C:\Users\Administrator\Desktop\27.zip\10(1).exe
Trojan-Downloader.JS.Agent.sy (virus)
C:\Users\Administrator\Desktop\27.zip\go368.gif
Trojan.Win32.Agent.btc (virus)
C:\Users\Administrator\Desktop\27.zip\1(1)(1)(1).exe
Trojan-PSW.Win32.OnLineGames.dtr (virus)
C:\Users\Administrator\Desktop\27.zip\1(1)(3).exe
C:\Users\Administrator\Desktop\27.zip\1(3).exe
Trojan-PSW.Win32.OnLineGames.dtx (virus)
C:\Users\Administrator\Desktop\27.zip\2(4).exe
Trojan-PSW.Win32.OnLineGames.dtu (virus)
C:\Users\Administrator\Desktop\27.zip\02jh.exe
Trojan-PSW.Win32.OnLineGames.dty (virus)
C:\Users\Administrator\Desktop\27.zip\3(2)(2).exe
Trojan-PSW.Win32.OnLineGames.dtz (virus)
C:\Users\Administrator\Desktop\27.zip\4(1).exe
C:\Users\Administrator\Desktop\27.zip\7.exe
C:\Users\Administrator\Desktop\27.zip\mh(1).exe
C:\Users\Administrator\Desktop\27.zip\mh.exe
Trojan-PSW.Win32.OnLineGames.dua (virus)
C:\Users\Administrator\Desktop\27.zip\4(3).exe
Trojan-PSW.Win32.OnLineGames.dtv (virus)
C:\Users\Administrator\Desktop\27.zip\04wl.exe
Trojan-PSW.Win32.WOW.ym (virus)
C:\Users\Administrator\Desktop\27.zip\5(3)(1).exe
C:\Users\Administrator\Desktop\27.zip\tempO.exe
Trojan-PSW.Win32.OnLineGames.duc (virus)
C:\Users\Administrator\Desktop\27.zip\6(2).exe
C:\Users\Administrator\Desktop\27.zip\moyu.exe
Trojan-PSW.Win32.OnLineGames.dub (virus)
C:\Users\Administrator\Desktop\27.zip\6.exe
Trojan-PSW.Win32.QQPass.afp (virus)
C:\Users\Administrator\Desktop\27.zip\9(1).exe
C:\Users\Administrator\Desktop\27.zip\qq.exe
Trojan-PSW.Win32.QQPass.bbb (virus)
C:\Users\Administrator\Desktop\27.zip\14(2).exe
Trojan-PSW.Win32.OnLineGames.dud (virus)
C:\Users\Administrator\Desktop\27.zip\jh.exe
Trojan-Downloader.Win32.Hmir.ap (virus)
C:\Users\Administrator\Desktop\27.zip\mminstall.exe
Trojan-PSW.Win32.Delf.ada (virus)
C:\Users\Administrator\Desktop\27.zip\sms.exe
C:\Users\Administrator\Desktop\27.zip\svcos.exe