14枚重磅炸弹

gzg

大家扫扫这 14枚重磅炸弹   呵呵~~~

FBAV

MicroVita AntiSpyware 100 C
_____________________________________________
                                          
             风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]                  
                   http://221.10.254.214/
----------------------------------------------
开始扫描……


正在检查启动……
[C:\Documents and Settings\Administrator\桌面\Virus\lianzhong_yahoo\Info_Ms.Sys]
                    …………发现Spy！报告:[8] HOOK者
文件信息:  大小:29769  MD5:58bf23c3f557a23f6c94ee9d04e982f4


[C:\Documents and Settings\Administrator\桌面\Virus\lianzhong_yahoo\Windows.scr]
                    …………发现Spy！报告: [4] [2]
文件信息:  大小:27183  MD5:b03cc7d64605a31016008cd8f44d8737


[C:\Documents and Settings\Administrator\桌面\Virus\lianzhong_yahoo\16.exe]
                    …………发现Spy！报告:[1]
文件信息:  大小:11295  MD5:740dbeb529920190db2fa936e58fd273


[C:\Documents and Settings\Administrator\桌面\Virus\lianzhong_yahoo\M1.exe]
                    …………发现Spy！报告:[2]
文件信息:  大小:26671  MD5:e580eea9f174fea0996eb0306f747a08


[C:\Documents and Settings\Administrator\桌面\Virus\lianzhong_yahoo\4.exe]
                    …………发现Spy！报告:[1]
文件信息:  大小:10271  MD5:26d6edc82be20112a795f393355d7003


[C:\Documents and Settings\Administrator\桌面\Virus\lianzhong_yahoo\WanPacket.dll]
                    …………发现Spy！报告:[2]
文件信息:  大小:61440  MD5:12aa2da30d1d2889511b4c1d14fb99b9


文件数:14   病毒数:6  比重:0.4285714285714
OK  扫描完毕！

  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎   
[2] 文件特征码引擎
[1] 文件启发式引擎

[ 本帖最后由 FBAV 于 2007-10-6 15:10 编辑 ]

微点卫士

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\LIANZHONG_YAHOO\4.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\CSDOOR0.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\LIANZHONG_YAHOO\16.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\CQDOOR0.DLL
是否删除木马程序及其衍生物?
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\LIANZHONG_YAHOO\LIANZHONG_YAHOO.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:1738
远端地址:60.191.101.147(浙江)
远端端口:80
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\LIANZHONG_YAHOO\LIANZHONG_YAHOO.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\NSKB.TMP\WMPNS.DLL
2) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\NSKB.TMP\SYSTEM.DLL
3) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\NSKB.TMP\SNPMW.DLL
4) C:\PROGRAM FILES\3721\CNSM.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\LIANZHONG_YAHOO\M1.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\ONLO0R.BAK
2) C:\PROGRAM FILES\INTERNET EXPLORER\ONLO0R.DLL
3) C:\PROGRAM FILES\COMMON FILES\FJOS0R.DLL
是否删除木马程序及其衍生物?

wangjay1980

deleted: Trojan program Trojan-PSW.Win32.OnLineGames.eez        File: C:\Documents and Settings\Owner\×ÀÃæ\lianzhong_yahoo.rar/Info_Ms.Sys
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.dys        File: C:\Documents and Settings\Owner\×ÀÃæ\lianzhong_yahoo.rar/Windows.scr//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-Clicker.HTML.IFrame.br        File: C:\Documents and Settings\Owner\×ÀÃæ\lianzhong_yahoo.rar/open_win.js

红心王子

2007-10-6        15:11:50        1191654710        Administrator        1284        Sign of "Win32:Delf-FWT [Trj]" has been found in "C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\XSXVZ5YW\lianzhong_yahoo[1].rar" file.  
2007-10-6        15:12:07        1191654727        Administrator        1284        Sign of "Win32:Delf-FWT [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\lianzhong_yahoo.rar" file.

FBAV

Trojan-Clicker.HTML.IFrame.br        ??
什么时候也报这个了

kkgh

AVG Anti-Spyware - 扫描报告
---------------------------------------------------------

+ 创建时间:        15:13:33 2007-10-6

+ 扫描结果:       



C:\Documents and Settings\zh\桌面\lianzhong_yahoo.rar/Windows.scr -> Downloader.Delf.chg : 已清除并备份(已隔离).

nosferatu

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\lianzhong_yahoo.rar'
C:\Documents and Settings\Administrator\桌面\lianzhong_yahoo.rar
      [DETECTION] Is the Trojan horse TR/Drop.Delf.aom
      [INFO]      The file was deleted!

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\lianzhong_yahoo.rar'
C:\Users\morgan\Documents\
  lianzhong_yahoo.rar
      [DETECTION] Is the Trojan horse TR/Drop.Delf.aom
      [WARNING]   The file was ignored!
    [0] Archive type: RAR
    --> Info_Ms.Sys
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> Windows.scr
        [DETECTION] Is the Trojan horse TR/Autorun.BK
        [WARNING]   Infected files in archives cannot be repaired!
    --> ~MY2.TMP
    --> MPRMSGSE.AXZ
    --> MSCPX32R.DET
    --> F7ON.DLL
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> lianzhong_yahoo.exe
    --> open_win.js
    --> 16.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> M1.exe
        [DETECTION] Is the Trojan horse TR/Autorun.BK
        [WARNING]   Infected files in archives cannot be repaired!
    --> 4.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> Packet.dll
    --> WanPacket.dll
    --> wpcap.dll
        [WARNING]   The file was ignored!


End of the scan: 2007年10月6日  00:38
Used time: 00:08 min

The scan has been done completely.

      0 Scanning directories
     15 Files were scanned
      5 viruses and/or unwanted programs were found
      2 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     10 Files not concerned
      1 Archives were scanned
      7 Warnings
      0 Notes

jimmyleo

这次antivir反到不报了