四个

显示全部楼层 · 发表于 2007-12-1 11:20:21

四个

显示全部楼层 · 发表于 2007-12-1 11:25:00

大蜘蛛报3个

autorun.pif.rar\autorun.pif.重命名;C:\Documents and Settings\77\My Documents\新建文件夹.rar\新建文件夹\autorun.pif.rar;BackDoor.Kais;;
新建文件夹\autorun.pif.rar;C:\Documents and Settings\77\My Documents\新建文件夹.rar\新建文件夹;发现档案文件中有受感染的对象;;
up_16.rar\up_16.tmp;C:\Documents and Settings\77\My Documents\新建文件夹.rar\新建文件夹\up_16.rar;可能 DLOADER.Trojan;;
新建文件夹\up_16.rar;C:\Documents and Settings\77\My Documents\新建文件夹.rar\新建文件夹;发现档案文件中有受感染的对象;;
up_B9.rar\up_B9.tmp;C:\Documents and Settings\77\My Documents\新建文件夹.rar\新建文件夹\up_B9.rar;可能 DLOADER.Trojan;;
新建文件夹\up_B9.rar;C:\Documents and Settings\77\My Documents\新建文件夹.rar\新建文件夹;发现档案文件中有受感染的对象;;
新建文件夹.rar;C:\Documents and Settings\77\My Documents;发现档案文件中有受感染的对象;;

显示全部楼层 · 发表于 2007-12-1 11:25:02

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\新建文件夹.rar'
C:\Users\morgan\Documents\
  新建文件夹.rar
[0] Archive type: RAR
   --> ￐ￂﾽﾨￎￄﾼﾼ￐\autorun.pif.rar
      [1] Archive type: RAR
      --> autorun.pif.ￖ￘ￃￃ￻
         [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.etx Backdoor server programs
         [WARNING] Infected files in archives cannot be repaired!
   --> ￐ￂﾽﾨￎￄﾼﾼ￐\LINKHRS.LNK.rar
      [1] Archive type: RAR
      --> LINKHRS.LNK.ￖ￘ￃￃ￻
   --> ￐ￂﾽﾨￎￄﾼﾼ￐\up_16.rar
      [1] Archive type: RAR
      --> up_16.tmp
         [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Boran.AC.2
         [WARNING] Infected files in archives cannot be repaired!
   --> ￐ￂﾽﾨￎￄﾼﾼ￐\up_B9.rar
      [1] Archive type: RAR
      --> up_B9.tmp
         [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Boran.AC.2
         [WARNING] Infected files in archives cannot be repaired!
   [WARNING] The file was ignored!

End of the scan: 2007年11月30日  19:24
Used time: 00:04 min

The scan has been done completely.

   0 Scanning directories
   9 Files were scanned
   3 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   6 Files not concerned
   5 Archives were scanned
   4 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-12-1 11:29:57

检测到：木马程序 Backdoor.Win32.Hupigon.etx 文件　: F:\du\新建文件夹.rar/新建文件夹\autorun.pif.rar/autorun.pif.重命名
检测到：广告程序 not-a-virus:AdWare.Win32.Themeadp.a 文件　: F:\du\新建文件夹.rar/新建文件夹\up_16.rar/up_16.tmp
检测到：广告程序 not-a-virus:AdWare.Win32.Themeadp.a 文件　: F:\du\新建文件夹.rar/新建文件夹\up_B9.rar/up_B9.tmp

显示全部楼层 · 发表于 2007-12-1 11:30:47

这个文件连ikarus都不杀，是病毒的可能性比较小，运行之后调用dos mode，也不知道干了什么
File: LINKHRS.LNK.重命名
Status: OK
MD5: 2b07121344617bc098c53b6f5b069f1a
Packers detected: -
Bit9 reports: File not found

Scanner results
Scan taken on 01 Dec 2007 03:27:25 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Ikarus Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Rising Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing

显示全部楼层 · 发表于 2007-12-1 12:06:54

BD 3个

显示全部楼层 · 发表于 2007-12-1 12:07:52

FS报一个病毒，两个间谍

显示全部楼层 · 发表于 2007-12-1 12:10:07

扫描进行于：2007-12-1 12:09:48
扫描日志
NOD32版本 2696 (20071130) NT
命令行： C:\Documents and Settings\Administrator.0CDC92BBFF714E5\桌面\新建文件夹.rar

日期： 1.12.2007 时间：12:09:53
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\Administrator.0CDC92BBFF714E5\桌面\新建文件夹.rar
C:\Documents and Settings\Administrator.0CDC92BBFF714E5\桌面\新建文件夹.rar >>RAR >>新建文件夹\autorun.pif.rar >>RAR >>autorun.pif.重命名 - Win32/Delf.NCW 蠕虫
已扫描的文件数目：4
已发现的病毒数目：1
完成时间： 12:09:54 总扫描时间：1 秒 (00:00:01)

显示全部楼层 · 发表于 2007-12-1 12:23:16

微点砍掉

其他三个都是:This program cannot be run in DOS mode.

显示全部楼层 · 发表于 2007-12-1 12:25:56

C:\Documents and Settings\Administrator\桌面\新建文件夹.rar » RAR » 新建文件夹\autorun.pif.rar » RAR » autorun.pif.重命名 - Win32/Delf.NCW worm - was a part of the deleted object
C:\Documents and Settings\Administrator\桌面\新建文件夹.rar » RAR » 新建文件夹\autorun.pif.rar - Win32/Delf.NCW worm - was a part of the deleted object
C:\Documents and Settings\Administrator\桌面\新建文件夹.rar - Win32/Delf.NCW worm - deleted - quarantined

果然 nod32就报1个

[病毒样本] 四个

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源