又见伪装soundman

promised

C:\ABC\样本.rar:\qq.exe - 特征码 'Backdoor.Win32.Agent.ahj' 被发现
C:\ABC\样本.rar:\alcwzrd.exe - 特征码 'Trojan-Downloader.Win32.VB.bse' 被发现
C:\ABC\样本.rar:\ineters.exe - 特征码 'BehavesLikeTrojan.Downloader' 被发现
C:\ABC\样本.rar:\notepde.exe - 特征码 'Trojan.Win32.VB.bjq' 被发现
C:\ABC\样本.rar:\SoundMan.exe - 特征码 'Backdoor.Win32.Agent.ahj' 被发现
C:\ABC\样本.rar:\gx.exe - 特征码 'Backdoor.Win32.Agent.ahj' 被发现
C:\ABC\样本.rar:\WINSCK.exe - 特征码 'BehavesLikeTrojan.Downloader' 被发现
C:\ABC\样本.rar:\MSWINSCK.OCX
C:\ABC\样本.rar:\dianji2.exe - 特征码 'Backdoor.Win32.Agent.ahj' 被发现
C:\ABC\样本.rar:\33890.exe - 特征码 'Backdoor.Win32.Agent.ahj' 被发现
C:\ABC\样本.rar:\gx1.exe - 特征码 'Backdoor.Win32.Agent.ahj' 被发现
C:\ABC\样本.rar:\bf.exe - 特征码 'Backdoor.Win32.Agent.ahj' 被发现
C:\ABC\样本.rar:\long.exe - 特征码 'BehavesLikeWin32.ExplorerHijack' 被发现
C:\ABC\样本.rar

        14 文件被扫描
          (1 压缩档 13 文件)
        12 特征码被侦测
        0 可疑代码段被发现
        耗时: 0:00.125

碧水寒潭

Start of the scan: 2007年11月16日  21:42

Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\样本.rar
  [0] Archive type: RAR
  --> qq.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> alcwzrd.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> ineters.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> notepde.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> SoundMan.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/VB.bqf Backdoor server programs
  --> gx.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> WINSCK.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> dianji2.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 33890.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> gx1.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> bf.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> long.exe
      [DETECTION] Is the Trojan horse TR/Hijack.Explor.1085
      [INFO]      The file was deleted!


End of the scan: 2007年11月16日  21:42
Used time: 00:11 min

The scan has been done completely.

      1 Scanning directories
     14 Files were scanned
      4 viruses and/or unwanted programs were found
      8 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     10 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

398566384

kv2008 4个

2007zxf1

小红伞报了12个.卡巴才7个

欠妳緈諨

BD9    KAV7

sam.to

Hello.
New malicious software was found in the attached file.
It's detection will be included in the next update. Thank you for your help.
-----------------
Regards, Namestnikov Yury
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com

傻猪猪米走鸡

2007-11-16 22:55:04        Real-time file system protection        file        D:\firefox下载的文件\样本(2)\long.exe        probably unknown NewHeur_PE virus        deleted - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: f:\Program Files\WinRAR\WinRAR.exe.
2007-11-16 22:55:03        Real-time file system protection        file        D:\firefox下载的文件\样本(2)\bf.exe        probably unknown NewHeur_PE virus        deleted - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: f:\Program Files\WinRAR\WinRAR.exe.
2007-11-16 22:55:01        Real-time file system protection        file        D:\firefox下载的文件\样本(2)\gx1.exe        probably unknown NewHeur_PE virus        deleted - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: f:\Program Files\WinRAR\WinRAR.exe.
2007-11-16 22:54:55        Real-time file system protection        file        D:\firefox下载的文件\样本(2)\WINSCK.exe        probably unknown NewHeur_PE virus        deleted - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: f:\Program Files\WinRAR\WinRAR.exe.
2007-11-16 22:54:48        Real-time file system protection        file        D:\firefox下载的文件\样本(2)\SoundMan.exe        Win32/VB.BJQ trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: f:\Program Files\WinRAR\WinRAR.exe.
2007-11-16 22:54:44        Real-time file system protection        file        D:\firefox下载的文件\样本(2)\notepde.exe        Win32/VB.BJQ trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: f:\Program Files\WinRAR\WinRAR.exe.
2007-11-16 22:54:40        Real-time file system protection        file        D:\firefox下载的文件\样本(2)\ineters.exe        Win32/VB.BJQ trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: f:\Program Files\WinRAR\WinRAR.exe.
2007-11-16 22:54:37        Real-time file system protection        file        D:\firefox下载的文件\样本(2)\alcwzrd.exe        Win32/VB.BJQ trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: f:\Program Files\WinRAR\WinRAR.exe.
2007-11-16 22:54:33        Real-time file system protection        file        D:\firefox下载的文件\样本(2)\qq.exe        Win32/VB.BJQ trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: f:\Program Files\WinRAR\WinRAR.exe.

