48 有些可能不是

qianwenxiang

CLAMWIN奇迹般的检测出几个

Scan Started Wed Jan 16 21:37:54 2008
-------------------------------------------------------------------------------

C:\Test\0801\0116\0116\crsss.exe: Trojan.Downloader-11640 FOUND
C:\Test\0801\0116\0116\ldcore.dll: Trojan.Downloader-15672 FOUND
C:\Test\0801\0116\0116\lsass.exe: Trojan.Rox-1 FOUND
C:\Test\0801\0116\0116\ONOGUMOBOUN: Trojan.Downloader-18574 FOUND
C:\Test\0801\0116\0116\Setup.exe.VIR: Trojan.Rox-1 FOUND
C:\Test\0801\0116\0116\smss.exe: Trojan.Rox-1 FOUND
C:\Test\0801\0116\0116\soundmix.exe: Trojan.Agent-2230 FOUND
C:\Test\0801\0116\0116\windivx.dll: Trojan.Downloader-18574 FOUND
C:\Test\0801\0116\0116\winsys32_070826.dll: Adware.Baidu FOUND
C:\Test\0801\0116\0116\winupdbc.exe: Trojan.Bancos-2629 FOUND
C:\Test\0801\0116\0116\wxptdi.sys: Trojan.Agent-10301 FOUND
C:\Test\0801\0116\0116\~: Trojan.Rox-1 FOUND
C:\Test\0801\0116\0116\~2_tmp.exe: Trojan.Zlob-799 FOUND
C:\Test\0801\0116\0116\~3_tmp.exe: Trojan.Downloader-18574 FOUND
C:\Test\0801\0116\0116\000.cfg0.VIR: Trojan.Rox-1 FOUND
----------- SCAN SUMMARY -----------
Known viruses: 191367
Engine version: 0.91.1
Scanned directories: 0
Scanned files: 48
Skipped non-executable files: 0
Infected files: 15
Data scanned: 16.61 MB
Time: 31.000 sec (0 m 31 s)
--------------------------------------
Completed
--------------------------------------

The EQs

C:\Documents and Settings\Don johnson\桌面\0116\000.cfg0.VIR - a variant of Win32/Xorer virus - deleted - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\1temp.exe - a variant of Win32/DoS.Sypak trojan - cleaned by deleting - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\2temp.exe - probably a variant of Win32/Genetik trojan - cleaned by deleting - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\alg.exe - probably a variant of Win32/Xorer virus - deleted - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\AlxRes070826.exe - probably a variant of Win32/Genetik trojan - cleaned by deleting - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\AntiTool.exe.3702718.VIR - probably a variant of Win32/Xorer virus - deleted - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\AntiTool.exe.VIR - probably a variant of Win32/Xorer virus - deleted - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\at1.810810.org.dll - a variant of Win32/DoS.Sypak trojan - cleaned by deleting - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\at1.810810.org.exe - a variant of Win32/DoS.Sypak trojan - cleaned by deleting - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\Autorun.inf.VIR - INF/Autorun virus - deleted - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\calc.exe - Win32/TrojanDownloader.Zlob.BMQ trojan - cleaned by deleting - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\crsss.exe - Win32/AutoRun.K worm - cleaned by deleting - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\freebsd.exe - Win32/TrojanDownloader.Zlob.BMQ trojan - cleaned by deleting - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\gdisvc.exe - a variant of Win32/TrojanClicker.VB.TK trojan - cleaned by deleting - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\kdhks.exe.VIR - Win32/TrojanDownloader.Zlob.BMQ trojan - cleaned by deleting - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\ldcore.dll - Win32/TrojanDownloader.Small.DXM trojan - cleaned by deleting - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\lsass.exe - a variant of Win32/Xorer virus - deleted - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\notepad.exe - Win32/TrojanDownloader.Zlob.BMQ trojan - cleaned by deleting - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\NSIS_Install_igb.exe.VIR » NSIS » NSUtils.dll - Win32/Adware.NaviPromo application - was a part of the deleted object
C:\Documents and Settings\Don johnson\桌面\0116\NSIS_Install_igb.exe.VIR » NSIS » uninst.exe » NSIS » NSUtils.dll - Win32/Adware.NaviPromo application - was a part of the deleted object
C:\Documents and Settings\Don johnson\桌面\0116\NSIS_Install_igb.exe.VIR » NSIS » uninst.exe - Win32/Adware.NaviPromo application - was a part of the deleted object
C:\Documents and Settings\Don johnson\桌面\0116\NSIS_Install_igb.exe.VIR - Win32/Adware.NaviPromo application - deleted - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\ONOGUMOBOUN - Win32/Adware.IeDefender.NAM application - cleaned by deleting - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\rdshost32.exe - a variant of Win32/Spy.Bancos.ZE trojan - cleaned by deleting - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\scrsys070826.scr - probably a variant of Win32/Genetik trojan - cleaned by deleting - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\Setup.exe.VIR - a variant of Win32/Xorer virus - deleted - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\soundmix.exe - Win32/Agent.AEC trojan - cleaned by deleting - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\windivx.dll - Win32/Adware.IeDefender.NAM application - cleaned by deleting - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\winsys32_070826.dll - probably a variant of Win32/Genetik trojan - cleaned by deleting - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\winupdbc.exe » tElock v0.98 - probably a variant of Win32/Spy.Banbra.NED trojan - was a part of the deleted object
C:\Documents and Settings\Don johnson\桌面\0116\winupdbc.exe - probably a variant of Win32/Spy.Banbra.NED trojan - deleted - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\wxptdi.sys - a variant of Win32/Jalous worm - cleaned by deleting - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\~ - a variant of Win32/Xorer virus - deleted - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\~2_tmp.exe - Win32/TrojanDownloader.Delf.OAR trojan - cleaned by deleting - quarantined
C:\Documents and Settings\Don johnson\桌面\0116\~3_tmp.exe - Win32/Adware.IeDefender.NAM application - cleaned by deleting - quarantined

浪滔天

卡巴 7.0.1.321  37个


已清除: 病毒 Virus.Win32.Xorer.dr        文件: F:\病毒样本\0116[1]\~//PE_Patch.UPX//UPX
已删除: 病毒 Virus.Win32.Xorer.dd        文件: F:\病毒样本\0116[1]\netcfg.000
已删除: 病毒 Virus.Win32.Xorer.dd        文件: F:\病毒样本\0116[1]\netcfg.dll
已删除: 病毒 Virus.Win32.Xorer.df        文件: F:\病毒样本\0116[1]\smss.exe//PE_Patch.UPX//UPX
已删除: 病毒 Virus.Win32.Xorer.dr        文件: F:\病毒样本\0116[1]\000.cfg0.VIR//PE_Patch.UPX//UPX
已删除: 病毒 Virus.Win32.Xorer.dr        文件: F:\病毒样本\0116[1]\lsass.exe//PE_Patch.UPX//UPX
已删除: 病毒 Virus.Win32.Xorer.dr        文件: F:\病毒样本\0116[1]\Setup.exe.VIR//PE_Patch.UPX//UPX
已删除: 病毒 Worm.Win32.Downloader.dv        文件: F:\病毒样本\0116[1]\wxptdi.sys
已删除: 广告程序 not-a-virus:AdWare.Win32.MyTool.e        文件: F:\病毒样本\0116[1]\ietoolbar.exe.VIR
已删除: 广告程序 not-a-virus:AdWare.Win32.MyTool.e        文件: F:\病毒样本\0116[1]\tb_ietoolbar_20_web.zip.VIR/ietoolbar.exe
已删除: 广告程序 not-a-virus:AdWare.Win32.MyTool.e        文件: F:\病毒样本\0116[1]\tb_ietoolbar_20_web.zip.VIR/tb_ietoolbar_20_instcount.exe
已删除: 广告程序 not-a-virus:AdWare.Win32.NaviPromo.ce        文件: F:\病毒样本\0116[1]\NSIS_Install_igb.exe.VIR//stream//data0006
已删除: 木马程序 Backdoor.Win32.Agent.bms        文件: F:\病毒样本\0116[1]\1temp.exe//NSPack
已删除: 木马程序 Backdoor.Win32.Agent.bms        文件: F:\病毒样本\0116[1]\at1.810810.org.dll
已删除: 木马程序 Backdoor.Win32.Agent.bms        文件: F:\病毒样本\0116[1]\at1.810810.org.exe//NSPack
已删除: 木马程序 Trojan-Downloader.Win32.Adload.op        文件: F:\病毒样本\0116[1]\ONOGUMOBOUN//ASPack
已删除: 木马程序 Trojan-Downloader.Win32.Adload.op        文件: F:\病毒样本\0116[1]\windivx.dll//ASPack
已删除: 木马程序 Trojan-Downloader.Win32.Adload.op        文件: F:\病毒样本\0116[1]\~3_tmp.exe//PE_Patch.UPX//UPX
已删除: 木马程序 Trojan-Downloader.Win32.Agent.hjg        文件: F:\病毒样本\0116[1]\alg.exe//FSG
已删除: 木马程序 Trojan-Downloader.Win32.Delf.bny        文件: F:\病毒样本\0116[1]\crsss.exe//PE_Patch.UPX//UPX
已删除: 木马程序 Trojan-Downloader.Win32.Small.dxm        文件: F:\病毒样本\0116[1]\ldcore.dll
已删除: 木马程序 Trojan-Downloader.Win32.Zlob.fee        文件: F:\病毒样本\0116[1]\~2_tmp.exe
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.mix        文件: F:\病毒样本\0116[1]\AntiTool.exe.3702718.VIR//PE_Patch.UPX//UPX
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.mix        文件: F:\病毒样本\0116[1]\AntiTool.exe.VIR//PE_Patch.UPX//UPX
已删除: 木马程序 Trojan-Spy.Win32.Agent.bao        文件: F:\病毒样本\0116[1]\winsys32_070826.dll
已删除: 木马程序 Trojan-Spy.Win32.Agent.um        文件: F:\病毒样本\0116[1]\2temp.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-Spy.Win32.Agent.um        文件: F:\病毒样本\0116[1]\AlxRes070826.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-Spy.Win32.Agent.um        文件: F:\病毒样本\0116[1]\scrsys070826.scr//PE_Patch//UPack
已删除: 木马程序 Trojan-Spy.Win32.Agent.um        文件: F:\病毒样本\0116[1]\scrsys16_070826.dll
已删除: 木马程序 Trojan-Spy.Win32.Agent.um        文件: F:\病毒样本\0116[1]\winsys16_070826.dll
已删除: 木马程序 Trojan-Spy.Win32.Bancos.zm        文件: F:\病毒样本\0116[1]\rdshost32.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-Spy.Win32.Banker.cfo        文件: F:\病毒样本\0116[1]\winupdbc.exe//PE_Patch//TeLock
已删除: 木马程序 Trojan.Win32.Agent.aec        文件: F:\病毒样本\0116[1]\soundmix.exe
已删除: 木马程序 Trojan.Win32.DNSChanger.apn        文件: F:\病毒样本\0116[1]\calc.exe
已删除: 木马程序 Trojan.Win32.DNSChanger.apn        文件: F:\病毒样本\0116[1]\kdhks.exe.VIR
已删除: 木马程序 Trojan.Win32.DNSChanger.apo        文件: F:\病毒样本\0116[1]\freebsd.exe
已删除: 木马程序 Trojan.Win32.VB.boj        文件: F:\病毒样本\0116[1]\gdisvc.exe//PE_Patch.UPX//UPX

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Worm.Win32.DiskGen.co   
病毒： Backdoor.Win32.Jusi.bn   
病毒： Trojan.Clicker.Win32.Pophot.au
病毒： Trojan.Clicker.Win32.Pophot.au
病毒： Backdoor.Win32.Jusi.bn   
病毒： Worm.Win32.Small.w      
病毒： Trojan.Win32.Agent.zyu   
病毒： Trojan.DL.Win32.Agent.xes
病毒： Trojan.Spy.Bancos.fuj   
病毒： Worm.Clive.a            
病毒： Trojan.Spy.Banker.GEN   
病毒： Trojan.DL.Win32.Inject.rju
病毒： Trojan.Win32.Delf.yjs   
病毒： Trojan.Win32.ArpCheater.c
病毒： Worm.Win32.DiskGen.cf   
病毒： Worm.Win32.DiskGen.cf   

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.27.22

醉一生爱妍

chjy007

End of the scan: 星期三 2008年1月16日  22:56
Used time: 00:04 min
The scan has been done completely.
      0 Scanning directories
     61 Files were scanned
     30 viruses and/or unwanted programs were found
      2 Files were classified as suspicious:
      4 files were deleted
      0 files were repaired
      4 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     31 Files not concerned
      5 Archives were scanned
      0 Warnings
      0 Notes

spaceplane

NOD 32个，蜘蛛也是32个

nosferatu

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\0116'
C:\Documents and Settings\Administrator\桌面\0116\000.cfg0.VIR
      [DETECTION] Is the Trojan horse TR/Xorer.DF.2
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\1temp.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\2temp.exe
      [DETECTION] Is the Trojan horse TR/Spy.Agent.UM.1
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\alg.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.qwa.2
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\AlxRes070826.exe
      [DETECTION] Is the Trojan horse TR/Spy.Agent.UM.1
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\AntiTool.exe.3702718.VIR
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.qwa.2
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\AntiTool.exe.VIR
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.qwa.2
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\at1.810810.org.dll
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.bms.2 Backdoor server programs
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\at1.810810.org.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\Autorun.inf.VIR
      [DETECTION] Is the Trojan horse TR/Agent.150
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\calc.exe
      [DETECTION] Is the Trojan horse TR/DNSChanger.apn.10
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\crsss.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\dnsq.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '480196dd.qua'!
C:\Documents and Settings\Administrator\桌面\0116\freebsd.exe
      [DETECTION] Is the Trojan horse TR/DNSChanger.RB.59
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\gdisvc.exe
      [DETECTION] Is the Trojan horse TR/VB.boj
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\ietoolbar.exe.VIR
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/MyTool.E.1
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\kdhks.exe.VIR
      [DETECTION] Is the Trojan horse TR/DNSChanger.apn.10
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\ldcore.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Small.dxm.3
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\lsass.exe
      [DETECTION] Is the Trojan horse TR/Xorer.DF.2
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\netcfg.000
      [DETECTION] Is the Trojan horse TR/Xorer.G
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\netcfg.dll
      [DETECTION] Is the Trojan horse TR/Xorer.G
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\notepad.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [INFO]      The file was moved to '480296de.qua'!
C:\Documents and Settings\Administrator\桌面\0116\ONOGUMOBOUN
      [DETECTION] Is the Trojan horse TR/Drop.Agen.401408
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\rdshost32.exe
      [DETECTION] Is the Trojan horse TR/Spy.Banker.CIL
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\scrsys070826.scr
      [DETECTION] Is the Trojan horse TR/Spy.Agent.UM.1
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\scrsys16_070826.dll
      [DETECTION] Is the Trojan horse TR/Spy.Agent.UM.1
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\Setup.exe.VIR
      [DETECTION] Is the Trojan horse TR/Xorer.DF.2
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\smss.exe
      [DETECTION] Is the Trojan horse TR/Xorer.DF.2
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\soundmix.exe
      [DETECTION] Is the Trojan horse TR/Agent.BAZ
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\SrchPlug.dll
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/ZSearch.G
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\tb_ietoolbar_20.dll
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/MyTool.F
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\tb_ietoolbar_20_web.zip.vir
  [0] Archive type: ZIP
  --> ietoolbar.exe
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/MyTool.E.1
  --> tb_ietoolbar_20.dll
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/MyTool.F
  --> tb_ietoolbar_20_instcount.exe
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/MyTool.E.3
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\windivx.dll
      [DETECTION] Is the Trojan horse TR/Drop.Agen.401408
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\winsys16_070826.dll
      [DETECTION] Is the Trojan horse TR/Spy.Agent.UM.1
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\winsys32_070826.dll
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\winupdbc.exe
      [DETECTION] Is the Trojan horse TR/Spy.Banker.Gen
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\wxptdi.sys
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.45056
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\~
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\~2_tmp.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Zlob.Fee.1
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0116\~3_tmp.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agen.401408
      [INFO]      The file was deleted!


End of the scan: 星期四 2008年1月17日  07:42
Used time: 00:11 min

The scan has been done completely.

      1 Scanning directories
     60 Files were scanned
     40 viruses and/or unwanted programs were found
      2 Files were classified as suspicious:
     38 files were deleted
      0 files were repaired
      2 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     20 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

nosferatu

AVG Anti-Spyware - Scan Report（23个）
---------------------------------------------------------

+ Created at:        7:47:45 2008-1-17

+ Scan result:       



C:\Documents and Settings\Administrator\桌面\0116\ietoolbar.exe.VIR -> Adware.MyTool : No action taken.
C:\Documents and Settings\Administrator\桌面\0116\tb_ietoolbar_20_web.zip.VIR/ietoolbar.exe -> Adware.MyTool : No action taken.
C:\Documents and Settings\Administrator\桌面\0116\1temp.exe -> Backdoor.Agent.bms : No action taken.
C:\Documents and Settings\Administrator\桌面\0116\at1.810810.org.dll -> Backdoor.Agent.bms : No action taken.
C:\Documents and Settings\Administrator\桌面\0116\at1.810810.org.exe -> Backdoor.Agent.bms : No action taken.
C:\Documents and Settings\Administrator\桌面\0116\ONOGUMOBOUN -> Downloader.Adload.op : No action taken.
C:\Documents and Settings\Administrator\桌面\0116\windivx.dll -> Downloader.Adload.op : No action taken.
C:\Documents and Settings\Administrator\桌面\0116\~3_tmp.exe -> Downloader.Adload.op : No action taken.
C:\Documents and Settings\Administrator\桌面\0116\crsss.exe -> Downloader.Delf.bny : No action taken.
C:\Documents and Settings\Administrator\桌面\0116\ldcore.dll -> Downloader.Small.dxm : No action taken.
C:\Documents and Settings\Administrator\桌面\0116\~2_tmp.exe -> Downloader.Zlob.fee : No action taken.
C:\Documents and Settings\Administrator\桌面\0116\winsys32_070826.dll -> Logger.Agent.bao : No action taken.
C:\Documents and Settings\Administrator\桌面\0116\2temp.exe -> Logger.Agent.um : No action taken.
C:\Documents and Settings\Administrator\桌面\0116\AlxRes070826.exe -> Logger.Agent.um : No action taken.
C:\Documents and Settings\Administrator\桌面\0116\scrsys070826.scr -> Logger.Agent.um : No action taken.
C:\Documents and Settings\Administrator\桌面\0116\scrsys16_070826.dll -> Logger.Agent.um : No action taken.
C:\Documents and Settings\Administrator\桌面\0116\winsys16_070826.dll -> Logger.Agent.um : No action taken.
C:\Documents and Settings\Administrator\桌面\0116\rdshost32.exe -> Logger.Bancos.zm : No action taken.
C:\Documents and Settings\Administrator\桌面\0116\winupdbc.exe -> Logger.Banker.cfo : No action taken.
C:\Documents and Settings\Administrator\桌面\0116\soundmix.exe -> Trojan.Agent.aec : No action taken.
C:\Documents and Settings\Administrator\桌面\0116\AntiTool.exe.3702718.VIR -> Trojan.OnLineGames.mix : No action taken.
C:\Documents and Settings\Administrator\桌面\0116\AntiTool.exe.VIR -> Trojan.OnLineGames.mix : No action taken.
C:\Documents and Settings\Administrator\桌面\0116\wxptdi.sys -> Worm.Downloader.aw : No action taken.


