30ge[MD5略]

wangjay1980

如题，卡巴全杀，试试你的

mofunzone

又是mminstall，什么时候支持nsis呀。。
Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\30.rar'
C:\Users\morgan\Documents\
  30.rar
    [0] Archive type: RAR
    --> tempO.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
        [WARNING]   Infected files in archives cannot be repaired!
    --> zt.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> 0.exe
        [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 1(1).exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 1(4)(1).exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
        [WARNING]   Infected files in archives cannot be repaired!
    --> 2.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 02jh.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
        [WARNING]   Infected files in archives cannot be repaired!
    --> 3(1)(1)(2).exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> 3(1)(1).exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> 4(1)(2).exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> 4.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> 5.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 6.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 7(2)(1)(1).exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 7.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 8.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 9.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 10.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 11.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 12.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 13.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 14.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> 15.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> menghuan1.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
        [WARNING]   Infected files in archives cannot be repaired!
    --> menghuan.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> mh(1).exe
        [DETECTION] Is the Trojan horse TR/PSW.LdPinch.jm1
        [WARNING]   Infected files in archives cannot be repaired!
    --> mminstall.exe
    --> qiji.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> qjsj.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> smss.exe
        [DETECTION] Is the Trojan horse TR/Agent.2596
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!


End of the scan: 2007年10月8日  00:23
Used time: 00:05 min

The scan has been done completely.

      0 Scanning directories
     31 Files were scanned
     20 viruses and/or unwanted programs were found
      9 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     11 Files not concerned
      1 Archives were scanned
     30 Warnings
      0 Notes

啊弥陀佛

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\1(1).EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\MHDOOR0.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\1(4)(1).EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\SQMAPI32.DLL
是否删除木马程序及其衍生物?


程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\2.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\WODOOR0.DLL
是否删除木马程序及其衍生物?


程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\02JH.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\MSEAM.SYS
2) C:\WINDOWS\SYSTEM32\QDSHM.DLL
是否删除木马程序及其衍生物?


程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\3(1)(1)(2).EXE
1) C:\DFD6790937.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?


程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\3(1)(1).EXE
1) C:\DFD6813109.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?


程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\4(1)(2).EXE
1) C:\DFD6825640.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?


程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\4.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\CSDOOR0.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\5.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\WLDOOR0.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\6.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\WGDOOR0.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\7(2)(1)(1).EXE
木马程序生成以下文件:
1) C:\WINDOWS\GENPROTECT.EXE
2) C:\WINDOWS\SYSTEM32\GENPROTECT.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\7.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\DADOOR0.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\8.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\DH3OOR0.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\9.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\QJDOOR0.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\10.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\RXDOOR0.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\11.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\WDDOOR0.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\12.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\TLDOOR0.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\13.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\ZXDOOR0.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\14.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\MYDOOR0.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\15.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\QHDOOR0.DLL
是否删除木马程序及其衍生物?


程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\MENGHUAN1.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\MSSOCK.SYS
2) C:\WINDOWS\SYSTEM32\QDSHM.DLL
是否删除木马程序及其衍生物?


程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\MENGHUAN.EXE
1) C:\DFD7269953.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?


程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\MH(1).EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\MH1002.EXE
2) C:\WINDOWS\SYSTEM32\XYUPRI0.DLL
是否删除木马程序及其衍生物?


C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAQJBPI.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAQJBPI.DLL
是否删除木马程序及其衍生物?


程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\QJSJ.EXE
1) C:\DFD7695375.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?


程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\SMSS.EXE
是否删除病毒程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\TEMPO.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\SQMAPI32.DLL
是否删除木马程序及其衍生物?


程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\30\ZT.EXE
1) C:\DFD7739125.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?

solcroft

mminstall是nsis？

swjken

学习的好机会 貌似这个病毒没见过呢`

wangjay1980

呵呵

mofunzone

确实不是nsis，upx修改壳脱掉修复后是Microsoft Visual C++ 6.0写的

BING126

扫描开始时间: 2007-10-8 16:24:58
扫描日志
NOD32 版本 2577 (20071008) NT
命令行: C:\Documents and Settings\Administrator\桌面\30.rar

