垃圾av终结者下的15个，基本是盗Q和鸽子后门

promised

C:\ABC\1\样本\atmQQ2.dll - 特征码 'MalwareScope.Worm.Viking.4' 被发现
C:\ABC\1\样本\qianqian1.exe - 特征码 'Backdoor.Win32.Agent.ahj' 被发现
C:\ABC\1\样本\qianqian10.exe - 特征码 'Virus.Win32.Virtualizer' 被发现
C:\ABC\1\样本\qianqian11.exe - 特征码 'Virus.Win32.Virtualizer' 被发现
C:\ABC\1\样本\qianqian2.exe - 特征码 'Dialer' 被发现
C:\ABC\1\样本\qianqian3.exe - 可疑代码段 被发现 (Level: 75)
C:\ABC\1\样本\qianqian4.exe - 特征码 'Virus.Packed.Win32.Klone.af' 被发现
C:\ABC\1\样本\qianqian5.exe - 特征码 'Backdoor.Win32.Agent.ahj' 被发现
C:\ABC\1\样本\qianqian6.exe - 可疑代码段 被发现 (Level: 100)
C:\ABC\1\样本\qianqian7.exe - 特征码 'Backdoor.Win32.Hupigon.dkl' 被发现
C:\ABC\1\样本\qianqian8.exe - 特征码 'Dialer' 被发现
C:\ABC\1\样本\qianqian9.exe - 可疑代码段 被发现 (Level: 85)
C:\ABC\1\样本\qservice.exe - 特征码 'Backdoor.Win32.Hupigon.dkl' 被发现
C:\ABC\1\样本\services.dll - 特征码 'Trojan-Spy.Win32.ProAgent.21' 被发现
C:\ABC\1\样本\smss..exe - 可疑代码段 被发现 (Level: 55)

promised

C:\ABC\1\样本\atmQQ2.dll
>>> Virus 'Mal/PWS-K' found in file C:\ABC\1\样本\atmQQ2.dll
        C:\ABC\1\样本\qianqian1.exe
>>> Virus 'Mal/EncPk-BN' found in file C:\ABC\1\样本\qianqian1.exe
        C:\ABC\1\样本\qianqian10.exe
>>> File "C:\ABC\1\样本\qianqian10.exe" has been identified as suspicious 'Sus/ComPack-C'.
        C:\ABC\1\样本\qianqian11.exe
>>> File "C:\ABC\1\样本\qianqian11.exe" has been identified as suspicious 'Sus/ComPack-C'.
        C:\ABC\1\样本\qianqian2.exe
>>> Virus 'Mal/EncPk-AP' found in file C:\ABC\1\样本\qianqian2.exe
        C:\ABC\1\样本\qianqian3.exe
>>> Virus 'Mal/EncPk-BN' found in file C:\ABC\1\样本\qianqian3.exe
        C:\ABC\1\样本\qianqian4.exe
>>> Virus 'Mal/EncPk-BN' found in file C:\ABC\1\样本\qianqian4.exe
        C:\ABC\1\样本\qianqian5.exe
>>> Virus 'Mal/SillyFDC-A' found in file C:\ABC\1\样本\qianqian5.exe
        C:\ABC\1\样本\qianqian6.exe
>>> Virus 'Mal/EncPk-BN' found in file C:\ABC\1\样本\qianqian6.exe
        C:\ABC\1\样本\qianqian7.exe
>>> Virus 'Mal/EncPk-BN' found in file C:\ABC\1\样本\qianqian7.exe
        C:\ABC\1\样本\qianqian8.exe
>>> Virus 'Mal/EncPk-BN' found in file C:\ABC\1\样本\qianqian8.exe
>>> Virus 'Mal/HckPk-A' found in file C:\ABC\1\样本\qianqian8.exe
        C:\ABC\1\样本\qianqian9.exe
>>> Virus 'Mal/EncPk-BN' found in file C:\ABC\1\样本\qianqian9.exe
        C:\ABC\1\样本\qservice.exe
>>> Virus 'Mal/EncPk-BN' found in file C:\ABC\1\样本\qservice.exe
>>> Virus 'Mal/Basine-C' found in file C:\ABC\1\样本\qservice.exe
        C:\ABC\1\样本\services.dll
>>> Virus 'Troj/Progent-P' found in file C:\ABC\1\样本\services.dll
        C:\ABC\1\样本\smss..exe
>>> Virus 'Mal/EncPk-BN' found in file C:\ABC\1\样本\smss..exe

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.QQPass.ytd
病毒： Trojan.Win32.PolyCrypt.b
病毒： Trojan.PSW.Win32.QQPass.ytd
病毒： Trojan.Win32.PolyCrypt.b
病毒： Worm.Win32.AvKiller.bu   
病毒： Trojan.Spy.ProAgent.a   

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.20.42

清凉世界

扫描进行于：2007-11-30 20:17:26
扫描日志
NOD32版本 2694 (20071130) NT
命令行： C:\Documents and Settings\Administrator.0CDC92BBFF714E5\桌面\样本.rar

