最后一包

qianwenxiang

比较大
http://www.mediafire.com/?2mt4t3ok2mz

Graybird

Starting the file scan:

Begin scan in 'E:\Malware4.rar'
E:\Malware4.rar
  [0] Archive type: RAR
  --> s1627.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agent.DGC.5
  --> hot.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> hoytr.exe
      [DETECTION] Contains detection pattern of the dropper DR/PSW.Zapchast.6252
  --> 9kgen_up.int
      [DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
  --> nwubrInsxF.EXE
      [DETECTION] Is the Trojan horse TR/Drop.Gavs
      [1] Archive type: ZIP SFX (self extracting)
      --> SNDSVMC.EXE
          [DETECTION] Is the Trojan horse TR/Dldr.Small.gel
      --> HOCNUNINSTALL.EXE
          [DETECTION] Contains suspicious code HEUR/Malware
      --> HOCNINSTALL.EXE
          [DETECTION] Is the Trojan horse TR/Gavs.ist
      --> ONEOCEAN.DLL
          [DETECTION] Is the Trojan horse TR/Gavs.dllbar
      [WARNING]   The file was ignored!


End of the scan: 2008年1月26日  15:44
Used time: 00:14 min

The scan has been done completely.

      0 Scanning directories
     35 Files were scanned
      8 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     27 Files not concerned
      2 Archives were scanned
      1 Warnings
      0 Notes

醉一生爱妍

LZ是從AVPCLUB轉來的？。

啊弥陀佛

木马名称:Trojan-Dropper.Win32.Agent.bna
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MALWARE4\S1627.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MALWARE4\SSS.EXE
是可疑程序!
试图修改系统时间!
是否阻止该进程继续运行?

qianwenxiang

不是 毒网上搜的些毒 这些比较大 就放到一起了

Joker

20

deleted: Trojan program Trojan-Dropper.Win32.Agent.dgc        File: C:\Documents and Settings\Administrator\×ÀÃæ\Malware4.rar/s1627.exe//PE_Patch.PECompact//PecBundle//PECompact
deleted: Trojan program Trojan-Dropper.Win32.Agent.duo        File: C:\Documents and Settings\Administrator\×ÀÃæ\Malware4.rar/sss.exe
deleted: virus Net-Worm.Win32.Kolab.m        File: C:\Documents and Settings\Administrator\×ÀÃæ\Malware4.rar/hot.exe
deleted: Trojan program Backdoor.IRC.Zapchast        File: C:\Documents and Settings\Administrator\×ÀÃæ\Malware4.rar/hoytr.exe/a
deleted: virus Net-Worm.Win32.Randon.ar        File: C:\Documents and Settings\Administrator\×ÀÃæ\Malware4.rar/hoytr.exe/b
deleted: Trojan program Backdoor.IRC.Sliv.d        File: C:\Documents and Settings\Administrator\×ÀÃæ\Malware4.rar/hoytr.exe/c
deleted: Trojan program Backdoor.IRC.Zapchast        File: C:\Documents and Settings\Administrator\×ÀÃæ\Malware4.rar/hoytr.exe/cl
deleted: virus Net-Worm.Win32.Randon.ar        File: C:\Documents and Settings\Administrator\×ÀÃæ\Malware4.rar/hoytr.exe/d
deleted: Trojan program Backdoor.IRC.Zapchast        File: C:\Documents and Settings\Administrator\×ÀÃæ\Malware4.rar/hoytr.exe/f
deleted: Trojan program Backdoor.IRC.Zapchast        File: C:\Documents and Settings\Administrator\×ÀÃæ\Malware4.rar/hoytr.exe/g
deleted: riskware not-a-virus:Client-IRC.Win32.mIRC.603        File: C:\Documents and Settings\Administrator\×ÀÃæ\Malware4.rar/hoytr.exe/ka6ber.exe//UPX
deleted: riskware not-a-virus:RiskTool.Win32.HideWindows        File: C:\Documents and Settings\Administrator\×ÀÃæ\Malware4.rar/hoytr.exe/norton.exe//FSG
deleted: Trojan program Backdoor.IRC.Zapchast        File: C:\Documents and Settings\Administrator\×ÀÃæ\Malware4.rar/hoytr.exe/o1o2o3o4
deleted: riskware not-a-virus:RiskTool.Win32.HideWindows        File: C:\Documents and Settings\Administrator\×ÀÃæ\Malware4.rar/hoytr.exe/of.exe//UPX
deleted: riskware not-a-virus:PSWTool.Win32.PassView.162        File: C:\Documents and Settings\Administrator\×ÀÃæ\Malware4.rar/hoytr.exe/ps2m.exe//UPX
deleted: Trojan program Backdoor.IRC.Zapchast        File: C:\Documents and Settings\Administrator\×ÀÃæ\Malware4.rar/hoytr.exe/scans
deleted: riskware not-a-virus:RiskTool.Win32.HideWindows        File: C:\Documents and Settings\Administrator\×ÀÃæ\Malware4.rar/hoytr.exe/securaq.exe//PE_Patch.PECompact//PecBundle//PECompact
deleted: Trojan program Backdoor.IRC.Zapchast        File: C:\Documents and Settings\Administrator\×ÀÃæ\Malware4.rar/hoytr.exe/test
deleted: Trojan program Trojan-Downloader.Win32.Small.gel        File: C:\Documents and Settings\Administrator\×ÀÃæ\Malware4.rar/nwubrInsxF.EXE/SNDSVMC.EXE
deleted: Trojan program Trojan-Downloader.Win32.Small.hwl        File: C:\Documents and Settings\Administrator\×ÀÃæ\Malware4.rar/nwubrInsxF.EXE/HOCNINSTALL.EXE