日期: 2007年10月8日  时间: 16:25:00
反 Rookits 技术已启用。
已扫描磁盘、文件夹和文件: C:\Documents and Settings\Administrator\桌面\30.rar
C:\Documents and Settings\Administrator\桌面\30.rar ?RAR ?zt.exe<病毒 - 可能是 Win32/Genetik 木马 变种>
C:\Documents and Settings\Administrator\桌面\30.rar ?RAR ?0.exe<病毒 - 可能是 Win32/PSW.Delf.NHI 木马 变种>
C:\Documents and Settings\Administrator\桌面\30.rar ?RAR ?1(1).exe<病毒 - Win32/PSW.OnLineGames.NFN 木马 变种>
C:\Documents and Settings\Administrator\桌面\30.rar ?RAR ?2.exe<病毒 - Win32/PSW.OnLineGames.NFN 木马 变种>
C:\Documents and Settings\Administrator\桌面\30.rar ?RAR ?3(1)(1)(2).exe<病毒 - 可能是 Win32/Genetik 木马 变种>
C:\Documents and Settings\Administrator\桌面\30.rar ?RAR ?3(1)(1).exe<病毒 - 可能是 Win32/Genetik 木马 变种>
C:\Documents and Settings\Administrator\桌面\30.rar ?RAR ?4(1)(2).exe<病毒 - 可能是 Win32/Genetik 木马 变种>
C:\Documents and Settings\Administrator\桌面\30.rar ?RAR ?4.exe<病毒 - Win32/PSW.OnLineGames.NFN 木马 变种>
C:\Documents and Settings\Administrator\桌面\30.rar ?RAR ?5.exe<病毒 - Win32/PSW.OnLineGames.NFN 木马 变种>
C:\Documents and Settings\Administrator\桌面\30.rar ?RAR ?6.exe<病毒 - Win32/PSW.OnLineGames.NFN 木马 变种>
C:\Documents and Settings\Administrator\桌面\30.rar ?RAR ?7(2)(1)(1).exe<病毒 - Win32/PSW.OnLineGames.NFL 木马 变种>
C:\Documents and Settings\Administrator\桌面\30.rar ?RAR ?7.exe<病毒 - Win32/PSW.OnLineGames.NFN 木马 变种>
C:\Documents and Settings\Administrator\桌面\30.rar ?RAR ?8.exe<病毒 - Win32/PSW.OnLineGames.NFN 木马 变种>
C:\Documents and Settings\Administrator\桌面\30.rar ?RAR ?9.exe<病毒 - Win32/PSW.OnLineGames.NFN 木马 变种>
C:\Documents and Settings\Administrator\桌面\30.rar ?RAR ?10.exe<病毒 - Win32/PSW.OnLineGames.NFN 木马 变种>
C:\Documents and Settings\Administrator\桌面\30.rar ?RAR ?11.exe<病毒 - Win32/PSW.OnLineGames.NFN 木马 变种>
C:\Documents and Settings\Administrator\桌面\30.rar ?RAR ?12.exe<病毒 - Win32/PSW.OnLineGames.NFN 木马 变种>
C:\Documents and Settings\Administrator\桌面\30.rar ?RAR ?13.exe<病毒 - Win32/PSW.OnLineGames.NFN 木马 变种>
C:\Documents and Settings\Administrator\桌面\30.rar ?RAR ?14.exe<病毒 - Win32/PSW.OnLineGames.NFN 木马 变种>
C:\Documents and Settings\Administrator\桌面\30.rar ?RAR ?15.exe<病毒 - Win32/PSW.OnLineGames.NFN 木马 变种>
C:\Documents and Settings\Administrator\桌面\30.rar ?RAR ?menghuan.exe<病毒 - 可能是 Win32/Genetik 木马 变种>
C:\Documents and Settings\Administrator\桌面\30.rar ?RAR ?mh(1).exe<病毒 - Win32/PSW.OnLineGames.NFN 木马 变种>
C:\Documents and Settings\Administrator\桌面\30.rar ?RAR ?mminstall.exe<病毒 - 可能是 Win32/Genetik 木马 变种>
C:\Documents and Settings\Administrator\桌面\30.rar ?RAR ?qjsj.exe<病毒 - 可能是 Win32/Genetik 木马 变种>
已扫描文件数量: 30
已发现病毒数量: 24
完成时间: 16:25:07 总共扫描时间: 7 秒 (00:00:07)

欠妳緈諨

AVAST杀 18

impp123

你这个是什么是病毒吗
NOD32查出24个 F-Secure一个没查出为什么