今天在迅雷里面下载东西 ！！中了好几个病毒！

zlq7zj

刚刚装上红伞又杀出10来个


Starting the file scan:

Begin scan in 'C:\WINDOWS\system32'
C:\WINDOWS\system32\1634.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16004
      [WARNING]   The source file could not be found.
C:\WINDOWS\system32\1636.exe
      [WARNING]   The file could not be opened!
C:\WINDOWS\system32\1638.exe
      [WARNING]   The file could not be opened!
C:\WINDOWS\system32\1639.exe
      [WARNING]   The file could not be opened!
C:\WINDOWS\system32\163a.exe
      [WARNING]   The file could not be opened!
C:\WINDOWS\system32\163b.exe
      [WARNING]   The file could not be opened!
C:\WINDOWS\system32\163e.exe
      [WARNING]   The file could not be opened!
C:\WINDOWS\system32\163h.exe
      [WARNING]   The file could not be opened!
C:\WINDOWS\system32\163i.exe
      [WARNING]   The file could not be opened!
C:\WINDOWS\system32\163k.exe
      [WARNING]   The file could not be opened!
C:\WINDOWS\system32\dzqcmr.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '476fa969.qua'!
C:\WINDOWS\system32\gcdgbp.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '4762a955.qua'!
C:\WINDOWS\system32\drivers\atapi.sys
      [WARNING]   The file could not be opened!


End of the scan: 2007年9月30日  03:36
Used time: 03:25 min

The scan has been done completely.

    166 Scanning directories
   6544 Files were scanned
      0 viruses and/or unwanted programs were found
      3 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      2 files were moved to quarantine
      0 files were renamed
     10 Files cannot be scanned
   6544 Files not concerned
     10 Archives were scanned
     11 Warnings
      0 Notes

红心王子

2007-9-30        7:32:12        1191108732        Administrator        3252        Sign of "Win32:Nilage-JY [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\mppds.rar\mppds.exe\[Embedded#1a60]" file.  
2007-9-30        7:32:15        1191108735        Administrator        3252        Sign of "Win32:Nilage-JY [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\mppds.rar\mppds.exe" file.  
2007-9-30        7:32:16        1191108736        Administrator        3252        Sign of "Win32:Delf-FZG [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\PLUGINS.rar\WinSys84.Tao" file.  
2007-9-30        7:32:16        1191108736        Administrator        3252        Sign of "Win32:Delf-FZG [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\PLUGINS.rar\SysWin74.Jmp\[UPX]\[Embedded#05ef8]" file.  
2007-9-30        7:32:16        1191108736        Administrator        3252        Sign of "Win32:Delf-FZG [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\PLUGINS.rar\WinSys84.Sys" file.  
2007-9-30        7:32:16        1191108736        Administrator        3252        Sign of "Win32:Delf-FZG [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\AutoRun.rar\AutoRun.exe\[UPX]\[Embedded#05ef8]" file.

zszzd

扫描进行于：2007-9-30 8:14:30
扫描日志
NOD32版本 2559 (20070929) NT
命令行： C:\Documents and Settings\Administrator\桌面\mppds.rar C:\Documents and Settings\Administrator\桌面\pk.rar C:\Documents and Settings\Administrator\桌面\PLUGINS.rar C:\Documents and Settings\Administrator\桌面\txlybz.rar C:\Documents and Settings\Administrator\桌面\AutoRun.rar
C:\Program Files\ESET\nod32.exe - 是正常的
1 的MBR区.物理磁盘 - 是正常的
1 的启动引导区.物理磁盘 - 是正常的

日期： 30.9.2007  时间：08:14:34
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\Administrator\桌面\mppds.rar; C:\Documents and Settings\Administrator\桌面\pk.rar; C:\Documents and Settings\Administrator\桌面\PLUGINS.rar; C:\Documents and Settings\Administrator\桌面\txlybz.rar; C:\Documents and Settings\Administrator\桌面\AutoRun.rar
C:\Documents and Settings\Administrator\桌面\mppds.rar >>RAR >>mppds.exe - 可能是 Win32/Genetik 木马 的一个变种
C:\Documents and Settings\Administrator\桌面\pk.rar >>RAR >>pk.vbs - 是正常的
C:\Documents and Settings\Administrator\桌面\PLUGINS.rar >>RAR >>WinSys84.Tao - 可能是 Win32/AutoRun.Q 蠕虫 的一个变种
C:\Documents and Settings\Administrator\桌面\PLUGINS.rar >>RAR >>SysWin74.Jmp - 可能是 Win32/AutoRun.Q 蠕虫 的一个变种
C:\Documents and Settings\Administrator\桌面\PLUGINS.rar >>RAR >>WinSys84.Sys - 可能是 Win32/AutoRun.Q 蠕虫 的一个变种
C:\Documents and Settings\Administrator\桌面\txlybz.rar >>RAR >>txlybz.exe - Win32/PSW.OnLineGames.YA 木马的变种
C:\Documents and Settings\Administrator\桌面\AutoRun.rar >>RAR >>AutoRun.exe - 可能是 Win32/AutoRun.Q 蠕虫 的一个变种
C:\Documents and Settings\Administrator\桌面\AutoRun.rar >>RAR >>AutoRun.Inf - 是正常的
已扫描的文件数目：12
已发现的病毒数目：6
活动的病毒数目：4
完成时间： 08:14:35 总扫描时间：1 秒 (00:00:01)

