10

sam.to

explorer:
不报
111:
已刪除: 特洛伊木馬程式 Trojan-Clicker.Win32.Agent.px        檔案: C:\Documents and Settings\kato9096\桌面\111.rar/gsvbbu66.dll
backups:
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.nzb        檔案: C:\Documents and Settings\kato9096\桌面\backups.rar/backups\ajfbsu.dll.bak
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.nza        檔案: C:\Documents and Settings\kato9096\桌面\backups.rar/backups\winform.exe.bak//UPack
QQRecorder:
不报

不报的上报卡巴


Hello,

26968.sys, QQRecorder.dll, update.sys, upxdnd.exe.bak

No malicious code were found in these files.

6to4.dll - Trojan.Win32.Agent.eaa,
explorer.exe_ - Trojan-Downloader.Win32.Agent.hmk

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

gsvbbu66.sys - Rootkit.Win32.Agent.ur

This file is already detected. Please update your antivirus bases.

Please quote all when answering.

[ 本帖最后由 kato9096 于 2008-1-17 15:22 编辑 ]

Joker

3 viruses and/or unwanted programs were found

Joker

Filename Result
update.sys  KNOWN CLEAN

The file 'update.sys' has been determined to be 'KNOWN CLEAN'. In particular this means that we could not find any malicious content. Please note that the file is part of 'Windows XP (SP2)'.

Filename Result
26968.sys  CLEAN

spaceplane

nod 4个，蜘蛛3个

风野胤

R:\backups.rar » RAR » backups\ajfbsu.dll.bak - probably a variant of Win32/PSW.OnLineGames.HCV trojan
R:\backups.rar » RAR » backups\winform.exe.bak - a variant of Win32/PSW.OnLineGames.NFL trojan
R:\111.rar » RAR » gsvbbu66.sys - Win32/Agent.ABE trojan
R:\111.rar » RAR » gsvbbu66.dll - Win32/TrojanClicker.BHO.NAT trojan

Graybird

Starting the file scan:

Begin scan in 'E:\explorer.rar'
E:\explorer.rar
  [0] Archive type: RAR
  --> explorer.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.YM
      [WARNING]   The file was ignored!
Begin scan in 'E:\111.rar'
E:\111.rar
  [0] Archive type: RAR
  --> gsvbbu66.sys
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 6to4.dll
      [DETECTION] Is the Trojan horse TR/Agent.49152.N
  --> gsvbbu66.dll
      [DETECTION] Is the Trojan horse TR/Clicker.Agent.PX
      [WARNING]   The file was ignored!
Begin scan in 'E:\backups.rar'
E:\backups.rar
  [0] Archive type: RAR
  --> backups\ajfbsu.dll.bak
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.74
  --> backups\winform.exe.bak
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.74
      [WARNING]   The file was ignored!
Begin scan in 'E:\QQRecorder.rar'


End of the scan: 2008年1月17日  15:29
Used time: 00:22 min

The scan has been done completely.

      0 Scanning directories
     14 Files were scanned
      6 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      8 Files not concerned
      4 Archives were scanned
      3 Warnings
      0 Notes

The file 'update.sys' has been determined to be 'KNOWN CLEAN'. In particular this means that we could not find any malicious content. Please note that the file is part of 'Windows XP (SP2)'.

The file '26968.sys' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.

The file 'upxdnd.exe.bak' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.

The file 'QQRecorder.dll' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.

[ 本帖最后由 Graybird 于 2008-1-17 15:29 编辑 ]

wangjay1980

等你的上报结果

chjy007

AntiVir PersonalEdition Classic Report file date: 星期三 2008年1月16日 22:11 Scanning for 1041443 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Username: Administrator Computer name: WWW-95DB6DA1DD3 Version information: BUILD.DAT : 270 15603 Bytes 2007-09-19 13:32:00 AVSCAN.EXE : 7.0.6.1 290856 Bytes 2007-08-23 06:16:30 AVSCAN.DLL : 7.0.6.0 49192 Bytes 2007-08-16 05:23:52 LUKE.DLL : 7.0.5.3 147496 Bytes 2007-08-14 08:32:48 LUKERES.DLL : 7.0.6.1 10280 Bytes 2007-08-21 05:35:22 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 2007-07-18 12:40:44 ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 2007-12-14 15:20:00 ANTIVIR2.VDF : 7.0.2.0 948736 Bytes 2008-01-15 02:00:40 ANTIVIR3.VDF : 7.0.2.1 2048 Bytes 2008-01-15 02:00:40 AVEWIN32.DLL : 7.6.0.48 3080704 Bytes 2008-01-16 02:00:40 AVWINLL.DLL : 1.0.0.7 14376 Bytes 2007-02-26 03:36:28 AVPREF.DLL : 7.0.2.2 25640 Bytes 2007-07-18 00:39:18 AVREP.DLL : 7.0.0.1 155688 Bytes 2007-04-16 06:16:24 AVPACK32.DLL : 7.6.0.3 360488 Bytes 2008-01-16 02:00:40 AVREG.DLL : 7.0.1.6 30760 Bytes 2007-07-18 00:17:08 AVARKT.DLL : 1.0.0.20 278568 Bytes 2007-08-28 05:26:34 AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 2007-07-18 00:10:20 NETNT.DLL : 7.0.0.0 7720 Bytes 2007-03-08 04:09:44 RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 2007-08-07 05:38:14 RCTEXT.DLL : 7.0.62.0 86056 Bytes 2007-08-21 05:50:38 SQLITE3.DLL : 3.3.17.1 339968 Bytes 2007-07-23 02:37:22 Configuration settings for the scan: Jobname..........................: ShlExt Configuration file...............: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\2ae45934.avp Logging..........................: low Primary action...................: repair Secondary action.................: delete Scan master boot sector..........: off Scan boot sector.................: on Boot sectors.....................: F:, Scan memory......................: on Process scan.....................: off Scan registry....................: off Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: high Start of the scan: 星期三 2008年1月16日 22:11 Starting the file scan: Begin scan in 'F:\病毒\0116.part1.rar' F:\病毒\0116.part1.rar [0] Archive type: RAR --> calc.exe [DETECTION] Is the Trojan horse TR/DNSChanger.apn.10 --> freebsd.exe [DETECTION] Is the Trojan horse TR/DNSChanger.RB.59 --> notepad.exe [DETECTION] Contains suspicious code HEUR/Crypted --> Setup.exe.VIR [DETECTION] Is the Trojan horse TR/Xorer.DF.2 --> 1temp.exe [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen --> 2temp.exe [DETECTION] Is the Trojan horse TR/Spy.Agent.UM.1 --> AlxRes070826.exe [DETECTION] Is the Trojan horse TR/Spy.Agent.UM.1 --> at1.810810.org.dll [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.bms.2 Backdoor server programs --> at1.810810.org.exe [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen --> crsss.exe [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen --> gdisvc.exe [DETECTION] Is the Trojan horse TR/VB.boj --> ldcore.dll [DETECTION] Is the Trojan horse TR/Dldr.Small.dxm.3 --> ONOGUMOBOUN [DETECTION] Is the Trojan horse TR/Drop.Agen.401408 --> rdshost32.exe [DETECTION] Is the Trojan horse TR/Spy.Banker.CIL --> scrsys070826.scr [DETECTION] Is the Trojan horse TR/Spy.Agent.UM.1 --> scrsys16_070826.dll [DETECTION] Is the Trojan horse TR/Spy.Agent.UM.1 --> soundmix.exe [DETECTION] Is the Trojan horse TR/Agent.BAZ [INFO] A backup was created as '47bf10d1.qua' ( QUARANTINE ) [INFO] The file was deleted! Begin scan in 'F:\病毒\0116.part2.rar' F:\病毒\0116.part2.rar [0] Archive type: RAR --> winsys16_070826.dll [DETECTION] Is the Trojan horse TR/Spy.Agent.UM.1 --> winsys32_070826.dll [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen --> winupdbc.exe [DETECTION] Is the Trojan horse TR/Spy.Banker.Gen --> wxptdi.sys [DETECTION] Is the Trojan horse TR/Dldr.Agent.45056 --> ~3_tmp.exe [DETECTION] Is the Trojan horse TR/Drop.Agen.401408 [INFO] A backup was created as '47bf10d2.qua' ( QUARANTINE ) [INFO] The file was deleted! Begin scan in 'F:\病毒\0116.part3.rar' F:\病毒\0116.part3.rar [0] Archive type: RAR --> 000.cfg0.VIR [DETECTION] Is the Trojan horse TR/Xorer.DF.2 --> AntiTool.exe.3702718.VIR [DETECTION] Is the Trojan horse TR/Dldr.Agent.qwa.2 --> AntiTool.exe.VIR [DETECTION] Is the Trojan horse TR/Dldr.Agent.qwa.2 --> dnsq.dll [DETECTION] Contains suspicious code HEUR/Malware --> alg.exe [DETECTION] Is the Trojan horse TR/Dldr.Agent.qwa.2 --> netcfg.000 [DETECTION] Is the Trojan horse TR/Xorer.G --> netcfg.dll [DETECTION] Is the Trojan horse TR/Xorer.G --> smss.exe [DETECTION] Is the Trojan horse TR/Xorer.DF.2 [INFO] A backup was created as '46209483.qua' ( QUARANTINE ) [INFO] The file was deleted! Begin scan in 'F:\病毒\0116.part4.rar' F:\病毒\0116.part4.rar [0] Archive type: RAR --> lsass.exe [DETECTION] Is the Trojan horse TR/Xorer.DF.2 --> ~2_tmp.exe [DETECTION] Is the Trojan horse TR/Dldr.Zlob.Fee.1 [INFO] A backup was created as '47bf10d4.qua' ( QUARANTINE ) [INFO] The file was deleted! End of the scan: 星期三 2008年1月16日 22:11 Used time: 00:04 min The scan has been done completely. 0 Scanning directories 61 Files were scanned 30 viruses and/or unwanted programs were found 2 Files were classified as suspicious: 4 files were deleted 0 files were repaired 4 files were moved to quarantine 0 files were renamed 0 Files cannot be scanned 31 Files not concerned 5 Archives were scanned 0 Warnings 0 Notes

chjy007

End of the scan: 星期三 2008年1月16日  22:11
Used time: 00:04 min
The scan has been done completely.
      0 Scanning directories
     61 Files were scanned
     30 viruses and/or unwanted programs were found
      2 Files were classified as suspicious:
      4 files were deleted
      0 files were repaired
      4 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     31 Files not concerned
      5 Archives were scanned
      0 Warnings
      0 Notes

qigang

不杀！

6/2

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Win32.Undef.bfd   

病毒： Trojan.Win32.Undef.bfd   

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.27.22

5/2

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.GameOL.lgn

病毒： Trojan.PSW.Win32.GameOL.lgn

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.27.22

不杀！

[ 本帖最后由 qigang 于 2008-1-16 22:21 编辑 ]