昨天发给eset的样本

The EQs

其中有一个报的很少

zwl2828

6

C:\Users\Wesley\Downloads\RemoteAbc.zip
  [0] Archive type: ZIP
  --> RemoteAbc/1/gdisvc.exe
      [DETECTION] Is the Trojan horse TR/Click.VB.ZK
  --> RemoteAbc/1/IOLVNN.DLL
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.ckb Backdoor server programs
  --> RemoteAbc/1/ruixing.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
  --> RemoteAbc/1/sxs/sxs.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Blackhole.J.4 Backdoor server programs
  --> RemoteAbc/1/top.exe
      [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.3840.1
  --> RemoteAbc/RemoteAbc/RemoteAbc.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Delf.DNR.1

mofunzone

就这样全灭掉了
Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\RemoteAbc.zip'
C:\Documents and Settings\Administrator\My Documents\
  RemoteAbc.zip
  RemoteAbc.zip:Zone.Identifier
    [0] Archive type: ZIP
    --> RemoteAbc/1/gdisvc.exe
        [DETECTION] Is the Trojan horse TR/Click.VB.ZK
        [WARNING]   Infected files in archives cannot be repaired!
    --> RemoteAbc/1/IOLVNN.DLL
        [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.ckb Backdoor server programs
        [WARNING]   Infected files in archives cannot be repaired!
    --> RemoteAbc/1/ruixing.exe
        [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
        [WARNING]   Infected files in archives cannot be repaired!
    --> RemoteAbc/1/sxs/sxs.exe
        [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Blackhole.J.4 Backdoor server programs
        [WARNING]   Infected files in archives cannot be repaired!
    --> RemoteAbc/1/top.exe
        [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.3840.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> RemoteAbc/RemoteAbc/RemoteAbc.exe
        [DETECTION] Is the Trojan horse TR/Dldr.Delf.DNR.1
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!


End of the scan: 2008年1月28日  15:33
Used time: 00:04 min

The scan has been done completely.

      0 Scanning directories
      8 Files were scanned
      6 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      1 Archives were scanned
      6 Warnings
      0 Notes

鱼是一只我

kv2008～～

Joker

6
deleted: Trojan program Trojan-Clicker.Win32.VB.zk        File: C:\Documents and Settings\Administrator\×ÀÃæ\RemoteAbc.zip/RemoteAbc/1/gdisvc.exe//PE_Patch.UPX//UPX
deleted: Trojan program Backdoor.Win32.PcClient.awe        File: C:\Documents and Settings\Administrator\×ÀÃæ\RemoteAbc.zip/RemoteAbc/1/IOLVNN.DLL
deleted: virus Packed.Win32.Klone.af        File: C:\Documents and Settings\Administrator\×ÀÃæ\RemoteAbc.zip/RemoteAbc/1/ruixing.exe
deleted: Trojan program Backdoor.Win32.BlackHole.j        File: C:\Documents and Settings\Administrator\×ÀÃæ\RemoteAbc.zip/RemoteAbc/1/sxs/sxs.exe
deleted: Trojan program Trojan-Downloader.Win32.Agent.hra        File: C:\Documents and Settings\Administrator\×ÀÃæ\RemoteAbc.zip/RemoteAbc/1/top.exe//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-Downloader.Win32.Delf.dnr        File: C:\Documents and Settings\Administrator\×ÀÃæ\RemoteAbc.zip/RemoteAbc/RemoteAbc/RemoteAbc.exe

zwl2828

原帖由 鱼是一只我 于 2008-1-29 07:34 发表
kv2008～～

江民都全灭了~

红心王子

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.Clicker.Win32.VB.zxb
病毒： Packer.Win32.VmpPacker.a
病毒： Backdoor.Win32.Agent.yrh

MAC 地址：00:1E:4F:91:F4:F0

用户来源：局域网

软件版本：20.29.02

leonfg

现在nod已经全报了！不错

wangjay1980

EQ2的优先级很高啊

是不是上报NOD病毒还要写个陈述报告？

残缺的唯美

扫描统计:
扫描时间: 3秒
扫描选项:
扫描目标: G:\Users\Administrator\Desktop\RemoteAbc.zip
  计数:
扫描的项目总数: 7
- 文件和目录: 7
- 注册表项: 0
- 进程和启动项: 0
- 网络和浏览器项目: 0
- 其他: 0

检测到的安全风险总数: 4
已解决的项目总数: 4
需要注意的项目总数: 0

已解决的风险:
Backdoor.Trojan
病毒 ID: 7586
类型: 已压缩
风险: 高 (高 隐蔽性，高 清除可能，高 性能，高 隐私)  
类别: 病毒
状态: 完全解决
-----------
1 文件
[iolvnn.dll] 位于[g:\users\administrator\desktop\remoteabc.zip] - 已删除


Backdoor.Graybird
病毒 ID: 37689
类型: 已压缩
风险: 高 (高 隐蔽性，高 清除可能，高 性能，高 隐私)  
类别: 病毒
状态: 完全解决
-----------
1 文件
[ruixing.exe] 位于[g:\users\administrator\desktop\remoteabc.zip] - 已删除


W32.SillyFDC
病毒 ID: 35916
类型: 已压缩
风险: 高 (高 隐蔽性，高 清除可能，高 性能，高 隐私)  
类别: 病毒
状态: 完全解决
-----------
1 文件
[sxs.exe] 位于[g:\users\administrator\desktop\remoteabc.zip] - 已删除


Downloader
病毒 ID: 26637
类型: 已压缩
风险: 高 (高 隐蔽性，高 清除可能，高 性能，高 隐私)  
类别: 病毒
状态: 完全解决
-----------
1 文件
[remoteabc.exe] 位于[g:\users\administrator\desktop\remoteabc.zip] - 已删除




未解决的风险: