5只[MD5: B5D73D 91C4F9 7C91F5 9FB655 94D06B]

promised

[Found possible virus] <W32/Threat-HLLPEM-based!Maximus (not disinfectable)>  C:\ABC\样本1.rar->dlyy.dll
[Found possible virus] < (not disinfectable)>  C:\ABC\样本1.rar->djsetup.exe->(Klone.AF)
[Found virus] <W32/Downloader.gen10 (not disinfectable)>  C:\ABC\样本1.rar->Keys.exe
[Found possible virus] < (not disinfectable)>  C:\ABC\样本1.rar->rundl132.exe->(NSPack)->(PE_Patch)
[Found possible virus] < (not disinfectable)>  C:\ABC\样本1.rar->od3mdi.dll->(Klone.AF)

FBAV

MicroVita AntiSpyware 100 C
_____________________________________________
                                          
             风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]                  
                   http://221.10.254.214/
----------------------------------------------
开始扫描……

正在检查启动……
[C:\Documents and Settings\Administrator\桌面\Virus\样本1\dlyy.dll]
                    …………发现Spy！报告:[1] Win32.NkHack.PeM.A
文件信息:  大小:91648  MD5:b5d73d4d0ed6cc91c40804a27709e429

[C:\Documents and Settings\Administrator\桌面\Virus\样本1\djsetup.exe]
                    …………发现Spy！报告:[1] Win32.Virus.Gen32
文件信息:  大小:139776  MD5:91c4f94ad90ca93292b569ea47626f5a

[C:\Documents and Settings\Administrator\桌面\Virus\样本1\Keys.exe]
                    …………发现Spy！报告:[8] HOOK者
文件信息:  大小:48170  MD5:7c91f57e9c8c1b2216662d4e70deef82

[C:\Documents and Settings\Administrator\桌面\Virus\样本1\od3mdi.dll]
                    …………发现Spy！报告:[1] Win32.Virus.Gen32
文件信息:  大小:244224  MD5:94d06b65a019588c26a904dfe7598914

文件数:5   病毒数:4  比重:0.8
OK  扫描完毕！
  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎   
[2] 文件特征码引擎
[1] 文件启发式引擎

[ 本帖最后由 FBAV 于 2007-11-17 11:43 编辑 ]

aerbeisi

检测到：木马程序 Trojan-PSW.Win32.Magania.bfh        文件　: F:\du\样本1.rar/dlyy.dll
检测到：木马程序 Trojan-PSW.Win32.Magania.bfg        文件　: F:\du\样本1.rar/djsetup.exe
检测到：木马程序 Trojan-PSW.Win32.Magania.bfh        文件　: F:\du\样本1.rar/rundl132.exe
检测到：木马程序 Trojan-PSW.Win32.Magania.bfg        文件　: F:\du\样本1.rar/od3mdi.dll

The EQs

C:\Documents and Settings\Don johnson\桌面\样本1.rar &raquo; RAR &raquo; dlyy.dll - probably a variant of Win32/PSW.Lineage.DN trojan
C:\Documents and Settings\Don johnson\桌面\样本1.rar &raquo; RAR &raquo; djsetup.exe - Win32/PSW.Maran.KF trojan
C:\Documents and Settings\Don johnson\桌面\样本1.rar &raquo; RAR &raquo; Keys.exe - Win32/TrojanDownloader.Delf.NZT trojan
C:\Documents and Settings\Don johnson\桌面\样本1.rar &raquo; RAR &raquo; rundl132.exe - probably a variant of Win32/Genetik trojan

zhr5898

Starting the file scan:

Begin scan in 'E:\样本1.rar'
E:\样本1.rar
  [0] Archive type: RAR
  --> dlyy.dll
      [DETECTION] Is the Trojan horse TR/Lineage.91648
  --> djsetup.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> Keys.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> rundl132.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> od3mdi.dll
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [WARNING]   The file was ignored!

promised

谀哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪姆
?            VirusBlokAda (Console scanner)             ?
?Vba32 Windows/CL 3.12.2.5 / 2007.11.16 08:34 (Vba32.W) ?
?         Copyright (c) 1993-2007 by VBA Ltd.           ?
酝屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯图
License expired
License #000000119 Valid till 2006-12-31
Demo mode
Computer: PROMISED-1BD18F
System: Windows XP
Command line options:
/r=susp.rpt /ha=3 /collect_suspects /nc /sfx /af+ /fd+ /ar+ /bt- /mr- /ml+ /rw+ /as-
Program settings:
/r=susp.rpt /ha=3 /collect_suspects /nc /sfx /af+ /fd+ /ar+ /qu+ /ml+ /rw+

*:
C:\
C:\ABC\样本1.rar:<RAR>\dlyy.dll : infected MalwareScope.Worm.Viking.4
C:\ABC\样本1.rar:<RAR>\djsetup.exe : infected Trojan.PWS.Maran
C:\ABC\样本1.rar:<RAR>\Keys.exe : infected MalwareScope.Trojan-PSW.Game.17
C:\ABC\样本1.rar:<RAR>\rundl132.exe : infected BackDoor.Pigeon.1604
C:\ABC\样本1.rar:<RAR>\od3mdi.dll : infected Trojan.PWS.Maran
Program execution terminated by user


Directories       : 3       Files in archives:      Files on disks:
Archives:                   - total       : 5       - total       : 13   
- scanned         : 1       -  scanned    : 5       - scanned     : 13   
- contain viruses : 1       -  infected   : 5       - infected    : 1     
- deleted         : 0       -  suspicious : 0       - suspicious  : 0     

Startup    : 12:23:02 17-11-2007
End        : 12:23:30 17-11-2007
Total time : 00:00:28

微点卫士

KILL 一个

欠妳緈諨

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Gamania.GEN   

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.18.51

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 906
Paranoia Database - 48810
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\New Folder (2)

C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\dlyy.dll - Suspected MaliciousScope:WIN32.GENERIC.MALWARE.8
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\djsetup.exe - OK
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\Keys.exe - Infected WIN32.TROJAN.AGENT.2 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\rundl132.exe - Infected MaliciousScope:WIN32.TROJAN-DOWNLOADER.AGENT.3 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\od3mdi.dll - OK

5 Files scanned
2 Infected files found
1 Suspected files found
0 Files disinfected
2 Files deleted