small.tmo下载的

显示全部楼层 · 发表于 2007-10-27 13:48:26

6个

显示全部楼层 · 发表于 2007-10-27 13:51:27

UGuard Log (Digital Fox - gankeyu@126.com)
UGuarduu.exe = 4.3.1
HC0.rlb = 2.9.1
HC2.rlb = 2.4.0
FN0.rlb = 2.3.1
扫描选项：扫描档案, 扩展, 忽略非活动, 忽略大文件, nFile, BAT模拟, 捆绑检测, 变形壳, 启发,
[扫描] [变形壳检测] 在 C:\Users\干孟泽\Downloads\10272\gyntmvohn.exe 检测到 Packed.Generic.Modified
[扫描] [Level 2] 在 C:\Users\干孟泽\Downloads\10272\setup.exe>>WebSpyShield.exe 检测到 Script.JSPack
[扫描] [变形壳检测] 在 C:\Users\干孟泽\Downloads\10272\zdfyax.exe 检测到 Packed.Generic.Modified
检测到了 2 个未知的恶意程序，请上报。
任务扫描完成。共耗费的时间：0-00-00 00:00:04:0446，共扫描的文件数量：11，共扫描到的威胁数量：3，威胁率：27.27%，扫描速率： 2.47 文件/秒，扫描速度： 282.41 千字节/秒，共扫描了 1255.58 千字节。
..

显示全部楼层 · 发表于 2007-10-27 13:52:33

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\10272.rar'
C:\Users\morgan\Documents\
  10272.rar
[0] Archive type: RAR
--> setup.exe
      [DETECTION] Is the Trojan horse TR/Fake.WebSpyShi.A
      [WARNING] Infected files in archives cannot be repaired!
--> zdfyax.exe
      [DETECTION] Is the Trojan horse TR/Tiny.705
      [WARNING] Infected files in archives cannot be repaired!
--> xvydwpm.exe
      [DETECTION] Is the Trojan horse TR/Hijack.Explor.767
      [WARNING] Infected files in archives cannot be repaired!
--> vgjohlebd.exe
      [DETECTION] Is the Trojan horse TR/Clicker.AFS
      [WARNING] Infected files in archives cannot be repaired!
--> gyntmvohn.exe
      [DETECTION] Is the Trojan horse TR/Tiny.705
      [WARNING] Infected files in archives cannot be repaired!
--> privacykit_setup.exe
      [WARNING] The file was ignored!

End of the scan: 2007年10月26日  22:52
Used time: 00:05 min

The scan has been done completely.

   0 Scanning directories
   7 Files were scanned
   5 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   1 Archives were scanned
   6 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-10-27 14:08:13

Result: 1 malware found
Trojan.Win32.Inject.iq (virus)
C:\Users\Administrator\Desktop\10272.rar\vgjohlebd.exe

显示全部楼层 · 发表于 2007-10-27 14:44:36

2007-10-27 14:43:41 1193467421 Administrator 2112 Sign of "Win32:Tiny-II [Trj]" has been found in "D:\Downloads\10272.rar\zdfyax.exe" file.
2007-10-27 14:43:44 1193467424 Administrator 2112 Sign of "Win32:Tiny-II [Trj]" has been found in "D:\Downloads\10272.rar\gyntmvohn.exe" file.
avast和红伞报的名字基本一致都是Tiny
估计入库的特征码是一样。。

显示全部楼层 · 发表于 2007-10-27 14:47:54

MicroVita AntiSpyware 100 C
_____________________________________________

         风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]
               http://221.10.254.214/
----------------------------------------------
开始扫描……

正在检查启动……
[C:\Documents and Settings\Administrator\桌面\Virus\10272\zdfyax.exe]
                  …………发现Spy！报告:[1]
文件信息:  大小:705  MD5:102ff59f4530e084005a2e04b768e9c1

[C:\Documents and Settings\Administrator\桌面\Virus\10272\gyntmvohn.exe]
                  …………发现Spy！报告:[1]
文件信息:  大小:705  MD5:102ff59f4530e084005a2e04b768e9c1

文件数:6 病毒数:2  比重:0.3333333333333
OK  扫描完毕！

  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎
[2] 文件特征码引擎
[1] 文件启发式引擎

显示全部楼层 · 发表于 2007-10-27 15:02:26

已扫描的磁盘，文件夹及文件：C:\Documents and Settings\zh\桌面\10272.rar
C:\Documents and Settings\zh\桌面\10272.rar >>RAR >>setup.exe >>NSIS >>Entries.bin - 是正常的
C:\Documents and Settings\zh\桌面\10272.rar >>RAR >>setup.exe >>NSIS >>Strings.txt - 是正常的
C:\Documents and Settings\zh\桌面\10272.rar >>RAR >>setup.exe >>NSIS >>WebSpyShield.exe - 是正常的
C:\Documents and Settings\zh\桌面\10272.rar >>RAR >>setup.exe >>NSIS >>WebSpyShield.dll - 是正常的
C:\Documents and Settings\zh\桌面\10272.rar >>RAR >>setup.exe >>NSIS >>Uninstall.exe >>NSIS >>Entries.bin - 是正常的
C:\Documents and Settings\zh\桌面\10272.rar >>RAR >>setup.exe >>NSIS >>Uninstall.exe >>NSIS >>Strings.txt - 是正常的
C:\Documents and Settings\zh\桌面\10272.rar >>RAR >>setup.exe >>NSIS >>Uninstall.exe >>NSIS >>System.dll - 是正常的
C:\Documents and Settings\zh\桌面\10272.rar >>RAR >>zdfyax.exe - 可能是 Win32/Agent 木马的一个变种
C:\Documents and Settings\zh\桌面\10272.rar >>RAR >>xvydwpm.exe >>UPX v12_m2 - 是正常的
C:\Documents and Settings\zh\桌面\10272.rar >>RAR >>vgjohlebd.exe - Win32/TrojanDownloader.Injecter.NAA 木马
C:\Documents and Settings\zh\桌面\10272.rar >>RAR >>gyntmvohn.exe - 可能是 Win32/Agent 木马的一个变种
C:\Documents and Settings\zh\桌面\10272.rar >>RAR >>privacykit_setup.exe >>NSIS >>Entries.bin - 是正常的
C:\Documents and Settings\zh\桌面\10272.rar >>RAR >>privacykit_setup.exe >>NSIS >>Strings.txt - 是正常的
C:\Documents and Settings\zh\桌面\10272.rar >>RAR >>privacykit_setup.exe >>NSIS >>PrivacyKit.exe - 是正常的
C:\Documents and Settings\zh\桌面\10272.rar >>RAR >>privacykit_setup.exe >>NSIS >>Uninstall.exe >>NSIS >>Entries.bin - 是正常的
C:\Documents and Settings\zh\桌面\10272.rar >>RAR >>privacykit_setup.exe >>NSIS >>Uninstall.exe >>NSIS >>Strings.txt - 是正常的
C:\Documents and Settings\zh\桌面\10272.rar >>RAR >>privacykit_setup.exe >>NSIS >>Uninstall.exe >>NSIS >>System.dll - 是正常的
C:\Documents and Settings\zh\桌面\10272.rar - 多重感染 - 已隔离 - 已删除
已扫描的文件数目：18
已发现的病毒数目：3
已清除病毒的文件数目：1
完成时间： 15:02:48 总扫描时间：12 秒 (00:00:12)

显示全部楼层 · 发表于 2007-10-27 15:06:20

deleted: virus Heur.Trojan.Generic (modification) File: C:\Users\Jack Jones\Desktop\10272.rar/xvydwpm.exe//PE_Patch.UPX
deleted: Trojan program Trojan.Win32.Inject.iq File: C:\Users\Jack Jones\Desktop\10272.rar/vgjohlebd.exe

显示全部楼层 · 发表于 2007-10-27 19:50:17

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Win32.Agent.zyx
病毒： Trojan.DL.Win32.Agent.ztk

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.15.52

显示全部楼层 · 发表于 2007-10-28 10:38:43

毒霸报三个.

[病毒样本] small.tmo下载的

本帖子中包含更多资源

12/2

本帖子中包含更多资源