13个比较老的

显示全部楼层 · 发表于 2008-1-15 22:18:18

[MD5: 352E9E 2A348C 987C91 FE19D8 237A21 A280D6 D8C5C6 3378BA C1B6D1 02B601 14ABAA 45B939 2B7927]

显示全部楼层 · 发表于 2008-1-15 22:23:39

17

SKY估计没问题

显示全部楼层 · 发表于 2008-1-15 22:25:19

nod查出11个

金山8个

[ 本帖最后由 spaceplane 于 2008-1-15 22:32 编辑 ]

显示全部楼层 · 发表于 2008-1-15 22:27:46

17（其实是11

）
R:\新建文件夹\sideb.exe - Win32/TrojanDropper.Agent.TV trojan - cleaned by deleting - quarantined

R:\新建文件夹\tsinstall_4_0_4_0_b4.exe » WISE » TSM - Win32/TrojanDownloader.TSUpdate.N trojan - was a part of the deleted object
R:\新建文件夹\tsinstall_4_0_4_0_b4.exe » WISE » TSL - Win32/TrojanDownloader.TSUpdate.P trojan - was a part of the deleted object
R:\新建文件夹\tsinstall_4_0_4_0_b4.exe » WISE » TS - Win32/TrojanDownloader.TSUpdate.L trojan - was a part of the deleted object
R:\新建文件夹\tsinstall_4_0_4_0_b4.exe » WISE » TSP - Win32/TrojanDownloader.TSUpdate.F trojan - was a part of the deleted object
R:\新建文件夹\tsinstall_4_0_4_0_b4.exe » WISE » vocabulary - Win32/TrojanDownloader.TSUpdate.J trojan - was a part of the deleted object
R:\新建文件夹\tsinstall_4_0_4_0_b4.exe - multiple threats - deleted - quarantined
R:\新建文件夹\1.exe - Win32/AutoRun.BU worm - cleaned by deleting - quarantined
R:\新建文件夹\014.exe - Win32/Jalous.AA worm - cleaned by deleting - quarantined
R:\新建文件夹\444.exe - Win32/TrojanDownloader.Agent.UE trojan - cleaned by deleting - quarantined
R:\新建文件夹\7013917092aab932.exe - Win32/TrojanDownloader.Flux trojan - cleaned by deleting - quarantined
R:\新建文件夹\A.exe » NSIS » a.sys - Win32/Adware.NewWeb application - was a part of the deleted object
R:\新建文件夹\A.exe » NSIS » staA.dll - Win32/Adware.NewWeb application - was a part of the deleted object
R:\新建文件夹\A.exe » NSIS » winA.dll - Win32/Adware.NewWeb application - was a part of the deleted object
R:\新建文件夹\A.exe - Win32/Adware.NewWeb application - deleted - quarantined
R:\新建文件夹\ahreco.exe - a variant of Win32/Adware.BetterInternet application - cleaned by deleting - quarantined
R:\新建文件夹\crack.exe - probably a variant of Win32/TrojanDownloader.Agent trojan - cleaned by deleting - quarantined
R:\新建文件夹\host2.exe - Win32/PSW.QQPass.NCJ trojan - cleaned by deleting - quarantined
R:\新建文件夹\optimize313.exe - Win32/TrojanDownloader.Dyfica.DX trojan - cleaned by deleting - quarantined

