再来一包17

qianwenxiang

Nerazzurri

扫描进行于：2008-2-2 18:40:27
扫描日志
NOD32版本 2845 (20080202) NT
命令行： C:\Documents and Settings\Nerazzurri\桌面\C.RAR

日期： 2.2.2008  时间：18:40:29
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\Nerazzurri\桌面\C.RAR
C:\Documents and Settings\Nerazzurri\桌面\C.RAR >>RAR >>ntldr.exe - Win32/Anilogo 蠕虫的变种
C:\Documents and Settings\Nerazzurri\桌面\C.RAR >>RAR >>autoexcs.dll - Win32/TrojanClicker.BHO.NAU 木马
C:\Documents and Settings\Nerazzurri\桌面\C.RAR >>RAR >>bot.exe - Win32/TrojanProxy.Wopla.AS 木马
C:\Documents and Settings\Nerazzurri\桌面\C.RAR >>RAR >>bqrqeokn.exe - Win32/PSW.OnLineGames.NLY 木马的变种
C:\Documents and Settings\Nerazzurri\桌面\C.RAR >>RAR >>cblqirgq.dll - Win32/PSW.OnLineGames.NLY 木马的变种
C:\Documents and Settings\Nerazzurri\桌面\C.RAR >>RAR >>DbgHlp32.exe - Win32/PSW.OnLineGames.NFL 木马的变种
C:\Documents and Settings\Nerazzurri\桌面\C.RAR >>RAR >>emhbquvkk.exe - Win32/PSW.OnLineGames.NLY 木马的变种
C:\Documents and Settings\Nerazzurri\桌面\C.RAR >>RAR >>LotusHlp.exe - Win32/PSW.OnLineGames.NFL 木马的变种
C:\Documents and Settings\Nerazzurri\桌面\C.RAR >>RAR >>NAVMon32.exE - Win32/PSW.OnLineGames.NFL 木马的变种
C:\Documents and Settings\Nerazzurri\桌面\C.RAR >>RAR >>PTSShell.exe - 可能是 Win32/PSW.OnLineGames.NFL 木马 的一个变种
C:\Documents and Settings\Nerazzurri\桌面\C.RAR >>RAR >>SHAProc.exe - Win32/PSW.OnLineGames.NFL 木马的变种
C:\Documents and Settings\Nerazzurri\桌面\C.RAR >>RAR >>upxdnd.exe - 可能是 Win32/PSW.OnLineGames.NFL 木马 的一个变种
C:\Documents and Settings\Nerazzurri\桌面\C.RAR >>RAR >>WinForm.exE - Win32/PSW.OnLineGames.NFL 木马的变种
C:\Documents and Settings\Nerazzurri\桌面\C.RAR >>RAR >>NVDispDRV.EXE - Win32/PSW.OnLineGames.NFL 木马的变种
C:\Documents and Settings\Nerazzurri\桌面\C.RAR >>RAR >>Wn_Sys8x.Sys - 可能是 Win32/AutoRun.Q 蠕虫 的一个变种
已扫描的文件数目：17
已发现的病毒数目：15
完成时间： 18:40:35 总扫描时间：6 秒 (00:00:06)

Graybird

Starting the file scan:

Begin scan in 'E:\C.RAR'
E:\C.rar
  [0] Archive type: RAR
  --> ntldr.exe
      [DETECTION] Contains detection pattern of the worm WORM/Cekar.A
  --> autoexcs.dll
      [DETECTION] Is the Trojan horse TR/BHO.Delf.I
  --> bot.exe
      [DETECTION] Is the Trojan horse TR/PSW.Steal.72192
  --> bqrqeokn.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pmw.2
  --> cblqirgq.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> DbgHlp32.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.267
  --> emhbquvkk.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pmw.2
  --> LotusHlp.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.266
  --> NAVMon32.exE
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> PTSShell.exe
      [DETECTION] Is the Trojan horse TR/PSW.Nilage.bxx.2
  --> SHAProc.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> upxdnd.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> WinForm.exE
      [DETECTION] Is the Trojan horse TR/PSW.Online.aav.1
  --> NVDispDRV.EXE
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.prj.1
  --> Wn_Sys8x.Sys
      [DETECTION] Contains detection pattern of the worm WORM/Autorun.FF.27
      [WARNING]   The file was ignored!


