XiaoBird,[81039b]

绅博周幸

a-squared	3.0.0.123	2007.10.03	2007-10-03	-	22.619
AntiVir	7.6.0.18	7.0.0.46	2007-10-03	HEUR/Crypted	6.455
Arcavir	1.0.4	200710032012	2007-10-03	-	8.330
AVAST	1.0.8	000778-2	2007-10-03	-	6.731
AVG	7.5.49.442	269.13.37/1042	2007-10-01	Packed.AverCrypt	5.114
BitDefender	7.60825.898240	7.15106	2007-10-04	-	11.252
CA (VET)	8.4.0.24	31.2.5185	2007-10-04	-	1.690
ClamAV	0.91.2	4462	2007-10-04	-	2.245
Comodo	2.11	2.0.0.303	2007-09-04	-	2.105
Dr.WEB	4.33	2007.10.03	2007-10-03	DLOADER.Trojan	14.950
ewido	4.0.0.2	2007.10.03	2007-10-03	-	34.816
F-PROT	4.4.0.50	20070930	2007-09-30	-	4.328
F-SECURE	5.51.6100	2007.10.04.01	2007-10-04	-	9.299
IKARUS	T3.1.1.12	2007.10.03.69612	2007-10-03	suspicious(level 45)	3.426
MKS_VIR	2.01	2007.10.03	2007-10-03	-	11.565
NOD32	2.70.10	2570	2007-10-03	probably a variant of Win32/Genetik trojan	27.435
NORMAN	5.91.08	5.90	2007-10-03	-	43.427
nProtect	2007-10-04.00	962832	2007-10-04	-	43.632
QuickHeal	9.00	2007.10.03	2007-10-03	Suspicious - DNAScan	4.190
SOPHOS	2.49.1	4.21	2007-10-04	-	10.272
The Hacker	6.2.6	v00076	2007-10-02	-	15.435
VBA32	3.12.2.4	20071003.0509	2007-10-03	Backdoor.XiaoBird.2 (paranoid heuristics) (suspicious)	113.566
ViRobot	20071002	2007.10.02	2007-10-02	-	1.080
VirusBuster	4.3.19:9	9.107.6/11.0	2007-10-03	-	12.827
卡巴斯基	5.5.10	2007.10.04	2007-10-04	Trojan.Win32.Delf.ahg	1.081
江民杀毒	10.00.650	2007.09.30	2007-09-30	-	1.134
熊猫卫士	9.04.03.0001	2007.10.03	2007-10-03	-	11.155
瑞星	19.0	19.43.20.00	2007-10-03	-	7.775
赛门铁克	1.3.0.24	20071003.035	2007-10-03	-	0.416
趋势	8.500-1001	4.755.00	2007-10-02	-	1.077
迈克菲	5.2.00	5133	2007-10-03	-	8.453
金山毒霸	2007.6.20.249	2007.10.4	2007-10-04	-	1.698
飞塔	2.81-3.11	8.183	2007-10-03	Suspicious	13.626

注意: 就算报告发现病毒，也可能是杀软误报，请根据查毒结果自行判断

复制到剪贴板

[ 本帖最后由 绅博周幸 于 2007-10-4 16:20 编辑 ]

FBAV

MicroVita AntiSpyware  
_____________________________________________
                                          
             风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]                  
                   http://221.10.254.214/
----------------------------------------------
开始扫描……

正在检查启动……
[C:\Documents and Settings\Administrator\桌面\Virus\alqq\alqq.exe]
                    …………发现Spy！报告:[1]
文件信息:  大小:166912  MD5:81039bd0df1302dba202f7fbcb2a9baf

文件数:1   病毒数:1  比重:1
OK  扫描完毕！
  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎   
[2] 文件特征码引擎
[1] 文件启发式引擎

阿拉？

[ 本帖最后由 FBAV 于 2007-10-4 16:22 编辑 ]

king6808

检测到：木马程序 Trojan.Win32.Delf.ahg        URL: http://bbs.kafan.cn/attachment.p ... q.exe//PE-Crypt.PNH

Guanguancan

阿拉QQ大盗？

IllusionWing

啊拉qq大盗?

UGuard Log (Digital Fox - gankeyu@126.com)
UGuarduu.exe = 4.2.0
HC0.rlb = 2.8.9
HC2.rlb = 2.4.0
FN0.rlb = 2.3.1
扫描选项：扫描档案, 扩展, 忽略非活动, 忽略大文件, nFile, BAT模拟, 捆绑检测, 变形壳, 启发,
[扫描] [捆绑检测] 在 E:\Documents and Settings\Administrator\桌面\Vir\alqq.rar>>alqq.exe 检测到 Generic.Binder
检测到了 1 个未知的恶意程序，请上报。
任务 扫描 完成。共耗费的时间：0-00-00 00:00:00:0547，共扫描的文件数量：2，共扫描到的威胁数量：1，威胁率：0.5

Guanguancan

Attempt to create service
Attempt to set value Common Favorites within the key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\

taihuxian

卡巴斯基反病毒软件 7.0

The requested URL http://bbs.kafan.cn/attachment.php?aid=135211 is infected with Trojan.Win32.Delf.ahg virus

hahacomcn

Begin scan in 'C:\Documents and Settings\Administrator\桌面\alqq.rar'
C:\Documents and Settings\Administrator\桌面\alqq.rar
  [0] Archive type: RAR
  --> alqq.exe
      [DETECTION] Contains suspicious code HEUR/Crypted

微点卫士

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ALQQ.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ALL USERS.WINDOWS.0\FAVORITES\NETSERVICE.EXE
是否删除木马程序及其衍生物?

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 305
Paranoia Database - 6796
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\alqq.exe

C:\Documents and Settings\uhthn\Desktop\alqq.exe - Suspected MalwareDetector:Win32.Generic.PSW.1

1 Files scanned
0 Infected files found
1 Suspected files found
0 Files cured
0 Files deleted