日期： 30.11.2007  时间：20:17:29
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\Administrator.0CDC92BBFF714E5\桌面\样本.rar
C:\Documents and Settings\Administrator.0CDC92BBFF714E5\桌面\样本.rar >>RAR >>atmQQ2.dll - 可能是 Win32/Genetik 木马 的一个变种
C:\Documents and Settings\Administrator.0CDC92BBFF714E5\桌面\样本.rar >>RAR >>qianqian2.exe - 可能是 Win32/Genetik 木马 的一个变种
C:\Documents and Settings\Administrator.0CDC92BBFF714E5\桌面\样本.rar >>RAR >>qianqian3.exe - 可能是 Win32/Genetik 木马 的一个变种
C:\Documents and Settings\Administrator.0CDC92BBFF714E5\桌面\样本.rar >>RAR >>qianqian6.exe - 可能是 Win32/PSW.QQShou 木马 的一个变种
C:\Documents and Settings\Administrator.0CDC92BBFF714E5\桌面\样本.rar >>RAR >>services.dll - Win32/Spy.ProAgent.21 木马
C:\Documents and Settings\Administrator.0CDC92BBFF714E5\桌面\样本.rar >>RAR >>qianqian10.exe - 没有找到下一个压缩文件卷
已扫描的文件数目：13
已发现的病毒数目：5
完成时间： 20:17:35 总扫描时间：6 秒 (00:00:06)

Graybird

Starting the file scan:

Begin scan in 'E:\样本[1].part2.rar'
Begin scan in 'E:\样本[1].part1.rar'
E:\样本[1].part1.rar
  [0] Archive type: RAR
  --> atmQQ2.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.dwi
  --> qianqian1.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> qianqian2.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> qianqian3.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> qianqian4.exe
      [DETECTION] Is the Trojan horse TR/PCK.PolyCrypt.B.276
  --> qianqian5.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> qianqian6.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> qianqian8.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> qianqian9.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> qservice.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> services.dll
      [DETECTION] Is the Trojan horse TR/Spy.ProAgen.21.3
  --> smss..exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was deleted!


End of the scan: 2007年11月30日  20:12
Used time: 00:25 min

The scan has been done completely.

      0 Scanning directories
     16 Files were scanned
     10 viruses and/or unwanted programs were found
      2 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      6 Files not concerned
      2 Archives were scanned
      0 Warnings
      0 Notes

promised

真受不了不解压就扫的人

sam.to

已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Agent.dwi    檔案: C:\Documents and Settings\kato9096\桌面\样本\atmQQ2.dll//NSPack//PE_Patch.MaskPE
已刪除: 病毒 Packed.Win32.PolyCrypt.b    檔案: C:\Documents and Settings\kato9096\桌面\样本\qianqian1.exe
已偵測: 特洛伊木馬程式 Trojan-Downloader.Win32.Agent.dwi    檔案: C:\Documents and Settings\kato9096\桌面\样本\qianqian2.exe//#//NSPack//PE_Patch.MaskPE
已刪除: 病毒 Packed.Win32.PolyCrypt.b    檔案: C:\Documents and Settings\kato9096\桌面\样本\qianqian3.exe
已刪除: 病毒 Packed.Win32.PolyCrypt.b    檔案: C:\Documents and Settings\kato9096\桌面\样本\qianqian4.exe//PE_Patch.AvSpoof
已刪除: 病毒 Packed.Win32.PolyCrypt.b    檔案: C:\Documents and Settings\kato9096\桌面\样本\qianqian6.exe//PE_Patch.EPProt
已刪除: 病毒 Packed.Win32.PolyCrypt.b    檔案: C:\Documents and Settings\kato9096\桌面\样本\qianqian7.exe
已刪除: 病毒 Packed.Win32.PolyCrypt.b    檔案: C:\Documents and Settings\kato9096\桌面\样本\qianqian8.exe//RPCrypt
已刪除: 病毒 Packed.Win32.PolyCrypt.b    檔案: C:\Documents and Settings\kato9096\桌面\样本\qianqian9.exe
已刪除: 病毒 Packed.Win32.Klone.af    檔案: C:\Documents and Settings\kato9096\桌面\样本\qservice.exe

４个不报，已上报
已刪除: 特洛伊木馬程式 Trojan-Spy.Win32.ProAgent.21    檔案: C:\Documents and Settings\kato9096\桌面\样本\services.dll//UPX

欠妳緈諨

Virus check with AntiVirusKit
Version 17.0.7089
Virus signatures of 11/29/2007
Start time: 11/30/2007 22:26
Engine(s): Engine B (AVKB 18.38)
Heuristic: On
Archives: On
System areas: Off

