费尔和卡巴杀生下的

鱼是一只我

大家看看，还能作恶吧？
第二个全，试试看

怎么会是正常程序呢？绝对是病毒建立的东西
这几个进程我kill了又建立，然后再kill
看ICESWORD 看到，互相建立进程，
绝对不是正常程序

[ 本帖最后由 鱼是一只我 于 2007-10-26 19:44 编辑 ]

nosferatu

avira found nothing

googlehack

居然都没有发先病毒！那么多exe文件，竟没有病毒？？

remind_me

楼主。。全部都是正常程序……  

鱼是一只我

绝对不是正常的文件
我看着这些程序之间互相加载，kill了这个建立那个，kill了那个建立这个
还有个.com文件，没有找到，参与之间的建立，但那时.com不在进程里，而且找不到，结果，全部kill后，过一会又建立

鱼是一只我

至少这里，看出卡巴就是有问题，查到病毒，不能清除，原因居然是不能备份，提示：磁盘已满等
最后用绿色版的drweb杀掉

鱼是一只我

至于为什么杀软都不管，就不知道为什么了，是不是这些东西单独不会做恶

qianwenxiang

那些net1.exe,net.exe,wdfmgr,mshta,sc什么的应该是系统文件，估计是病毒调用他们下载东西的


Scan Started Fri Oct 26 20:22:22 2007
-------------------------------------------------------------------------------


C:\Test\1026\severe1\mqhaym.dll: Trojan.QQPass-101 FOUND
----------- SCAN SUMMARY -----------
Known viruses: 161241
Engine version: 0.91.1
Scanned directories: 1
Scanned files: 17
Skipped non-executable files: 0
Infected files: 1

Data scanned: 0.63 MB
Time: 6.531 sec (0 m 6 s)
--------------------------------------
Completed
--------------------------------------

clamav的结果

wangjay1980

detected: Trojan program Trojan-PSW.Win32.QQPass.uv        File: C:\Documents and Settings\Owner\×ÀÃæ\severe.rar/severe.exe//UPack
detected: Trojan program Trojan-PSW.Win32.QQPass.uv        File: C:\Documents and Settings\Owner\×ÀÃæ\severe.rar/mqhaym.exe//UPack
detected: Trojan program Trojan-PSW.Win32.QQPass.uv        File: C:\Documents and Settings\Owner\×ÀÃæ\severe.rar/mqhaym.dll
detected: Trojan program Trojan-PSW.Win32.QQPass.uv        File: C:\Documents and Settings\Owner\×ÀÃæ\severe.rar/OSO.exe//UPack
detected: Trojan program Trojan-PSW.Win32.QQPass.uv        File: C:\Documents and Settings\Owner\×ÀÃæ\severe.rar/ÃÀÅ®ÓÎÏ·.pif//UPack
detected: Trojan program Trojan-PSW.Win32.QQPass.uv        File: C:\Documents and Settings\Owner\×ÀÃæ\severe.rar/ÖØÒª×ÊÁÏ.exe//UPack

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\severe.rar'
C:\Users\morgan\Documents\
  severe.rar
    [0] Archive type: RAR
    --> severe.exe
        [DETECTION] Is the Trojan horse TR/PSW.QQpass.UV.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> mqhaym.exe
        [DETECTION] Is the Trojan horse TR/PSW.QQpass.UV.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> mqhaym.dll
        [DETECTION] Is the Trojan horse TR/PSW.QQpass.UV
        [WARNING]   Infected files in archives cannot be repaired!
    --> wdfmgr.exe
    --> net1.exe
    --> net.exe
    --> sc.exe
    --> mshta.exe
    --> autorun.inf
        [DETECTION] Is the Trojan horse TR/Autorun.EU
        [WARNING]   Infected files in archives cannot be repaired!
    --> OSO.exe
        [DETECTION] Is the Trojan horse TR/PSW.QQpass.UV.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> ÃÀÅ®ÓÎÏ·.pif
        [DETECTION] Is the Trojan horse TR/PSW.QQpass.UV.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> ÖØÒª×ÊÁÏ.exe
        [DETECTION] Is the Trojan horse TR/PSW.QQpass.UV.1
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!
Begin scan in 'C:\Users\morgan\Documents\severe1.rar'
C:\Users\morgan\Documents\
  severe1.rar
    [0] Archive type: RAR
    --> severe\mshta.exe
    --> severe\net.exe
    --> severe\net1.exe
    --> severe\sc.exe
    --> severe\wdfmgr.exe


End of the scan: 2007年10月26日  17:33
Used time: 00:05 min

The scan has been done completely.

      0 Scanning directories
     19 Files were scanned
      7 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     12 Files not concerned
      2 Archives were scanned
      7 Warnings
      0 Notes