5个[MD5: 2CD6C5 BCAA09 1CCDCE 60E63F D8786A]

promised

睡觉去了

promised

C:\ABC\样本1.rar:\logo.exe\2.vbs
C:\ABC\样本1.rar:\logo.exe\2.exe - 特征码 'Packed.Win32.Klone.af' 被发现
C:\ABC\样本1.rar:\logo.exe\2.bat
C:\ABC\样本1.rar:\logo.exe - 可疑代码段 被发现 (Level: 95)
C:\ABC\样本1.rar:\e.exe - 特征码 'Backdoor.Win32.Delf.MS' 被发现
C:\ABC\样本1.rar:\grldr.com - 特征码 'Packed.Win32.Klone.af' 被发现
C:\ABC\样本1.rar:\3A164BDB8EB1.dll - 特征码 'Trojan.Popwin.R' 被发现
C:\ABC\样本1.rar:\no.exe - 特征码 'Trojan.Popwin.R' 被发现
C:\ABC\样本1.rar

        9 文件被扫描
          (1 压缩档 8 文件)
        5 特征码被侦测
        1 可疑代码段被发现
        耗时: 0:02.610


F-PROT Antivirus version 6.2.1
FRISK Software International (C) Copyright 1989-2007

Engine version: 4.3.3.49
Virus signatures: 200710041535e63534e608f23b7de3e198c8eca81208
                  (C:\Documents and Settings\All Users.WINDOWS\Application Data\FRISK Software\F-PROT Antivirus for Windows\antivir.def)

[Clean]    C:\ABC\样本1.rar->logo.exe->(RAR)->2.vbs
[Found possible virus] < (damaged, not disinfectable)>         C:\ABC\样本1.rar->logo.exe->(RAR)->2.exe->(NSPack)->(PE_Patch)
[Clean]    C:\ABC\样本1.rar->logo.exe->(RAR)->2.bat
[Found possible virus] <W32/Threat-HLLIN-Slipper-based!Maximus (not disinfectable)>         C:\ABC\样本1.rar->e.exe
[Found possible virus] < (damaged, not disinfectable)>         C:\ABC\样本1.rar->grldr.com->(NSPack)->(PE_Patch)
[Clean]    C:\ABC\样本1.rar->3A164BDB8EB1.dll->(BeRo)
[Clean]    C:\ABC\样本1.rar->no.exe->(BeRo)
[Contains infected objects]        C:\ABC\样本1.rar

The EQs

F-prot当个查壳工具蛮好的。。。。不知道能查多少壳

C:\Documents and Settings\Don johnson\桌面\样本1.rar &raquo; RAR &raquo; logo.exe &raquo; RAR &raquo; 2.exe - probably a variant of Win32/TrojanDownloader.Delf.NSA trojan
C:\Documents and Settings\Don johnson\桌面\样本1.rar &raquo; RAR &raquo; logo.exe &raquo; RAR &raquo; 2.bat - BAT/KillAV.EC trojan
C:\Documents and Settings\Don johnson\桌面\样本1.rar &raquo; RAR &raquo; e.exe - probably a variant of Win32/TrojanDownloader.Delf.NSA trojan
C:\Documents and Settings\Don johnson\桌面\样本1.rar &raquo; RAR &raquo; grldr.com - probably a variant of Win32/TrojanDownloader.Delf.NSA trojan
C:\Documents and Settings\Don johnson\桌面\样本1.rar &raquo; RAR &raquo; 3A164BDB8EB1.dll - a variant of Win32/PSW.OnLineGames.NFF trojan
C:\Documents and Settings\Don johnson\桌面\样本1.rar &raquo; RAR &raquo; no.exe - a variant of Win32/PSW.OnLineGames.NFF trojan

wangjay1980

niu x

capsshift

红伞报了好多个。
Starting the file scan:

Begin scan in 'C:\Users\lenovo\Pictures\样本1.rar'
C:\Users\lenovo\Pictures\样本1.rar
  [0] Archive type: RAR
  --> logo.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [1] Archive type: RAR SFX (self extracting)
      --> 2.exe
          [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      --> 2.bat
          [DETECTION] Contains detection pattern of the batch virus BAT/Zyfore.AB
  --> e.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> grldr.com
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 3A164BDB8EB1.dll
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> no.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '473cef69.qua'!

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.DL.Win32.Agent.bds
病毒： Trojan.DL.Win32.Inject.l

MAC地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：19.44.12

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 352
Paranoia Database - 7002
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder (2)

C:\Documents and Settings\uhthn\Desktop\New Folder (2)\logo.exe - OK
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\e.exe - OK
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\grldr.com - Suspected MalwareDetector:Trojan-Downloader.Delf.1
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\3A164BDB8EB1.dll - OK
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\no.exe - OK

5 Files scanned
0 Infected files found
1 Suspected files found
0 Files cured
0 Files deleted

欠妳緈諨