转剑盟的一个感染的[F972CA D23EFD]

promised

The EQs

在剑盟测试过了。。。就不测试了

微点卫士

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ABC\ICESWORD.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\COMMON FILES\SYSTEM\GDISERVER.EXE
2) C:\WINDOWS.0\SYSTEM32\GDISVC.EXE
是否删除木马程序及其衍生物?

木马名称:未知木马

程序:
C:\WINDOWS.0\SYSTEM32\GDISVC.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ABC\SETUP.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\COMMON FILES\SYSTEM\GDISERVER.EXE
2) C:\WINDOWS.0\SYSTEM32\GDISVC.EXE
是否删除木马程序及其衍生物?

IllusionWing

UGuard Log (Digital Fox - gankeyu@126.com)
UGuarduu.exe = 4.3.1
HC0.rlb = 2.9.1
HC2.rlb = 2.4.0
FN0.rlb = 2.3.1
扫描选项：扫描档案, 扩展, 忽略非活动, 忽略大文件, nFile, BAT模拟, 捆绑检测, 变形壳, 启发,
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\ABC\IceSword.exe//UPX//Crypt1 检测到 Generic.FTW.a
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\ABC\setup.exe//UPX//Crypt1 检测到 Generic.FTW.a
检测到了 2 个未知的恶意程序，请上报。
任务 扫描 完成。共耗费的时间：0-00-00 00:00:00:0370，共扫描的文件数量：6，共扫描到的威胁数量：2，威胁率：33.33%，扫描速率： 16.22 文件/秒，扫描速度： 767.57 千字节/秒

Nerazzurri

Starting the file scan:

Begin scan in 'F:\Documents and Settings\kafan\桌面\ABC.rar'
F:\Documents and Settings\kafan\桌面\ABC.rar
  [0] Archive type: RAR
  --> ABC\IceSword.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> ABC\setup.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [INFO]      The file was deleted!

woai_jolin

那个能清除

changzheng2

AVIRA C
Archive type: RAR
  --> ABC\IceSword.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> ABC\setup.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [INFO]      The file was deleted!

The scan has been done completely.

      0 Scanning directories
      3 Files were scanned
      0 viruses and/or unwanted programs were found
      2 Files were classified as suspicious:

平淡

红心王子

2007-10-5        16:24:14        1191572654        Administrator        2616        Sign of "Win32:VB-FGK [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\ABC.rar\ABC\IceSword.exe\[UPX]" file.  
2007-10-5        16:24:17        1191572657        Administrator        2616        Sign of "Win32:VB-FGK [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\ABC.rar\ABC\setup.exe\[UPX]" file.

timhas266

Starting the file scan:

Begin scan in 'C:\Documents and Settings\tim\桌面\ABC.rar'
C:\Documents and Settings\tim\桌面\ABC.rar
  [0] Archive type: RAR
  --> ABC\IceSword.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> ABC\setup.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [INFO]      A backup was created as '47490272.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!


End of the scan: Friday, 5 October, 2007  17:21
Used time: 00:02 min

The scan has been done completely.

      0 Scanning directories
      3 Files were scanned
      0 viruses and/or unwanted programs were found
      2 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes