巴.江民.杀剩的

显示全部楼层 · 发表于 2007-10-21 18:12:11

下载http://www.91files.com/?07C93ZHNO1QYPHSY307Y

密码:1

显示全部楼层 · 发表于 2007-10-21 18:15:34

MicroVita AntiSpyware 100 C
_____________________________________________

         风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]
               http://221.10.254.214/
----------------------------------------------
开始扫描……

正在检查启动……
[C:\Documents and Settings\Administrator\桌面\Virus\0713(1)\000-1\weatherstudio(1).exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:545128  MD5:36bbc1057c619806e88fe34a6d576740

[C:\Documents and Settings\Administrator\桌面\Virus\0713(1)\000-1\jokes_en-gb.exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:535304  MD5:ff8a1b5c6bcf5e2b2afdb989b476f6f3

[C:\Documents and Settings\Administrator\桌面\Virus\0713(1)\000-1\jokes.exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:534616  MD5:5f4dd3768c5997446bfaed696a074f75

[C:\Documents and Settings\Administrator\桌面\Virus\0713(1)\000-1\yalive.dll]
                  …………发现Spy！报告:[2]
文件信息:  大小:142776  MD5:e5be98220d767edb0d35afdd9c7fe038

[C:\Documents and Settings\Administrator\桌面\Virus\0713(1)\000-1\ynotifier.dll]
                  …………发现Spy！报告:[2]
文件信息:  大小:105912  MD5:c96523e5ddf292e20f3677508ae64fb3

[C:\Documents and Settings\Administrator\桌面\Virus\0713(1)\000-1\yhelper.dll]
                  …………发现Spy！报告:[2]
文件信息:  大小:93624  MD5:352d8ef0d1b6b0d9199daa2285bcc91f

[C:\Documents and Settings\Administrator\桌面\Virus\0713(1)\000-1\bd.dll]
                  …………发现Spy！报告:[1]
文件信息:  大小:87490  MD5:7edaf119f578efdcdcac3dad5545265a

[C:\Documents and Settings\Administrator\桌面\Virus\0713(1)\000-1\yadfilter.dll]
                  …………发现Spy！报告:[1]
文件信息:  大小:56760  MD5:86181fe5581c2cc8003e30f450284924

[C:\Documents and Settings\Administrator\桌面\Virus\0713(1)\33333文件\download.exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:24576  MD5:6a66708aa6eb084b0be42a70657bd3e3

[C:\Documents and Settings\Administrator\桌面\Virus\0713(1)\33333文件\coding.exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:137480  MD5:9ebfd4db4b955f2958043213deb54d49

[C:\Documents and Settings\Administrator\桌面\Virus\0713(1)\33333文件\compress.exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:334416  MD5:206ed8a07236a4e033f9f06628c5910d

[C:\Documents and Settings\Administrator\桌面\Virus\0713(1)\33333文件\httptestgo.exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:15980  MD5:770bb69cb68152b388005af68341dd92

[C:\Documents and Settings\Administrator\桌面\Virus\0713(1)\33333文件\qq音乐地址获取_unpacked.exe]
                  …………发现Spy！报告:[1]
文件信息:  大小:103936  MD5:baadbc7ef064a518b0fd56dcdde8e2bc

[C:\Documents and Settings\Administrator\桌面\Virus\0713(1)\33333文件\msinet.ocx]
                  …………发现Spy！报告:[2]
文件信息:  大小:132880  MD5:90a39346e9b67f132ef133725c487ff6

[C:\Documents and Settings\Administrator\桌面\Virus\0713(1)\33333文件\folder.exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:124688  MD5:e8a2190a9e8ee5e5d2e0b599bbf9dda6

[C:\Documents and Settings\Administrator\桌面\Virus\0713(1)\33333文件\calc.exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:65536  MD5:6c9ef9842ebc18ae8371828b7bec7faa

[C:\Documents and Settings\Administrator\桌面\Virus\0713(1)\33333文件\file_diy.exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:72447  MD5:d927ba8c5c0fd7566574375a868eeeff

[C:\Documents and Settings\Administrator\桌面\Virus\0713(1)\33333文件\strchange.exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:19784  MD5:8874523985d27ffe2c260bf7dbef3a72

[C:\Documents and Settings\Administrator\桌面\Virus\0713(1)\33333文件\webser.exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:14308  MD5:22cb3988fd3a5d05fb91c95f5652f78d

文件数:66 病毒数:19  比重:0.2878787878788
OK  扫描完毕！
  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎
[2] 文件特征码引擎
[1] 文件启发式引擎

[ 本帖最后由 FBAV 于 2007-10-21 18:25 编辑 ]

显示全部楼层 · 发表于 2007-10-21 19:18:23

C:\ABC\0713(1)\000-1\addrsearch.dll
C:\ABC\0713(1)\000-1\amcap.exe
C:\ABC\0713(1)\000-1\bd.dll - 特征码 'Backdoor.Win32.Hupigon.dkl' 被发现
C:\ABC\0713(1)\000-1\cabuse(1).dll
C:\ABC\0713(1)\000-1\cabuse.dll
C:\ABC\0713(1)\000-1\hideinstaller.exe
C:\ABC\0713(1)\000-1\jokes.exe - 可疑代码段被发现 (Level: 20)
C:\ABC\0713(1)\000-1\jokes_en-gb.exe - 可疑代码段被发现 (Level: 20)
C:\ABC\0713(1)\000-1\liudodo.dll
C:\ABC\0713(1)\000-1\riched32.dll
C:\ABC\0713(1)\000-1\searchpack.dll
C:\ABC\0713(1)\000-1\sound.wav
C:\ABC\0713(1)\000-1\stillcap.exe
C:\ABC\0713(1)\000-1\vmcap.exe
C:\ABC\0713(1)\000-1\weatherstudio(1).exe - 可疑代码段被发现 (Level: 20)
C:\ABC\0713(1)\000-1\yadfilter.dll
C:\ABC\0713(1)\000-1\yalive.dll - 特征码 'AdWare.Win32.Boran.i' 被发现
C:\ABC\0713(1)\000-1\yasnoad.dll
C:\ABC\0713(1)\000-1\yassecblk.dll
C:\ABC\0713(1)\000-1\yassisres.dll
C:\ABC\0713(1)\000-1\yhelper.dll
C:\ABC\0713(1)\000-1\ynotifier.dll
C:\ABC\0713(1)\000-1\yrepair.dll
C:\ABC\0713(1)\000-1\yscrblock.dll
C:\ABC\0713(1)\000-1\ysettings.dll
C:\ABC\0713(1)\000-1\ywiper.dll
C:\ABC\0713(1)\071020\SearchPackMini.dll
C:\ABC\0713(1)\111-1\avk.exe - 可疑代码段被发现 (Level: 120)
C:\ABC\0713(1)\33333文件\(1)crack.exe - 特征码 'Packed.Win32.Klone.af' 被发现
C:\ABC\0713(1)\33333文件\actskin4.ocx
C:\ABC\0713(1)\33333文件\autodetect.exe
C:\ABC\0713(1)\33333文件\boxmain.exe - 特征码 'Packed.Win32.Klone.af' 被发现
C:\ABC\0713(1)\33333文件\boxmain无图版本.exe - 特征码 'Packed.Win32.Klone.af' 被发现
C:\ABC\0713(1)\33333文件\byshell.exe
C:\ABC\0713(1)\33333文件\calc.exe
C:\ABC\0713(1)\33333文件\coding.exe - 特征码 'Packed.Win32.Klone.af' 被发现
C:\ABC\0713(1)\33333文件\compress.exe - 特征码 'Packed.Win32.Klone.af' 被发现
C:\ABC\0713(1)\33333文件\download.exe
C:\ABC\0713(1)\33333文件\file_diy.exe - 特征码 'Packed.Win32.Klone.af' 被发现
C:\ABC\0713(1)\33333文件\folder.exe
C:\ABC\0713(1)\33333文件\folderdecrypt.exe
C:\ABC\0713(1)\33333文件\httptestgo.exe - 特征码 'Packed.Win32.Klone.af' 被发现
C:\ABC\0713(1)\33333文件\md5.dll - 可疑代码段被发现 (Level: 25)
C:\ABC\0713(1)\33333文件\msclib.dll
C:\ABC\0713(1)\33333文件\msinet.ocx
C:\ABC\0713(1)\33333文件\qq音乐地址获取_unpacked.exe - 特征码 'MalwareScope.Backdoor.Hupigon.1' 被发现
C:\ABC\0713(1)\33333文件\richtx32.ocx
C:\ABC\0713(1)\33333文件\rigaga.exe - 可疑代码段被发现 (Level: 190)
C:\ABC\0713(1)\33333文件\setupex.exe - 特征码 'Trojan-Downloader.Win32.Agent.bes' 被发现
C:\ABC\0713(1)\33333文件\sql_shellcmd.exe - 特征码 'Packed.Win32.Klone.af' 被发现
C:\ABC\0713(1)\33333文件\strchange.exe - 特征码 'Packed.Win32.Klone.af' 被发现
C:\ABC\0713(1)\33333文件\tabctl32.ocx
C:\ABC\0713(1)\33333文件\webser.exe - 特征码 'Packed.Win32.Klone.af' 被发现
C:\ABC\0713(1)\33333文件\wmtimeprodrv.sys
C:\ABC\0713(1)\33333文件\wpe.dll - 可疑代码段被发现 (Level: 10)
C:\ABC\0713(1)\33333文件\wsihk32.dll
C:\ABC\0713(1)\33333文件\wsiwin32.dll
C:\ABC\0713(1)\33333文件\yfdnetmenu.ocx
C:\ABC\0713(1)\33333文件\yulvwep.exe - 特征码 'Packed.Win32.Klone.af' 被发现
C:\ABC\0713(1)\33333文件\yulv_sqltools.exe - 特征码 'Packed.Win32.Klone.af' 被发现
C:\ABC\0713(1)\444\mfc42.exe
C:\ABC\0713(1)\444\searchwebupdater.exe
C:\ABC\0713(1)\444\sysinfo.exe
C:\ABC\0713(1)\444\usbvm31b.sys
C:\ABC\0713(1)\444\userinit.exe
C:\ABC\0713(1)\444\vm31bprp.ax