mofunzone

Starting the file scan:

Begin scan in 'C:\TDDOWNLOAD\Malware4'
C:\TDDOWNLOAD\Malware4\
  9kgen_up.int
  hot.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was deleted!
  hoytr.exe
      [DETECTION] Contains detection pattern of the dropper DR/PSW.Zapchast.6252
      [INFO]      The file was deleted!
  nwubrInsxF.EXE
    [0] Archive type: ZIP SFX (self extracting)
    --> FILE0002.DAT
    --> PROGRESS.DLL
    --> OCXREG32.EXE
    --> WISE0001.DLL
    --> W32INST.DLL
    --> FILE0001.DAT
    --> OLEAUT32.DLL
    --> OLEPRO32.DLL
    --> ASYCFILT.DLL
    --> STDOLE2.TLB
    --> MSVBVM60.DLL
    --> REGSVR32.EXE
    --> COMCAT.DLL
    --> MFC42.DLL
    --> MSVCRT40.DLL
    --> MSCOMCTL.OCX
    --> COMDLG32.OCX
    --> VBAR332.DLL
    --> RESTART.EXE
    --> VBSHELL.TLB
    --> SNDSVMC.EXE
        [DETECTION] Is the Trojan horse TR/Dldr.Small.gel
        [WARNING]   Infected files in archives cannot be repaired!
    --> HOCNUNINSTALL.EXE
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> HOCNINSTALL.EXE
        [DETECTION] Is the Trojan horse TR/Gavs.ist
        [WARNING]   Infected files in archives cannot be repaired!
    --> ONEOCEAN.DLL
        [DETECTION] Is the Trojan horse TR/Gavs.dllbar
        [WARNING]   Infected files in archives cannot be repaired!
    --> STDOLE2.TLB
    --> VB6KO.DLL
      [DETECTION] Is the Trojan horse TR/Drop.Gavs
      [INFO]      The file was deleted!
  s1627.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agent.DGC.5
      [INFO]      The file was deleted!
  sss.exe
  tp_map16.int
  upd_admn.int


End of the scan: 2008年1月25日  23:59
Used time: 00:04 min

The scan has been done completely.

      1 Scanning directories
     34 Files were scanned
      7 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      4 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     27 Files not concerned
      1 Archives were scanned
      4 Warnings
      0 Notes

hj5abc

xie e ..

Sign of "Win32:Qhost-AYU [Trj]" has been found in "F:\Malware4.rar\s1627.exe\[PECompact]\bho.dll.zgx" file.  
Sign of "Win32:Qhost-AYU [Trj]" has been found in "F:\Malware4.rar\sss.exe\bho.dll.zgx" file.  
Sign of "Win32:Qhost-AYU [Trj]" has been found in "F:\Malware4.rar\sss.exe" file.  
Sign of "Unix:Malware-gen" has been found in "F:\Malware4.rar\hoytr.exe\a" file.  
Sign of "Win32:Generic-V [Wrm]" has been found in "F:\Malware4.rar\hoytr.exe\b" file.  
Sign of "Unix:Malware-gen" has been found in "F:\Malware4.rar\hoytr.exe\c" file.  
Sign of "IRC:LowJones [Trj]" has been found in "F:\Malware4.rar\hoytr.exe\cl" file.  
Sign of "Win32:Generic-W [Wrm]" has been found in "F:\Malware4.rar\hoytr.exe\d" file.  
Sign of "Win32:IRC-Flood [Drp]" has been found in "F:\Malware4.rar\hoytr.exe\d.dll" file.  
Sign of "Win32:Trojan-gen {UPX}" has been found in "F:\Malware4.rar\hoytr.exe\ka6ber.exe" file.  
Sign of "Win32:Trojan-gen {Other}" has been found in "F:\Malware4.rar\hoytr.exe\norton.exe" file.  
Sign of "Win32:Adware-gen [Adw]" has been found in "F:\Malware4.rar\hoytr.exe\of.exe" file.  
Sign of "Win32:Adware-gen [Adw]" has been found in "F:\Malware4.rar\hoytr.exe\ps2m.exe" file.  
Sign of "Win32:Hidewnd [Tool]" has been found in "F:\Malware4.rar\hoytr.exe\securaq.exe\[PECompact]" file.  
Sign of "IRC:Malware-gen" has been found in "F:\Malware4.rar\hoytr.exe\u" file.  
Sign of "Win32:Trojan-gen {VC}" has been found in "F:\Malware4.rar\nwubrInsxF.EXE\SNDSVMC.EXE" file.  
Sign of "Win32:Trojan-gen {VB}" has been found in "F:\Malware4.rar\nwubrInsxF.EXE\HOCNINSTALL.EXE" file.  
Sign of "Win32:Trojan-gen {Other}" has been found in "F:\Malware4.rar\nwubrInsxF.EXE\ONEOCEAN.DLL" file.  
Sign of "Win32:VB-GBH [Trj]" has been found in "F:\Malware4.rar\nwubrInsxF.EXE" file.