显示全部楼层 · 发表于 2008-1-15 22:37:39

即系几多个啊？

显示全部楼层 · 发表于 2008-1-15 23:23:50

Begin scan in 'K:\0115[1]'
K:\0115[1]\014.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [INFO]    A backup was created as '47c0d007.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
K:\0115[1]\1.exe
   [DETECTION] Contains detection pattern of the worm WORM/QQpass.AL
   [INFO]    A backup was created as '47f1d004.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
K:\0115[1]\444.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [INFO]    A backup was created as '47c0d00a.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
K:\0115[1]\7013917092aab932.exe
   [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
   [INFO]    A backup was created as '47bdd006.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
K:\0115[1]\A.exe
   [DETECTION] Contains detection pattern of the dropper DR/Agent.MC
   [INFO]    A backup was created as '467bbc55.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
K:\0115[1]\ahreco.exe
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/BetterInternet.A.51
   [INFO]    A backup was created as '47fed03e.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
K:\0115[1]\crack.exe
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Agent.BM.8
   [INFO]    A backup was created as '47edd048.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
K:\0115[1]\host2.exe
   [DETECTION] Is the Trojan horse TR/PSW.Steal.44157
   [INFO]    A backup was created as '47ffd045.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
K:\0115[1]\optimize313.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Dyfuca.ds
   [INFO]    A backup was created as '4800d046.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
K:\0115[1]\sideb.exe
   [DETECTION] Is the Trojan horse TR/EliteBar.H.1
   [INFO]    A backup was created as '47f0d040.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
K:\0115[1]\sky.exe
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    The file was moved to '4805d042.qua'!
K:\0115[1]\tsinstall_4_0_4_0_b4.exe
   [DETECTION] Is the Trojan horse TR/Dldr.TSUpdat.F.3
   [INFO]    A backup was created as '47f5d04a.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2008-1-15 23:26:58

趋势11

显示全部楼层 · 发表于 2008-1-15 23:46:15

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\0115'
C:\Documents and Settings\Administrator\桌面\0115\014.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0115\1.exe
   [DETECTION] Contains detection pattern of the worm WORM/QQpass.AL
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0115\444.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0115\7013917092aab932.exe
   [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0115\A.exe
   [DETECTION] Contains detection pattern of the dropper DR/Agent.MC
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0115\ahreco.exe
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/BetterInternet.A.51
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0115\crack.exe
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Agent.BM.8
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0115\host2.exe
   [DETECTION] Is the Trojan horse TR/PSW.Steal.44157
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0115\optimize313.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Dyfuca.ds
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0115\sideb.exe
   [DETECTION] Is the Trojan horse TR/EliteBar.H.1
   [INFO]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0115\sky.exe
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    The file was moved to '4805d58f.qua'!
C:\Documents and Settings\Administrator\桌面\0115\tsinstall_4_0_4_0_b4.exe
   [DETECTION] Is the Trojan horse TR/Dldr.TSUpdat.F.3
   [INFO]    The file was deleted!

End of the scan: 星期二 2008年1月15日  23:45
Used time: 00:10 min

The scan has been done completely.

   1 Scanning directories
   13 Files were scanned
   11 viruses and/or unwanted programs were found
   1 Files were classified as suspicious:
   11 files were deleted
   0 files were repaired
   1 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   0 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-1-16 00:15:08

* avast! 报告
* 这个文件自动被产生
*
* 任务 '简易用户界面' 被使用
* 开始于 2008年1月16日 0:13:11
* VPS: 080114-3, 2008-01-14
*