66 文件被扫描
(0 压缩档 0 文件)
16 特征码被侦测
7 可疑代码段被发现
耗时: 0:16.047

显示全部楼层 · 发表于 2007-10-21 19:20:36

下载超级慢的说。

显示全部楼层 · 发表于 2007-10-21 19:38:55

还是有很多遗留下来的

2007-10-21 19:38:23 1192966703 Administrator 3720 Sign of "Win32:Adware-gen [Adw]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹\000-1\weatherstudio(1).exe\$INSTDIR\bin\$PLUGINSDIR\NSISdl.dll" file.
2007-10-21 19:38:29 1192966709 Administrator 3720 Sign of "Win32:Adware-gen [Adw]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹\000-1\jokes_en-gb.exe\$INSTDIR\bin\$PLUGINSDIR\NSISdl.dll" file.
2007-10-21 19:38:29 1192966709 Administrator 3720 Sign of "Win32:Adware-gen [Adw]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹\000-1\jokes_en-gb.exe\$INSTDIR\bin\dlls\jokester.dll" file.
2007-10-21 19:38:29 1192966709 Administrator 3720 Sign of "Win32:Adware-gen [Adw]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹\000-1\jokes.exe\$INSTDIR\bin\$PLUGINSDIR\NSISdl.dll" file.
2007-10-21 19:38:30 1192966710 Administrator 3720 Sign of "Win32:Adware-gen [Adw]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹\000-1\jokes.exe\$INSTDIR\bin\dlls\jokester.dll" file.
2007-10-21 19:38:30 1192966710 Administrator 3720 Sign of "Win32:Adware-gen [Adw]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹\000-1\yrepair.dll\[Embedded#34ab8]\[Embedded#5a60]" file.
2007-10-21 19:38:31 1192966711 Administrator 3720 Sign of "Win32:Agent-JVZ [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹\000-1\bd.dll\[NsPack]" file.
2007-10-21 19:38:34 1192966714 Administrator 3720 Sign of "Win32:VB-AQV [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹\33333文件\file_diy.exe\[NsPack]\[Embedded#BIND]\[ASPack]" file.

显示全部楼层 · 发表于 2007-10-22 01:00:37

End of the scan: 2007年10月21日  10:00
Used time: 00:08 min

The scan has been done completely.

   6 Scanning directories
   66 Files were scanned
   7 viruses and/or unwanted programs were found
   4 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   11 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   59 Files not concerned
   0 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-10-22 09:19:11

Hello,

(1)crack.exe_, 1.dll, actskin4.ocx, addrsearch.dll, amcap.exe_, autodetect.exe_, AUTORUN.inf1, avk.exe_, bd.dll, boxmain+=.exe_, boxmain.exe_, byshell.exe_, cabuse(1).dll, cabuse.dll, calc.exe_, cj_236.exe_, coding.exe_, compress.exe_, DAEMON_MGM.exe_, download.exe_, file_diy.exe_, folder.exe_, folderdecrypt.exe_, httptestgo.exe_, Internet.lnk, lcyl.exe_, liudodo.dll, md5.dll, mfc42.exe_, msclib(1).dll, msclib.dll, msinet.ocx, NETMONINSTALLER.exe_, NPF_MGM.exe_, qqTL+L_unpacked.exe_, riched32.dll, richtx32.ocx, rigaga.exe_, RPCAPD.exe_, searchpack.dll, Setup(1).exe_, setupex.exe_, sql_shellcmd.exe_, stillcap.exe_, strchange.exe_, sysinfo.exe_, tabctl32.ocx, usbvm31b.sys, userinit.exe_, vm31bprp.ax, vmcap.exe_, webser.exe_, wmtimeprodrv.sys, wpe.dll, wsihk32.dll, wsiwin32.dll, yadfilter.dll, yalive.dll, yasnoad.dll, yassecblk.dll, yassisres.dll, yfdnetmenu.ocx, yhelper.dll, ynotifier.dll, yrepair.dll, yscrblock.dll, ysettings.dll, yulvwep.exe_, yulv_sqltools.exe_, ywiper.dll

No malicious code were found in these files.

显示全部楼层 · 发表于 2007-10-22 19:16:08

hideinstaller.exe_ - not-a-virus:AdWare.Win32.Agent.qe,
jokes.exe_ - not-a-virus:AdWare.Win32.Comet.bm,
jokes_en-gb.exe_ - not-a-virus:AdWare.Win32.Comet.bn,
SearchPackMini.dll - not-a-virus:AdWare.Win32.Agent.qh,
searchwebupdater.exe_ - not-a-virus:AdWare.Win32.Agent.qf,
weatherstudio(1).exe_ - not-a-virus:AdWare.Win32.Comet.bo

[病毒样本] 巴.江民.杀剩的

浏览过的版块