Check selected directories and files...
Object: [NsPack]
        In archive: D:\病毒测试\解压样本\atmQQ2.dll
        Status: Virus detected
        Virus: Win32:QQPass-MH [Trj] (Engine B)
Object: atmQQ2.dll
        Path: D:\病毒测试\解压样本
        Status: Virus detected
        Virus: Win32:QQPass-MH [Trj] (Engine B)
Object: qianqian1.exe
        Path: D:\病毒测试\解压样本
        Status: Virus detected
        Virus: Win32:RPoly [Cryp] (Engine B)
Object: qianqian3.exe
        Path: D:\病毒测试\解压样本
        Status: Virus detected
        Virus: Win32:RPoly [Cryp] (Engine B)
Object: qianqian4.exe
        Path: D:\病毒测试\解压样本
        Status: Virus detected
        Virus: Win32:RPoly [Cryp] (Engine B)
Object: [NsPack]\[NsPack]
        In archive: D:\病毒测试\解压样本\qianqian5.exe
        Status: Virus detected
        Virus: Win32:AutoRun-FI (Engine B)
Object: qianqian5.exe
        Path: D:\病毒测试\解压样本
        Status: Virus detected
        Virus: Win32:AutoRun-FI (Engine B)
Object: qianqian6.exe
        Path: D:\病毒测试\解压样本
        Status: Virus detected
        Virus: Win32:RPoly [Cryp] (Engine B)
Object: qianqian7.exe
        Path: D:\病毒测试\解压样本
        Status: Virus detected
        Virus: Win32:RPoly [Cryp] (Engine B)
Object: qianqian8.exe
        Path: D:\病毒测试\解压样本
        Status: Virus detected
        Virus: Win32:RPoly [Cryp] (Engine B)
Object: qianqian9.exe
        Path: D:\病毒测试\解压样本
        Status: Virus detected
        Virus: Win32:RPoly [Cryp] (Engine B)
Object: qservice.exe
        Path: D:\病毒测试\解压样本
        Status: Virus detected
        Virus: Win32:ProAgent-G [Trj] (Engine B)
Object: services.dll
        Path: D:\病毒测试\解压样本
        Status: Virus detected
        Virus: Win32:ProAgent-G [Trj] (Engine B)
Object: smss..exe
        Path: D:\病毒测试\解压样本
        Status: Virus detected
        Virus: Win32:RPoly [Cryp] (Engine B)
Analysis complete: 11/30/2007 22:26
    15 files checked
    12 infected files detected
    0 suspected files detected

sam.to

Hello,

qianqian10.exe_ - Trojan-Dropper.Win32.Agent.cvb,
qianqian11.exe_ - Trojan-Dropper.Win32.Agent.cvc,
qianqian2.exe_ - Trojan-Dropper.Win32.Agent.cvd,
qianqian5.exe_ - Backdoor.Win32.Hupigon.aalq

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Ermilov Maxim
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

嘁。不稀罕~

原帖由 promised 于 2007-11-30 20:21 发表
真受不了不解压就扫的人

...看了这句话，赶快解压。。。
TIS2008病毒加间谍9个：
"病毒扫描日志" "2007/11/30" ""
"时间" "已检测，用户设定为信任" "类型" "威胁名称" "受感染文件" "第一处理措施" "第二处理措施"
"23:38" "文件监控" "文件" "Possible_Infostl" "E:\下载\病毒测试\样本\atmQQ2.dll" "忽略 成功" ""
"23:38" "文件监控" "文件" "Possible_Virus" "E:\下载\病毒测试\样本\qianqian1.exe" "清除 未完成，单击威胁名称，以确定应该如何手动处理此安全威胁" "隔离 成功"
"23:38" "文件监控" "文件" "PACKER-GEN.001" "E:\下载\病毒测试\样本\qianqian2.exe" "忽略 成功" ""
"23:38" "文件监控" "文件" "PACKER-GEN.001" "E:\下载\病毒测试\样本\qianqian3.exe" "忽略 成功" ""
"23:38" "文件监控" "文件" "Possible_Virus" "E:\下载\病毒测试\样本\qianqian6.exe" "清除 未完成，单击威胁名称，以确定应该如何手动处理此安全威胁" "隔离 成功"
"23:38" "文件监控" "文件" "PACKER-GEN.001" "E:\下载\病毒测试\样本\qianqian7.exe" "忽略 成功" ""
"23:38" "文件监控" "文件" "PACKER-GEN.001" "E:\下载\病毒测试\样本\qianqian8.exe" "忽略 成功" ""
"23:38" "文件监控" "文件" "PACKER-GEN.001" "E:\下载\病毒测试\样本\qianqian9.exe" "忽略 成功" ""
"间谍软件扫描日志" "2007/11/30" ""
"时间" "类型" "威胁名称" "受感染文件" "名称" "处理措施" "状态" "已检测，用户设定为信任" "类型"
"23:38" "" "HackingTools_PassGet" "E:\下载\病毒测试\样本\services.dll" "services.dll" "隔离 成功" "HackingTools_PassGet" "文件监控" "文件系统"