9个

promised

Quick Scanning
C:\ABC\SCVH0ST.EXE
C:\ABC\SCVH0ST.EXE\FILE:0000
>>> File "C:\ABC\SCVH0ST.EXE" has been identified as suspicious 'Sus/Malware-A'.
C:\ABC\SERVICS.EXE
C:\ABC\SERVICS.EXE\FILE:0000
>>> File "C:\ABC\SERVICS.EXE" has been identified as suspicious 'Sus/Malware-A'.
C:\ABC\svcos.exe
C:\ABC\svcos.exe\FILE:0000
>>> Virus 'Mal/Dloadr-B' found in file C:\ABC\svcos.exe\FILE:0000
>>> Virus 'Mal/Dropper-H' found in file C:\ABC\svcos.exe
C:\ABC\svcos4.exe
>>> Virus 'Mal/Heuri-E' found in file C:\ABC\svcos4.exe
C:\ABC\svocs1.exe
C:\ABC\svocs1.exe\FILE:0000
>>> Virus 'Mal/Dloadr-B' found in file C:\ABC\svocs1.exe\FILE:0000
>>> File "C:\ABC\svocs1.exe" has been identified as suspicious 'Sus/Dropper-R'.
C:\ABC\svocs2.exe
>>> Virus 'Mal/Heuri-E' found in file C:\ABC\svocs2.exe
C:\ABC\svocs3.exe
>>> Virus 'Mal/Heuri-E' found in file C:\ABC\svocs3.exe
C:\ABC\XQDBHO.dll
>>> Virus 'Mal/Behav-056' found in file C:\ABC\XQDBHO.dll
C:\ABC\XQDBHO5.exe
>>> Virus 'Mal/Behav-056' found in file C:\ABC\XQDBHO5.exe
9 files swept in 12 seconds.
8 viruses were discovered.
3 suspicious files were discovered.
9 files out of 9 were infected.
Please send infected samples to Sophos for analysis.
For advice consult www.sophos.com, email support@sophos.com
or telephone +44 1235 559933
Ending Sophos Anti-Virus.

Graybird

Starting the file scan:

Begin scan in 'E:\9.rar'
E:\9.rar
  [0] Archive type: RAR
  --> SCVH0ST.EXE
      [DETECTION] Contains suspicious code HEUR/Malware
  --> SERVICS.EXE
      [DETECTION] Contains suspicious code HEUR/Malware
  --> svcos4.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> svcos.exe
      [DETECTION] Is the Trojan horse TR/Spy.Delf.aqt
  --> svocs1.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.ZXB
  --> svocs2.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> svocs3.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> XQDBHO5.exe
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
  --> XQDBHO.dll
      [DETECTION] Is the Trojan horse TR/Spy.Bantua.A
      [INFO]      The file was deleted!


End of the scan: 2007年11月24日  12:59
Used time: 00:20 min

The scan has been done completely.

      0 Scanning directories
     10 Files were scanned
      7 viruses and/or unwanted programs were found
      2 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

Nerazzurri

deleted: virus Virus.Win32.AutoRun.aes        File: C:\Documents and Settings\Nerazzurri\×ÀÃæ\9.rar/svcos4.exe//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-Spy.Win32.Delf.aqs        File: C:\Documents and Settings\Nerazzurri\×ÀÃæ\9.rar/svcos.exe//UPX
deleted: Trojan program Trojan-PSW.Win32.Delf.aig        File: C:\Documents and Settings\Nerazzurri\×ÀÃæ\9.rar/svocs1.exe//UPX
deleted: virus Virus.Win32.AutoRun.adu        File: C:\Documents and Settings\Nerazzurri\×ÀÃæ\9.rar/svocs2.exe//PE_Patch.UPX//UPX
deleted: virus Virus.Win32.AutoRun.afb        File: C:\Documents and Settings\Nerazzurri\×ÀÃæ\9.rar/svocs3.exe//PE_Patch.UPX//#
deleted: Trojan program Trojan-Downloader.Win32.Delf.cyr        File: C:\Documents and Settings\Nerazzurri\×ÀÃæ\9.rar/XQDBHO5.exe//PE_Patch.UPX//UPX