sam.to

报了后,只有其中五个杀了

tun

>>> Virus 'Mal/Packer' found in file C:\Scan\13\33890.exe
>>> File "C:\Scan\13\alcwzrd.exe\FILE:0002" has been identified as suspicious 'Sus/Malware-B'.
>>> File "C:\Scan\13\alcwzrd.exe" has been identified as suspicious 'Sus/Malware-B'.
>>> Virus 'Mal/Behav-156' found in file C:\Scan\13\bf.exe
>>> Virus 'Mal/Packer' found in file C:\Scan\13\dianji2.exe
>>> Virus 'Mal/Packer' found in file C:\Scan\13\gx.exe
>>> Virus 'Mal/Emogen-H' found in file C:\Scan\13\gx1.exe\FILE:0000
>>> Virus 'Mal/Packer' found in file C:\Scan\13\gx1.exe
>>> File "C:\Scan\13\ineters.exe" has been identified as suspicious 'Sus/Malware-B'.
>>> Virus 'Mal/Behav-010' found in file C:\Scan\13\long.exe
>>> Virus 'Mal/Emogen-H' found in file C:\Scan\13\qq.exe
>>> Virus 'Mal/Emogen-F' found in file C:\Scan\13\qq.exe
>>> Virus 'Mal/Emogen-H' found in file C:\Scan\13\SoundMan.exe
>>> Virus 'Mal/Emogen-F' found in file C:\Scan\13\SoundMan.exe
>>> Virus 'Mal/Emogen-H' found in file C:\Scan\13\WINSCK.exe
>>> Virus 'Mal/Emogen-F' found in file C:\Scan\13\WINSCK.exe

13 files swept in 16 seconds.
13 viruses were discovered.
3 suspicious files were discovered.
11 files out of 13 were infected.
Please send infected samples to Sophos for analysis.
For advice consult www.sophos.com, email support@sophos.com
or telephone +44 1235 559933
Ending Sophos Anti-Virus.

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 878
Paranoia Database - 48756
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\New Folder (2)

C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\qq.exe - Infected MaliciousScope:TROJAN-DOWNLOADER.AGENT.3 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\alcwzrd.exe - Suspected TROJAN-DOWNLOADER (HTTP://...)
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\ineters.exe - Suspected MaliciousScope:GENERIC.MALWARE.27
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\notepde.exe - Suspected MaliciousScope:GENERIC.MALWARE.27
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\SoundMan.exe - Infected MaliciousScope:TROJAN-DOWNLOADER.AGENT.3 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\gx.exe - Infected MaliciousScope:TROJAN-DOWNLOADER.AGENT.3 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\WINSCK.exe - Suspected MaliciousScope:GENERIC.MALWARE.27
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\MSWINSCK.OCX - Infected TROJAN.STARTPAGE.A - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\dianji2.exe - Infected MaliciousScope:TROJAN-DOWNLOADER.AGENT.3 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\33890.exe - Infected MaliciousScope:TROJAN-DOWNLOADER.AGENT.3 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\gx1.exe - Infected MaliciousScope:TROJAN-DOWNLOADER.AGENT.3 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\bf.exe - Infected MaliciousScope:TROJAN.VB.A - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\long.exe - Infected TROJAN-DOWNLOADER.AGENT.32 - Deleted

13 Files scanned
9 Infected files found
4 Suspected files found
0 Files disinfected
9 Files deleted