13个

显示全部楼层 · 发表于 2008-2-2 18:36:52

某位好人上报下卡巴吧。。
deleted: Trojan program Trojan-Downloader.Win32.Small.hwl File: C:\Documents and Settings\Administrator\×ÀÃæ\system3202.rar/~GLH0008.TMP
deleted: Trojan program Trojan-Downloader.Win32.Small.hwl File: C:\Documents and Settings\Administrator\×ÀÃæ\system3202.rar/hocninstall.exe
deleted: Trojan program Backdoor.Win32.Agent.egr File: C:\Documents and Settings\Administrator\×ÀÃæ\system3202.rar/datemercy.exe
deleted: Trojan program Trojan-Downloader.Win32.Small.gel File: C:\Documents and Settings\Administrator\×ÀÃæ\system3202.rar/sndsvmc.exe
deleted: Trojan program Trojan-Downloader.Win32.Small.hzn File: C:\Documents and Settings\Administrator\×ÀÃæ\system3202.rar/~GLH000a.TMP
deleted: Trojan program Trojan-Downloader.Win32.Small.hzn File: C:\Documents and Settings\Administrator\×ÀÃæ\system3202.rar/oneocean.dll

显示全部楼层 · 发表于 2008-2-2 18:38:49

8个

Starting the file scan:

Begin scan in 'E:\system3202.rar'
E:\system3202.rar
  [0] Archive type: RAR
  --> ~GLH0006.TMP
   [DETECTION] Contains suspicious code HEUR/Malware
  --> ~GLH0008.TMP
   [DETECTION] Is the Trojan horse TR/Gavs.ist
  --> hocninstall.exe
   [DETECTION] Is the Trojan horse TR/Gavs.ist
  --> hocnuninstall.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> datemercy.exe
   [DETECTION] Is the Trojan horse TR/Agent.sca
  --> sndsvmc.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Small.gel
  --> ~GLH000a.TMP
   [DETECTION] Is the Trojan horse TR/Gavs.dllbar
  --> oneocean.dll
   [DETECTION] Is the Trojan horse TR/Gavs.dllbar
   [WARNING] The file was ignored!

显示全部楼层 · 发表于 2008-2-2 18:39:14

扫描报告
2008年2月2日 18:38:59 - 18:39:01
计算机名称: CN-89FF4B9EA4D6
扫描类型: 扫描指定目标
目标: I:\hanxiaojun\system3202.rar

--------------------------------------------------------------------------------

结果: 发现6个恶意软件
Trojan-Downloader.Win32.Small.hwl (病毒)
I:\hanxiaojun\system3202.rar\~GLH0008.TMP
I:\hanxiaojun\system3202.rar\hocninstall.exe
Backdoor.Win32.Agent.egr (病毒)
I:\hanxiaojun\system3202.rar\datemercy.exe
Trojan-Downloader.Win32.Small.gel (病毒)
I:\hanxiaojun\system3202.rar\sndsvmc.exe
Trojan-Downloader.Win32.Small.hzn (病毒)
I:\hanxiaojun\system3202.rar\~GLH000a.TMP
I:\hanxiaojun\system3202.rar\oneocean.dll

显示全部楼层 · 发表于 2008-2-2 18:40:50

IK
I:\virus\system3202.rar:\~GLH0001.TMP
I:\virus\system3202.rar:\~GLH0006.TMP
I:\virus\system3202.rar:\~GLH0008.TMP
I:\virus\system3202.rar:\hocninstall.exe
I:\virus\system3202.rar:\hocnuninstall.exe
I:\virus\system3202.rar:\datemercy.exe - Signature 'Virus.Win32.Agent.GJW' found
I:\virus\system3202.rar:\sndsvmc.exe - Signature 'BehavesLikeTrojan.Downloader' found
I:\virus\system3202.rar:\Vbshell.tlb
I:\virus\system3202.rar:\~GLH000d.TMP
I:\virus\system3202.rar:\~GLH0002.TMP
I:\virus\system3202.rar:\~GLH000a.TMP - Signature 'Trojan-Downloader.Win32.Small.hzn' found
I:\virus\system3202.rar:\oneocean.dll - Signature 'Trojan-Downloader.Win32.Small.hzn' found
I:\virus\system3202.rar:\~GLH0003.TMP
I:\virus\system3202.rar

14 Files scanned
(1 Archiv with 13 files)
4 Signatures found
0 Suspect code-parts found
Used time: 0:00.281

显示全部楼层 · 发表于 2008-2-2 18:41:01

Scan Log
Version of virus signature database: 2845 (20080202)
Date: 2008-2-2 Time: 18:40:27
Scanned disks, folders and files: G:\v\system3202.rar
G:\v\system3202.rar » RAR » ~GLH0001.TMP - is OK
G:\v\system3202.rar » RAR » ~GLH0006.TMP - is OK
G:\v\system3202.rar » RAR » ~GLH0008.TMP - is OK
G:\v\system3202.rar » RAR » hocninstall.exe - is OK
G:\v\system3202.rar » RAR » hocnuninstall.exe - is OK
G:\v\system3202.rar » RAR » datemercy.exe - is OK
G:\v\system3202.rar » RAR » sndsvmc.exe - probably a variant of Win32/TrojanDownloader.Small trojan - was a part of the deleted object
G:\v\system3202.rar » RAR » Vbshell.tlb - is OK
G:\v\system3202.rar » RAR » ~GLH000d.TMP - is OK
G:\v\system3202.rar » RAR » ~GLH0002.TMP - is OK
G:\v\system3202.rar » RAR » ~GLH000a.TMP - is OK
G:\v\system3202.rar » RAR » oneocean.dll - is OK
G:\v\system3202.rar » RAR » ~GLH0003.TMP - is OK
Number of scanned objects: 14
Number of threats found: 1
Time of completion: 18:40:29 Total scanning time: 2 sec (00:00:02)

显示全部楼层 · 发表于 2008-2-2 18:41:43

已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Small.hwl 檔案: C:\Documents and Settings\kato9096\桌面\197413.rar/~GLH0008.TMP
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Small.hwl 檔案: C:\Documents and Settings\kato9096\桌面\197413.rar/hocninstall.exe
已刪除: 特洛伊木馬程式 Backdoor.Win32.Agent.egr 檔案: C:\Documents and Settings\kato9096\桌面\197413.rar/datemercy.exe
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Small.gel 檔案: C:\Documents and Settings\kato9096\桌面\197413.rar/sndsvmc.exe
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Small.hzn 檔案: C:\Documents and Settings\kato9096\桌面\197413.rar/~GLH000a.TMP
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Small.hzn 檔案: C:\Documents and Settings\kato9096\桌面\197413.rar/oneocean.dll

不报的上报

显示全部楼层 · 发表于 2008-2-2 18:44:25

2008-2-2 18:47:57 Kernel File  'G:\v\~GLH000d.TMP' was sent to ESET for analysis.
2008-2-2 18:47:39 Kernel File  'G:\v\~GLH0003.TMP' was sent to ESET for analysis.
2008-2-2 18:46:40 Kernel File  'G:\v\~GLH0002.TMP' was sent to ESET for analysis.
2008-2-2 18:46:19 Kernel File  'G:\v\Vbshell.tlb' was sent to ESET for analysis.
2008-2-2 18:46:06 Kernel File  'G:\v\~GLH0001.TMP' was sent to ESET for analysis.
2008-2-2 18:42:56 Kernel File  'G:\v\~GLH000a.TMP' was sent to ESET for analysis.
2008-2-2 18:42:18 Kernel File  'G:\v\~GLH0006.TMP' was sent to ESET for analysis.
2008-2-2 18:42:06 Kernel File  'G:\v\hocninstall.exe' was sent to ESET for analysis.
2008-2-2 18:41:50 Kernel File  'G:\v\datemercy.exe' was sent to ESET for analysis.

[ 本帖最后由 woai_jolin 于 2008-2-2 18:48 编辑 ]

显示全部楼层 · 发表于 2008-2-2 18:47:01

The file '~GLH0001.TMP' has been determined to be 'KNOWN CLEAN'. In particular this means that we could not find any malicious content. Please note that the file is part of 'VMware Workstation 5.5.1-19175'.

The file 'hocnuninstall.exe' has been determined to be 'FALSE POSITIVE'. In particular this means that this file is not malicious but a false alarm. Detection will be removed from our virus definition file (VDF) with one of the next updates.

The file 'Vbshell.tlb' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.

The file '~GLH000d.TMP' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.

The file '~GLH0002.TMP' has been determined to be 'KNOWN CLEAN'. In particular this means that we could not find any malicious content. Please note that the file is part of 'Dirty Little Helper '.

The file '~GLH0003.TMP' has been determined to be 'KNOWN CLEAN'. In particular this means that we could not find any malicious content. Please note that the file is part of 'Windows 98'.

显示全部楼层 · 发表于 2008-2-2 18:51:32

剩下的2008-2-2 18:50:03 Kernel File 'G:\v\v.rar' was sent to ESET for analysis.

[病毒样本] 13个

本帖子中包含更多资源

回复 3楼 Graybird 的帖子