1/4

qianwenxiang

无尽藏海

Begin scan in 'D:\Downloads\样本\010701.rar'
D:\Downloads\样本\010701.rar
  [0] Archive type: RAR
  --> gdnOT2904.exe
      [DETECTION] Contains detection pattern of the dial-up program DIAL/Generic
  --> media_codec_install_wizard_3912981.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> codec_setup.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
  --> fill.dll
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Virtumon.v.17
  --> css4.dll
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Virtumonde.bio
  --> uusee54.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> myself.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [WARNING]   The file was ignored!


End of the scan: 2008年1月7日  22:46
Used time: 00:11 min

The scan has been done completely.

      0 Scanning directories
      8 Files were scanned
      7 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      1 Warnings
      0 Notes

The EQs

C:\Documents and Settings\Don johnson\桌面\010701.rar » RAR » gdnOT2904.exe - Win32/Dialer.NAD trojan
C:\Documents and Settings\Don johnson\桌面\010701.rar » RAR » fill.dll - Win32/Adware.Virtumonde.FP application
C:\Documents and Settings\Don johnson\桌面\010701.rar » RAR » uusee54.exe - probably a variant of Win32/TrojanDownloader.Delf trojan

浪滔天

卡巴 321 高启发

已删除: 病毒 Heur.Trojan.Generic        文件: F:\病毒样本\010701.rar/codec_setup.exe//PE_Patch.UPX
已删除: 广告程序 not-a-virus:AdWare.Win32.Virtumonde.fp        文件: F:\病毒样本\010701.rar/fill.dll//PE_Patch.PECompact
已删除: 木马程序 Trojan-Downloader.Win32.Delf.ctz        文件: F:\病毒样本\010701.rar/media_codec_install_wizard_3912981.exe//PE_Patch.UPX//UPX
已删除: 木马程序 Trojan-Downloader.Win32.Delf.dax        文件: F:\病毒样本\010701.rar/uusee54.exe//PE_Patch.PECompact//PecBundle//PECompact
已删除: 木马程序 Trojan-Spy.Win32.Pophot.yn        文件: F:\病毒样本\010701.rar/myself.exe//PE_Patch//UPack
已删除: 自动拨号程序 not-a-virus:Porn-Dialer.Win32.GBDialer.j        文件: F:\病毒样本\010701.rar/gdnOT2904.exe

wangjay1980

deleted: pornware not-a-virus:Porn-Dialer.Win32.GBDialer.j        File: C:\Documents and Settings\Owner\×ÀÃæ\010701.rar/gdnOT2904.exe
deleted: Trojan program Trojan-Downloader.Win32.Delf.ctz        File: C:\Documents and Settings\Owner\×ÀÃæ\010701.rar/media_codec_install_wizard_3912981.exe//PE_Patch.UPX//UPX
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.fp        File: C:\Documents and Settings\Owner\×ÀÃæ\010701.rar/fill.dll//PE_Patch.PECompact
deleted: Trojan program Trojan-Downloader.Win32.Delf.dax        File: C:\Documents and Settings\Owner\×ÀÃæ\010701.rar/uusee54.exe//PE_Patch.PECompact//PecBundle//PECompact
deleted: Trojan program Trojan-Spy.Win32.Pophot.yn        File: C:\Documents and Settings\Owner\×ÀÃæ\010701.rar/myself.exe//PE_Patch//UPack

1688388728

反病毒专家 AntiVirusKit 2007 扫描病毒日志记录
版本
双引擎反病毒签名 1/7/2008
开始时间: 1/8/2008 00:49
引擎: KAV 引擎 (AVK 18.2324), AVST 引擎 (AVKB 18.80)
高启发式: 打开
压缩文件: 打开
系统区域: 打开

扫描系统区域...
扫描所选择的目录和文件...
对象: css4.dll
        路径: D:\1\010701
狀態: 已发现病毒
        病毒: Win32:Adware-gen [Adw] (AVST 引擎)
对象: fill.dll
        路径: D:\1\010701
狀態: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.Virtumonde.fp (KAV 引擎), Win32:Vundo-gen48 [Adw] (AVST 引擎)
对象: gdnOT2904.exe
        路径: D:\1\010701
狀態: 已发现病毒
        病毒: not-a-virus:Porn-Dialer.Win32.GBDialer.j (KAV 引擎), Win32:Dialer-407 [Trj] (AVST 引擎)
对象: media_codec_install_wizard_3912981.exe
        路径: D:\1\010701
狀態: 已发现病毒
        病毒: Trojan-Downloader.Win32.Delf.ctz (KAV 引擎), Win32:Delf-GQC [Trj] (AVST 引擎)
对象: myself.exe
        路径: D:\1\010701
狀態: 已发现病毒
        病毒: Trojan-Spy.Win32.Pophot.yn (KAV 引擎), Win32:Agent-ICL [Trj] (AVST 引擎)
对象: uusee54.exe
        路径: D:\1\010701
狀態: 已发现病毒
        病毒: Trojan-Downloader.Win32.Delf.dax (KAV 引擎)
扫描完成: 1/8/2008 00:49
    已检查 7 个文件
    已发现 6 个染毒文件
    发现 0 个可疑文件

nosferatu

AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at:        3:24:14 2008-1-8

+ Scan result:       



C:\Documents and Settings\Administrator\桌面\010701.rar/gdnOT2904.exe -> Dialer.GBDialer.j : No action taken.
C:\Documents and Settings\Administrator\桌面\010701.rar/media_codec_install_wizard_3912981.exe -> Downloader.Delf.ctz : No action taken.
C:\Documents and Settings\Administrator\桌面\010701.rar/uusee54.exe -> Downloader.Delf.dax : No action taken.


::Report end

e-pie

江民报5个病毒

啊弥陀佛

木马名称:Trojan-Downloader.Win32.Delf.hqy
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\010701\MEDIA_CODEC_INSTALL_WIZARD_3912981.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

广告软件名称:AdWare.Win32.Downloader.m
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\010701\UUSEE54.EXE
是广告软件!
已成功阻止其运行,是否要删除此文件?

moonsilver

rs 5ge