3个[MD5: C7067D D21BD5 C75A1E]

xxwpk007

3个[MD5: C7067D D21BD5 C75A1E]

The EQs

Scan performed at: 2007-10-3 19:38:26
Scanning Log
NOD32 version 2568 (20071003) NT
Command line: C:\Documents and Settings\Don johnson\桌面\样本.rar
Operating memory - is OK

Date: 3.10.2007  Time: 19:38:29
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\样本.rar
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?MM.exe - probably a variant of Win32/PSW.QQShou trojan
Number of scanned files: 4
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 19:38:29 Total scanning time: 0 sec (00:00:00)

hahacomcn

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本.rar'
C:\Documents and Settings\Administrator\桌面\样本.rar
  [0] Archive type: RAR
  --> zz.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> MM.exe
      [DETECTION] Is the Trojan horse TR/PSW.QQpass.afn.1

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.QQPass.yrp

MAC地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：19.43.20

IllusionWing

2

UGuard Log (Digital Fox - gankeyu@126.com)
UGuarduu.exe = 4.2.0
HC0.rlb = 2.8.9
HC2.rlb = 2.4.0
FN0.rlb = 2.3.1
扫描选项：扫描档案, 扩展, 忽略非活动, 忽略大文件, nFile, BAT模拟, 捆绑检测, 变形壳, 启发,
[扫描] [Level 2] 在 E:\Documents and Settings\Administrator\桌面\Vir\样本.rar>>MM.exe//Stream_01 检测到 Generic.OperationOfSEH
[扫描] [Level 2] 在 E:\Documents and Settings\Administrator\桌面\Vir\样本.rar>>MM.exe//Stream_02 检测到 Trojan.Game.WuLinWaiZhuan
[扫描] [捆绑检测] 在 E:\Documents and Settings\Administrator\桌面\Vir\样本.rar>>MM.exe 检测到 Generic.Binder
[扫描] [Level 2] 在 E:\Documents and Settings\Administrator\桌面\Vir\样本.rar>>MM.exe 检测到 Trojan.Game.WuLinWaiZhuan
[扫描] [Level 2] 在 E:\Documents and Settings\Administrator\桌面\Vir\样本.rar>>zz.exe 检测到 Downloaer.77
检测到了 2 个未知的恶意程序，请上报。
任务 扫描 完成。共耗费的时间：0-00-00 00:00:00:0328，共扫描的文件数量：6，共扫描到的威胁数量：5，威胁率：0.83333333

moonsilver

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.QQPass.yrp


一个

yurius

deleted: virus Heur.Downloader (modification)        File: J:\virus\Ñù±¾.rar/zz.exe
deleted: Trojan program Trojan-PSW.Win32.QQPass.afn        File: J:\virus\Ñù±¾.rar/MM.exe

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 290
Paranoia Database - 6697
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder (2)

C:\Documents and Settings\uhthn\Desktop\New Folder (2)\zx.exe - OK
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\zz.exe - Suspected Trojan-Downloader.VB.1
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\MM.exe - Infected Win32.Trojan-PSW.QQPass.a

3 Files scanned
1 Infected files found
1 Suspected files found
0 Files cured
1 Files deleted

微点卫士

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MM.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\ATMQQ2.DLL
是否删除木马程序及其衍生物?
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ZZ.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:1454
远端地址:220.248.198.186(江西·南昌)
远端端口:80
zz.exe没动作了

zx.exe无法运行

king6808

已隔离：病毒 Heur.Downloader (修改)        文件　: G:\10.3\样本.rar/zz.exe
已删除：木马程序 Trojan-PSW.Win32.QQPass.afn        文件　: G:\10.3\样本.rar/MM.exe