C:\Documents and Settings\David\桌面\0115[1]\sideb.exe\[Embedded#08060] [L] Win32:EliteBar-D [Trj] (0)
C:\Documents and Settings\David\桌面\0115[1]\sideb.exe [L] Win32:EliteBar-D [Trj] (0)
C:\Documents and Settings\David\桌面\0115[1]\sky.exe\[PECompact]\[Embedded#1] [L] Win32:Baidubar-B [Trj] (0)
C:\Documents and Settings\David\桌面\0115[1]\tsinstall_4_0_4_0_b4.exe\%SYS%\tsuninst.exe [L] Win32:Adware-gen [Adw] (0)
C:\Documents and Settings\David\桌面\0115[1]\tsinstall_4_0_4_0_b4.exe\%MAINDIR%\%TSM% [L] Win32:Tsupdate-C [Trj] (0)
C:\Documents and Settings\David\桌面\0115[1]\tsinstall_4_0_4_0_b4.exe\%MAINDIR%\%TSL% [L] Win32:Tsupdate-E [Trj] (0)
C:\Documents and Settings\David\桌面\0115[1]\tsinstall_4_0_4_0_b4.exe\%MAINDIR%\%TS% [L] Win32:Tsupdate-D [Trj] (0)
C:\Documents and Settings\David\桌面\0115[1]\tsinstall_4_0_4_0_b4.exe\%MAINDIR%\%TSP% [L] Win32:Tsupdate-H [Trj] (0)
C:\Documents and Settings\David\桌面\0115[1]\tsinstall_4_0_4_0_b4.exe [L] Win32:TSUpdate-L [Trj] (0)
C:\Documents and Settings\David\桌面\0115[1]\1.exe\[UPX]\[Embedded#05ef8] [L] Win32:OnLineGames-BSI [Trj] (0)
C:\Documents and Settings\David\桌面\0115[1]\014.exe\[Upack]\[Embedded#03008]\[Embedded#08008]\[Embedded#1a18] [L] Win32:Downloader-RW [Wrm] (0)
C:\Documents and Settings\David\桌面\0115[1]\444.exe\[NsPack]\[Embedded#04060]\[Embedded#4060] [L] Win32:Trojan-gen {Other} (0)
C:\Documents and Settings\David\桌面\0115[1]\7013917092aab932.exe\[Upack]\[Embedded#4010] [L] Win32:Agent-LWQ [Trj] (0)
C:\Documents and Settings\David\桌面\0115[1]\A.exe\$INSTDIR\a.sys [L] Win32:Agent-LAI [Trj] (0)
C:\Documents and Settings\David\桌面\0115[1]\A.exe\$INSTDIR\staA.dll\[UPX] [L] Win32:Agent-NNT [Adw] (0)
C:\Documents and Settings\David\桌面\0115[1]\A.exe\$INSTDIR\winA.dll [L] Win32:Adware-gen [Adw] (0)
C:\Documents and Settings\David\桌面\0115[1]\ahreco.exe [L] Win32:Trojan-gen {Other} (0)
C:\Documents and Settings\David\桌面\0115[1]\crack.exe\[Embedded#3b004] [L] Win32:Adware-gen [Adw] (0)
C:\Documents and Settings\David\桌面\0115[1]\crack.exe\[Embedded#46024] [L] Win32:Adware-gen [Adw] (0)
C:\Documents and Settings\David\桌面\0115[1]\crack.exe\[Embedded#57044] [L] Win32:Adware-gen [Adw] (0)
C:\Documents and Settings\David\桌面\0115[1]\crack.exe\[Embedded#5f064] [L] Win32:Adware-gen [Adw] (0)
C:\Documents and Settings\David\桌面\0115[1]\crack.exe [L] Win32:Adware-gen [Adw] (0)
C:\Documents and Settings\David\桌面\0115[1]\host2.exe\[UPX]\[Embedded#4cf8] [L] Win32:OnLineGames-BSI [Trj] (0)
C:\Documents and Settings\David\桌面\0115[1]\optimize313.exe [L] Win32:Dyfuca-D [Trj] (0)
已感染文件: 24
总共文件: 69
总共文件夹: 1
总共大小: 16.3 MB

* 任务被停止: 2008年1月16日 0:13:31
* 运作时间是 20 秒

显示全部楼层 · 发表于 2008-1-16 00:18:35

TrojanHunter Scan Report - Saved 2008-01-16 00:16

Scanning folder C:\Documents and Settings\David\桌面\0115[1]
Found trojan file: C:\Documents and Settings\David\桌面\0115[1]\setup.exe/Upxrhjcscjj (FraudTool.Avola.102)
Found trojan file: C:\Documents and Settings\David\桌面\0115[1]\sideb.exe (EliteBar.106)
Found trojan file: C:\Documents and Settings\David\桌面\0115[1]\tsinstall_4_0_4_0_b4.exe (TrojanDownloader.TSUpdate.101)
Found trojan file: C:\Documents and Settings\David\桌面\0115[1]\014.exe (Generic.TrojanDownloader.A)
Found trojan file: C:\Documents and Settings\David\桌面\0115[1]\7013917092aab932.exe (Generic.TrojanDownloader.A)
Found adware file: C:\Documents and Settings\David\桌面\0115[1]\crack.exe/EOa.exe (Adware.Agent.201)
Found adware file: C:\Documents and Settings\David\桌面\0115[1]\crack.exe (Adware.Agent.201)
Found trojan file: C:\Documents and Settings\David\桌面\0115[1]\host2.exe/Upxqaookpcg (PWSteal.QQPass.156)
Found adware file: C:\Documents and Settings\David\桌面\0115[1]\optimize313.exe (Adware.AvenueMedia.Dyfuca.108)

[病毒样本] 13个比较老的

本帖子中包含更多资源

本帖子中包含更多资源