某贴挖的下载者[6F12CD]

显示全部楼层 · 发表于 2007-11-30 19:33:39

显示全部楼层 · 发表于 2007-11-30 19:34:50

Starting the file scan:

Begin scan in 'E:\baidu.rar'
E:\baidu.rar
  [0] Archive type: RAR
  --> baidu.exe
   [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-11-30 19:39:16

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.GameOnline.asy
病毒： Trojan.Win32.Mnless.zub
病毒： Trojan.PSW.Win32.GameOnline.asm
病毒： Trojan.DL.Delf.xxb
病毒： Trojan.PSW.Win32.GameOnline.art
病毒： Worm.Win32.PaBug.ep
病毒： Trojan.DL.Win32.Agent.yrh
病毒： Trojan.PSW.Win32.WoWar.afr
病毒： Trojan.PSW.Win32.GameOnline.amm
病毒： Trojan.PSW.Win32.QQHX.tsf
病毒： Trojan.PSW.Win32.XYOnline.ui
病毒： Trojan.PSW.Win32.LMir.yzb
病毒： Trojan.PSW.Win32.SunOnline.hy
病毒： Trojan.PSW.Win32.QQHX.tsg
病毒： Trojan.PSW.Win32.GameOnline.ana
病毒： Trojan.PSW.Win32.QQSG.an
病毒： Trojan.PSW.Win32.GameOnline.ars
病毒： Trojan.Win32.Mnless.zhs
病毒： Trojan.PSW.Win32.Woool.c

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.20.41

显示全部楼层 · 发表于 2007-11-30 19:39:23

deleted: virus Virus.Win32.AutoRun.ahs File: C:\Users\Nerazzurri\Desktop\baidu.rar/baidu.exe//PE_Patch.UPX//UPX

显示全部楼层 · 发表于 2007-11-30 19:56:41

KAV7.0报~

显示全部楼层 · 发表于 2007-11-30 20:17:02

程序:
C:\WINDOWS\SYSTEM32\REG.EXE
修改注册表项:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr
是否阻止?
程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\BAIDU.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\TXHMOU.EXE
2) C:\SOS.EXE
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-11-30 23:51:27

Starting the file scan:

Begin scan in 'C:\TDDOWNLOAD\a21.exe'
C:\TDDOWNLOAD\
  a21.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/Spy.Gen
         [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a1.exe'
C:\TDDOWNLOAD\
  a1.exe
   [DETECTION] Is the Trojan horse TR/Agent.czq
   [INFO]    The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a2.exe'
C:\TDDOWNLOAD\
  a2.exe
[0] Archive type: Runtime Packed
--> Object
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.iqw
      [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a3.exe'
C:\TDDOWNLOAD\
  a3.exe
[0] Archive type: RSRC
--> Object
   [INFO]    The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a4.exe'
C:\TDDOWNLOAD\
  a4.exe
   [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
   [INFO]    The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a5.exe'
C:\TDDOWNLOAD\
  a5.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/Spy.Gen
         [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a6.exe'
C:\TDDOWNLOAD\
  a6.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Contains suspicious code HEUR/Malware
         [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a7.exe'
C:\TDDOWNLOAD\
  a7.exe
[0] Archive type: RSRC
--> Object
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.blm.3
      [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a8.exe'
C:\TDDOWNLOAD\
  a8.exe
   [DETECTION] Is the Trojan horse TR/Crypt.FSPM.Gen
   [INFO]    The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a9.exe'
C:\TDDOWNLOAD\
  a9.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Contains suspicious code HEUR/Malware
         [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a10.exe'
C:\TDDOWNLOAD\
  a10.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Contains suspicious code HEUR/Malware
         [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a11.exe'
C:\TDDOWNLOAD\
  a11.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.itq
         [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a12.exe'
C:\TDDOWNLOAD\
  a12.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.iza
         [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a13.exe'
C:\TDDOWNLOAD\
  a13.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
         [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a14.exe'
C:\TDDOWNLOAD\
  a14.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Contains suspicious code HEUR/Malware
         [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a15.exe'
C:\TDDOWNLOAD\
  a15.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
   [INFO]    The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a16.exe'
C:\TDDOWNLOAD\
  a16.exe
[0] Archive type: Runtime Packed
--> Object
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.ikc
      [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a17.exe'
C:\TDDOWNLOAD\
  a17.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Contains suspicious code HEUR/Malware
         [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a18.exe'
C:\TDDOWNLOAD\
  a18.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Contains suspicious code HEUR/Malware
         [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a19.exe'
C:\TDDOWNLOAD\
  a19.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/FWDisable.22884
         [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a20.exe'
C:\TDDOWNLOAD\
  a20.exe
   [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.1
   [INFO]    The file was deleted!

End of the scan: 2007年11月30日  07:50
Used time: 00:08 min

The scan has been done completely.

   0 Scanning directories
   21 Files were scanned
   13 viruses and/or unwanted programs were found
   8 Files were classified as suspicious:
   21 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   8 Files not concerned
   15 Archives were scanned
   15 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-12-1 00:24:31

AVAST报

[病毒样本] 某贴挖的下载者[6F12CD]

本帖子中包含更多资源

9,18未杀！