除了两个没用的,其它的杀了

wangjay1980

detected: Trojan program Trojan-PSW.Win32.QQPass.afp        File: C:\Documents and Settings\Owner\×ÀÃæ\PLUGINS.rar/WinSys84.Tao
detected: Trojan program Trojan-PSW.Win32.QQPass.afp        File: C:\Documents and Settings\Owner\×ÀÃæ\PLUGINS.rar/SysWin74.Jmp//UPX
detected: Trojan program Trojan-PSW.Win32.QQPass.afp        File: C:\Documents and Settings\Owner\×ÀÃæ\PLUGINS.rar/WinSys84.Sys
detected: virus Heur.Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\txlybz.rar/txlybz.exe//PE_Patch.UPX
detected: Trojan program Trojan-PSW.Win32.QQPass.afp        File: C:\Documents and Settings\Owner\×ÀÃæ\AutoRun.rar/AutoRun.exe//UPX
detected: virus Heur.Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\mppds.rar/mppds.exe
detected: Trojan program Trojan.VBS.Runner.w        File: C:\Documents and Settings\Owner\×ÀÃæ\pk.rar/pk.vbs

啊弥陀佛

微点砍掉

Set Shell = CreateObject("Wscript.Shell")
Shell.Run("C:\DOCUME~1\Owner\LOCALS~1\Temp\pk.exe")
set Shell=Nothing
pk.exe不存在

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 270
Paranoia Database - 6213
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder (2)

C:\Documents and Settings\uhthn\Desktop\New Folder (2)\mppds.exe - Infected with SDB:Trojan-PSW.OnLineGames.12 - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\pk.vbs - OK
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\WinSys84.Tao - Infected with SDB:Win32.Trojan-PSW.QQPass.a - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\SysWin74.Jmp - Suspicious of Win32.Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\WinSys84.Sys - Infected with SDB:Win32.Trojan-PSW.QQPass.a - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\txlybz.exe - Suspicious of Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\AutoRun.exe - Suspicious of Win32.Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\AutoRun.Inf - Infected with PDB:0e6 Malware program - Deleted

8 Files scanned
4 Infected files found
3 Suspicious files found
0 Files cured
4 Files deleted

FBAV

MicroVita AntiSpyware 100 C
_____________________________________________
                                          
             风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]                  
                   http://221.10.254.214/
----------------------------------------------
开始扫描……


正在检查启动……
[E:\Safe\AutoRun\AutoRun.exe]
                    …………发现Spy！报告: [4] [2]
文件信息:  大小:32359  MD5:cf01137ae8506c8efd6f188c29363f99


[E:\Safe\AutoRun\AutoRun.Inf]
                    …………发现Spy！报告: [4]
文件信息:  大小:89  MD5:eb229c76b0e8c7adc3309a792ba1f516


[E:\Safe\AutoRun\SysWin74.Jmp]
                    …………发现Spy！报告:[2]
文件信息:  大小:32359  MD5:cf01137ae8506c8efd6f188c29363f99


[E:\Safe\AutoRun\WinSys84.Sys]
                    …………发现Spy！报告: [4]
文件信息:  大小:45159  MD5:13eeeaf0f61b21d807756cd0b91c067b


[E:\Safe\AutoRun\WinSys84.Tao]
                    …………发现Spy！报告: [4]
文件信息:  大小:45159  MD5:13eeeaf0f61b21d807756cd0b91c067b


文件数:8   病毒数:5  比重:0.625
OK  扫描完毕！

  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎   
[2] 文件特征码引擎
[1] 文件启发式引擎

投机的会议

诺顿看来是真的让人不放心，杀毒能力有点差劲哦