一下载者及产物，vip.........[MD5: 32980B 2D3F03 42A0A6]

promised

promised

C:\ABC\vip.rar:\vip\long.exe - 可疑代码段 被发现 (Level: 30)
C:\ABC\vip.rar:\vip\net.exe - 特征码 'Packed.Win32.Klone.af' 被发现
C:\ABC\vip.rar:\vip\vip.exe - 可疑代码段 被发现 (Level: 150)
C:\ABC\vip.rar

        4 文件被扫描
          (1 压缩档 3 文件)
        1 特征码被侦测
        2 可疑代码段被发现
        耗时: 0:00.078

promised

F-PROT Antivirus version 6.2.1
FRISK Software International (C) Copyright 1989-2007

Engine version: 4.3.3.49
Virus signatures: 200710041535e63534e608f23b7de3e198c8eca81208
                  (C:\Documents and Settings\All Users.WINDOWS\Application Data\FRISK Software\F-PROT Antivirus for Windows\antivir.def)

[Clean]    C:\ABC\vip.rar:Zone.Identifier
[Found possible virus] <W32/Downloader-WebExe-based!Maximus (not disinfectable)>         C:\ABC\vip.rar->vip\long.exe
[Found possible virus] < (not disinfectable)>         C:\ABC\vip.rar->vip\net.exe->(NSPack)->(PE_Patch)
[Found possible virus] < (not disinfectable)>         C:\ABC\vip.rar->vip\vip.exe->(PecBundle)->(PECompact)
[Contains infected objects]        C:\ABC\vip.rar


Results:

Files: 2
Skipped files: 0
MBR/boot sectors checked: 0
Objects scanned: 5
Infected objects: 3
Files with errors: 0
Disinfected: 0

Running time: 00:01

killloop

江民0个

qigang

原帖由 killloop 于 2007-10-9 20:25 发表
江民0个

RX跟着江民走，呵呵！

wangjay1980

detected: Trojan program Trojan-Downloader.Win32.Tiny.nf        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\vip.rar/vip\long.exe
detected: virus Heur.Trojan.Generic        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\vip.rar/vip\vip.exe//PE_Patch.PECompact//PecBundle//PECompact//PE_Patch.MaskPE

The EQs

C:\Documents and Settings\Don johnson\桌面\vip.rar &raquo; RAR &raquo; vip\long.exe - probably unknown NewHeur_PE virus
C:\Documents and Settings\Don johnson\桌面\vip.rar &raquo; RAR &raquo; vip\net.exe - probably unknown NewHeur_PE virus
C:\Documents and Settings\Don johnson\桌面\vip.rar &raquo; RAR &raquo; vip\vip.exe - a variant of Win32/Delf.NDL worm

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 352
Paranoia Database - 7002
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\vip

C:\Documents and Settings\uhthn\Desktop\vip\long.exe - Suspected Trojan-Downloader.VB.1
C:\Documents and Settings\uhthn\Desktop\vip\net.exe - Suspected MalwareDetector:Trojan.Dialer.1
C:\Documents and Settings\uhthn\Desktop\vip\vip.exe - Suspected MalwareDetector:Win32.Generic.PSW.16

3 Files scanned
0 Infected files found
3 Suspected files found
0 Files cured
0 Files deleted

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\vip.rar'
C:\Users\morgan\Documents\
  vip.rar
    [0] Archive type: RAR
    --> vip\long.exe
        [DETECTION] Is the Trojan horse TR/Dldr.Tiny.NF
        [WARNING]   Infected files in archives cannot be repaired!
    --> vip\net.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> vip\vip.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!

欠妳緈諨

杀一个还是报壳