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.DL.Win32.Agent.eqx

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.28.52

冷冷

I:\virus\test\9kgen_up.int
I:\virus\test\hot.exe - Signature 'Generic.Sdbot' found
I:\virus\test\hoytr.exe - Signature 'IRC-Worm.Momma.F' found
I:\virus\test\nwubrInsxF.EXE:\FILE0002.DAT
I:\virus\test\nwubrInsxF.EXE:\PROGRESS.DLL
I:\virus\test\nwubrInsxF.EXE:\OCXREG32.EXE
I:\virus\test\nwubrInsxF.EXE:\WISE0001.DLL
I:\virus\test\nwubrInsxF.EXE:\W32INST.DLL
I:\virus\test\nwubrInsxF.EXE:\FILE0001.DAT
I:\virus\test\nwubrInsxF.EXE:\OLEAUT32.DLL
I:\virus\test\nwubrInsxF.EXE:\OLEPRO32.DLL
I:\virus\test\nwubrInsxF.EXE:\ASYCFILT.DLL
I:\virus\test\nwubrInsxF.EXE:\STDOLE2.TLB
I:\virus\test\nwubrInsxF.EXE:\MSVBVM60.DLL
I:\virus\test\nwubrInsxF.EXE:\REGSVR32.EXE
I:\virus\test\nwubrInsxF.EXE:\COMCAT.DLL
I:\virus\test\nwubrInsxF.EXE:\MFC42.DLL
I:\virus\test\nwubrInsxF.EXE:\MSVCRT40.DLL
I:\virus\test\nwubrInsxF.EXE:\MSCOMCTL.OCX
I:\virus\test\nwubrInsxF.EXE:\COMDLG32.OCX
I:\virus\test\nwubrInsxF.EXE:\VBAR332.DLL
I:\virus\test\nwubrInsxF.EXE:\RESTART.EXE
I:\virus\test\nwubrInsxF.EXE:\VBSHELL.TLB
I:\virus\test\nwubrInsxF.EXE:\SNDSVMC.EXE - Signature 'BehavesLikeTrojan.Downloader' found
I:\virus\test\nwubrInsxF.EXE:\HOCNUNINSTALL.EXE
I:\virus\test\nwubrInsxF.EXE:\HOCNINSTALL.EXE
I:\virus\test\nwubrInsxF.EXE:\ONEOCEAN.DLL
I:\virus\test\nwubrInsxF.EXE:\STDOLE2.TLB
I:\virus\test\nwubrInsxF.EXE:\VB6KO.DLL
I:\virus\test\nwubrInsxF.EXE - Suspect code-parts found (Level: 5)
I:\virus\test\s1627.exe - Signature 'Trojan-Dropper.Win32.Agent.dgc' found
I:\virus\test\sss.exe - Signature 'Virus.Win32.Qhost.AYU' found
I:\virus\test\tp_map16.int
I:\virus\test\upd_admn.int
34 Files scanned
   (1 Archiv with 26 files)
5 Signatures found
1 Suspect code-part found
Used time: 0:00.625
-------------------------------------------------------------------------------

I:\virus\test/hot.exe: PUA.Packed.Themida FOUND
I:\virus\test/hoytr.exe: Trojan.Mybot-6820 FOUND
I:\virus\test/nwubrInsxF.EXE: Suspect.Zip FOUND
----------- SCAN SUMMARY -----------
Known viruses: 197940
Engine version: 0.92
Scanned directories: 1
Scanned files: 8
Infected files: 3
Data scanned: 6.19 MB
Time: 8.343 sec (0 m 8 s)