qqhelper

a256886572008

xxwpk007

C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MY_70145.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:2118
远端地址:58.211.7.59(江苏·苏州)
远端端口:80

C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MY_70145.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:2127
远端地址:58.211.7.41(江苏·苏州)
远端端口:80

C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MY_70145.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:2136
远端地址:58.211.7.36(江苏·苏州)
远端端口:80

C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MY_70145.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:2145
远端地址:58.211.7.25(江苏·苏州)
远端端口:80


logo.exe生成东西微点每反应

qigang

RX20.21.61暂时未发现病毒。

gho

deleted: virus Heur.Downloader (modification)        File: C:\Documents and Settings\gho\×ÀÃæ\cdd\cdd\readme.exe//stream//data0001
deleted: adware not-a-virus:AdWare.Win32.BHO.ms        File: C:\Documents and Settings\gho\×ÀÃæ\cdd\cdd\readme.exe//stream//data0002//data0002
deleted: adware not-a-virus:AdWare.Win32.BHO.ne        File: C:\Documents and Settings\gho\×ÀÃæ\cdd\cdd\readme.exe//stream//data0002//data0003//stream//data0001
deleted: adware not-a-virus:AdWare.Win32.Boran.bv        File: C:\Documents and Settings\gho\×ÀÃæ\cdd\cdd\readme.exe//stream//data0003//stream//data0001

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 1056
Paranoia Database - 49948
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\New Folder (2)

C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\my_70145.exe - Suspected TROJAN-DOWNLOADER (HTTP://{REMOVED}/...)
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\logo.exe - Suspected MaliciousScope:GENERIC.MALWARE.1
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\4p0qwar.dll - Suspected TROJAN-DOWNLOADER.AGENT.1
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\ee3ufr1g3p.sys - OK
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\rcmd.sys - OK

5 Files scanned
0 Infected files found
3 Suspected files found
0 Files disinfected
0 Files deleted

sam.to

已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Hmir.li        檔案: C:\Documents and Settings\kato9096\桌面\qqhelper\4p0qwar.dll
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Hmir.li        檔案: C:\Documents and Settings\kato9096\桌面\qqhelper\ee3ufr1g3p.sys
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Hmir.li        檔案: C:\Documents and Settings\kato9096\桌面\qqhelper\logo.exe
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Agent.fwd        檔案: C:\Documents and Settings\kato9096\桌面\qqhelper\my_70145.exe
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Hmir.li        檔案: C:\Documents and Settings\kato9096\桌面\qqhelper\rcmd.sys


没有不杀

BING126

扫描开始时间: 2007-12-10 14:06:04
扫描日志
NOD32 版本 2712 (20071209) NT
命令行: C:\Documents and Settings\Administrator\桌面\qqhelper.rar

日期: 2007年12月10日  时间: 14:06:08
反 Rookits 技术已启用。
已扫描磁盘、文件夹和文件: C:\Documents and Settings\Administrator\桌面\qqhelper.rar
C:\Documents and Settings\Administrator\桌面\qqhelper.rar ?RAR ?logo.exe<病毒 - Win32/TrojanDownloader.QQHelper.NDW 木马 变种>
C:\Documents and Settings\Administrator\桌面\qqhelper.rar ?RAR ?4p0qwar.dll<病毒 - 可能是 Win32/TrojanDownloader.Agent.NPO 木马 变种>
C:\Documents and Settings\Administrator\桌面\qqhelper.rar ?RAR ?ee3ufr1g3p.sys<病毒 - Win32/Rootkit.Agent.NBQ 木马 变种>
C:\Documents and Settings\Administrator\桌面\qqhelper.rar ?RAR ?rcmd.sys<病毒 - Win32/Rootkit.Agent.NCK 木马 变种>
已扫描文件数量: 5
已发现病毒数量: 4
完成时间: 14:06:11 总共扫描时间: 3 秒 (00:00:03)

Graybird

The file 'my_70145.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/Dldr.Agent.fwd. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.00.01.61.

The file 'logo.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/Dldr.Hmir.LI. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.00.01.61.

Graybird

Starting the file scan:

Begin scan in 'E:\qqhelper.rar'
E:\qqhelper.rar
  [0] Archive type: RAR
  --> my_70145.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.fwd
  --> logo.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Hmir.LI
  --> 4p0qwar.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> ee3ufr1g3p.sys
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> rcmd.sys
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [INFO]      The file was deleted!


End of the scan: 2007年12月10日  16:39
Used time: 00:23 min

The scan has been done completely.

      0 Scanning directories
      6 Files were scanned
      5 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      0 Warnings

wu19934718

费尔 杀五个//