风野胤

7
R:\9.rar » RAR » SCVH0ST.EXE - probably a variant of Win32/Genetik trojan
R:\9.rar » RAR » SERVICS.EXE - probably a variant of Win32/Genetik trojan
R:\9.rar » RAR » svcos4.exe - a variant of Win32/AutoRun.K worm
R:\9.rar » RAR » svcos.exe - a variant of Win32/PSW.Delf.NIY trojan
R:\9.rar » RAR » svocs1.exe - Win32/PSW.Delf.AIG trojan
R:\9.rar » RAR » svocs2.exe - a variant of Win32/AutoRun.K worm
R:\9.rar » RAR » svocs3.exe - a variant of Win32/AutoRun.K worm

Nerazzurri

Hello,

SCVH0ST.EXE - Virus.Win32.AutoRun.afq,
SERVICS.EXE - Virus.Win32.AutoRun.afr,
XQDBHO.dll - Trojan-Downloader.Win32.Delf.dbn

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vyacheslav Zakorzhevsky
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: 9.rar

will

"Win32:Delf-FZE [Trj]" has been found in "SCVH0ST.EXE\[UPX]".  
"Win32:Delf-FZE [Trj]" has been found in "SERVICS.EXE\[UPX]".  
"Win32:Delf-GQR [Trj]" has been found in "svcos.exe\[UPX]\[Embedded#52f0]".  
"Win32:AutoRun-FI" has been found in "svcos4.exe\[UPX]".  
"Win32:Delf-AGT [Trj]" has been found in "svocs1.exe".  
"Win32:AutoRun-FI" has been found in "svocs2.exe\[UPX]".  
"Win32:AutoRun-FI" has been found in "svocs3.exe\[UPX]".  
"Win32:Delf-FYM [Trj]" has been found in "XQDBHO5.exe\[UPX]".

kkgh

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Worm.Win32.Autorun.ixu   
病毒： Worm.Win32.DownLoad.u   
病毒： Trojan.PSW.Win32.GameOnline.aez
病毒： Trojan.PSW.Win32.Agent.vpw
病毒： Trojan.DL.Win32.InfectHtm.a
病毒： Trojan.DL.Win32.Delf.cyr

用户来源：互联网

软件版本：20.19.50

clock11011

kv08，有点少

wangjay1980

好快
detected: virus Virus.Win32.AutoRun.afq File: C:\Documents and Settings\Owner\×ÀÃæ\9.rar/SCVH0ST.EXE//PE_Patch.UPX//UPX
detected: virus Virus.Win32.AutoRun.afr File: C:\Documents and Settings\Owner\×ÀÃæ\9.rar/SERVICS.EXE//PE_Patch.UPX//UPX
detected: virus Virus.Win32.AutoRun.aes File: C:\Documents and Settings\Owner\×ÀÃæ\9.rar/svcos4.exe//PE_Patch.UPX//UPX
detected: Trojan program Trojan-Spy.Win32.Delf.aqs File: C:\Documents and Settings\Owner\×ÀÃæ\9.rar/svcos.exe//UPX
detected: Trojan program Trojan-PSW.Win32.Delf.aig File: C:\Documents and Settings\Owner\×ÀÃæ\9.rar/svocs1.exe//UPX
detected: virus Virus.Win32.AutoRun.adu File: C:\Documents and Settings\Owner\×ÀÃæ\9.rar/svocs2.exe//PE_Patch.UPX//UPX
detected: virus Virus.Win32.AutoRun.afb File: C:\Documents and Settings\Owner\×ÀÃæ\9.rar/svocs3.exe//PE_Patch.UPX//#
detected: Trojan program Trojan-Downloader.Win32.Delf.cyr File: C:\Documents and Settings\Owner\×ÀÃæ\9.rar/XQDBHO5.exe//PE_Patch.UPX//UPX
detected: Trojan program Trojan-Downloader.Win32.Delf.dbn File: C:\Documents and Settings\Owner\×ÀÃæ\9.rar/XQDBHO.dll//PE_Patch.UPX//UPX

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Worm.Win32.Autorun.ixu   
病毒： Worm.Win32.DownLoad.u   
病毒： Trojan.PSW.Win32.GameOnline.aez
病毒： Trojan.PSW.Win32.Agent.vpw
病毒： Trojan.DL.Win32.InfectHtm.a
病毒： Trojan.DL.Win32.Delf.cyr

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.19.52