::Report end

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\0116'
C:\Documents and Settings\Administrator\My Documents\0116\
  .6866266.exe
  000.cfg0.VIR
    [0] Archive type: Runtime Packed
    --> Object
        [DETECTION] Is the Trojan horse TR/Xorer.DF.2
        [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  1temp.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Contains suspicious code HEUR/Malware
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  2temp.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  alg.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Xorer.E.2
      [INFO]      The file was deleted!
  AlxRes070826.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  AntiTool.exe.3702718.VIR
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/Dldr.Xorer.E.2
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  AntiTool.exe.VIR
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/Dldr.Xorer.E.2
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  at1.810810.org.dll
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.bms.2 Backdoor server programs
      [INFO]      The file was deleted!
  at1.810810.org.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Contains suspicious code HEUR/Malware
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  Autorun.inf.VIR
      [DETECTION] Is the Trojan horse TR/Agent.150
      [INFO]      The file was deleted!
  BasePro.dll
  calc.exe
      [DETECTION] Is the Trojan horse TR/DNSChanger.apn.10
      [INFO]      The file was deleted!
  CF06674C-EDA6-48df-B12C-F810984ACF54.exe
  crsss.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was deleted!
  dnsq.dll
    [0] Archive type: Runtime Packed
    --> Object
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  freebsd.exe
      [DETECTION] Is the Trojan horse TR/DNSChanger.RB.59
      [INFO]      The file was deleted!
  gdisvc.exe
      [DETECTION] Is the Trojan horse TR/VB.boj
      [INFO]      The file was deleted!
  Hide.dll
  ietoolbar.exe.VIR
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/MyTool.E.1
      [INFO]      The file was deleted!
  kdhks.exe.VIR
      [DETECTION] Is the Trojan horse TR/DNSChanger.apn.10
      [INFO]      The file was deleted!
  ldcore.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Small.dxm.3
      [INFO]      The file was deleted!
  lsass.exe
    [0] Archive type: Runtime Packed
    --> Object
        [DETECTION] Is the Trojan horse TR/Xorer.DF.2
        [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  netcfg.000
      [DETECTION] Is the Trojan horse TR/Xorer.G
      [INFO]      The file was deleted!
  netcfg.dll
      [DETECTION] Is the Trojan horse TR/Xorer.G
      [INFO]      The file was deleted!
  notepad.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [INFO]      The fund was classified as suspicious.
      [INFO]      The file was moved to '4802a8bb.qua'!
  NSIS_Install_igb.exe.VIR
  ONOGUMOBOUN
      [DETECTION] Is the Trojan horse TR/Drop.Agen.401408
      [INFO]      The file was deleted!
  pack.epk.VIR
  pthreadVC.dll
  rdshost32.exe
      [DETECTION] Is the Trojan horse TR/Spy.Banker.CIL
      [INFO]      The file was deleted!
  scrsys070826.scr
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  scrsys16_070826.dll
      [DETECTION] Is the Trojan horse TR/Spy.Agent.UM.1
      [INFO]      The file was deleted!
  Setup.exe.VIR
    [0] Archive type: Runtime Packed
    --> Object
        [DETECTION] Is the Trojan horse TR/Xorer.DF.2
        [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  smss.exe
      [DETECTION] Is the Trojan horse TR/Xorer.DF.2
      [INFO]      The file was deleted!
  soundmix.exe
      [DETECTION] Is the Trojan horse TR/Agent.BAZ
      [INFO]      The file was deleted!
  SrchPlug.dll
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/ZSearch.G
      [INFO]      The file was deleted!
  tb_ietoolbar_20.dll
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/MyTool.F
      [INFO]      The file was deleted!
  tb_ietoolbar_20_web.zip.VIR
    [0] Archive type: ZIP
    --> addreach.reg
    --> ietoolbar.exe
        [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/MyTool.E.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> ietoolbar.ico
    --> onlyietb.reg
    --> tb_ietoolbar_20.bmp
    --> tb_ietoolbar_20.dll
        [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/MyTool.F
        [WARNING]   Infected files in archives cannot be repaired!
    --> tb_ietoolbar_20_hot.bmp
    --> tb_ietoolbar_20_instcount.exe
        [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/MyTool.E.3
        [WARNING]   Infected files in archives cannot be repaired!
    --> tb_ietoolbar_20_keyword.php
    --> tb_ietoolbar_20_popup.php
    --> tb_ietoolbar_20_suggest.php
    --> tb_ietoolbar_20_uninstall.exe
      [INFO]      The file was deleted!
  Update.dll
  windivx.dll
      [DETECTION] Is the Trojan horse TR/Drop.Agen.401408
      [INFO]      The file was deleted!
  winsys16_070826.dll
      [DETECTION] Is the Trojan horse TR/Spy.Agent.UM.1
      [INFO]      The file was deleted!
  winsys32_070826.dll
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was deleted!
  winupdbc.exe
      [DETECTION] Is the Trojan horse TR/Spy.Banker.Gen
      [INFO]      The file was deleted!
  wxptdi.sys
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.45056
      [INFO]      The file was deleted!
  ~
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [INFO]      The file was deleted!
  ~2_tmp.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Zlob.Fee.1
      [INFO]      The file was deleted!
  ~3_tmp.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agen.401408
      [INFO]      The file was deleted!


End of the scan: 2008年1月16日  16:58
Used time: 00:06 min

The scan has been done completely.

      1 Scanning directories
     60 Files were scanned
     38 viruses and/or unwanted programs were found
      4 Files were classified as suspicious:
     39 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     22 Files not concerned
      8 Archives were scanned
     14 Warnings
      0 Notes