End of the scan: 2008年2月2日  18:43
Used time: 00:19 min

The scan has been done completely.

      0 Scanning directories
     18 Files were scanned
     14 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      4 Files not concerned
      1 Archives were scanned
      1 Warnings
      0 Notes

sam.to

已刪除: 病毒 Worm.Win32.AutoRun.bkt        檔案: C:\Documents and Settings\kato9096\桌面\197418.RAR/ntldr.exe//UPack
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.BHO.sb        檔案: C:\Documents and Settings\kato9096\桌面\197418.RAR/autoexcs.dll
已刪除: 特洛伊木馬程式 Trojan-Proxy.Win32.Wopla.as        檔案: C:\Documents and Settings\kato9096\桌面\197418.RAR/bot.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.pmw        檔案: C:\Documents and Settings\kato9096\桌面\197418.RAR/bqrqeokn.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.qbt        檔案: C:\Documents and Settings\kato9096\桌面\197418.RAR/cblqirgq.dll//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.pmw        檔案: C:\Documents and Settings\kato9096\桌面\197418.RAR/emhbquvkk.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.nkq        檔案: C:\Documents and Settings\kato9096\桌面\197418.RAR/NAVMon32.exE//UPack//PE_Patch
已刪除: 特洛伊木馬程式 Trojan.Win32.Vaklik.gq        檔案: C:\Documents and Settings\kato9096\桌面\197418.RAR/NVDispDRV.EXE//UPack//PE_Patch
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.QQPass.atl        檔案: C:\Documents and Settings\kato9096\桌面\197418.RAR/Wn_Sys8x.Sys

9,不报的上报

[ 本帖最后由 kato9096 于 2008-2-2 20:28 编辑 ]

gho

扫描报告
2008年2月2日 18:42:58 - 18:43:01
计算机名称: CN-89FF4B9EA4D6
扫描类型: 扫描指定目标
目标: I:\hanxiaojun\C(1).RAR


--------------------------------------------------------------------------------

结果: 发现15个恶意软件
Worm.Win32.AutoRun.bkt (病毒)
I:\hanxiaojun\C(1).RAR\ntldr.exe
AdWare.Win32.BHO.sb (adware)
I:\hanxiaojun\C(1).RAR\autoexcs.dll
Trojan-Proxy.Win32.Wopla.as (病毒)
I:\hanxiaojun\C(1).RAR\bot.exe
Trojan-PSW.Win32.OnLineGames.pmw (病毒)
I:\hanxiaojun\C(1).RAR\bqrqeokn.exe
I:\hanxiaojun\C(1).RAR\emhbquvkk.exe
Trojan-PSW.Win32.OnLineGames.qbt (病毒)
I:\hanxiaojun\C(1).RAR\cblqirgq.dll
Trojan.Win32.Vaklik.hb (病毒)
I:\hanxiaojun\C(1).RAR\DbgHlp32.exe
Trojan.Win32.Vaklik.hc (病毒)
I:\hanxiaojun\C(1).RAR\LotusHlp.exe
Trojan-PSW.Win32.OnLineGames.nkq (病毒)
I:\hanxiaojun\C(1).RAR\NAVMon32.exE
Trojan-PSW.Win32.Nilage.bxx (病毒)
I:\hanxiaojun\C(1).RAR\PTSShell.exe
Trojan.Win32.Vaklik.ig (病毒)
I:\hanxiaojun\C(1).RAR\SHAProc.exe
Trojan-PSW.Win32.OnLineGames.qfw (病毒)
I:\hanxiaojun\C(1).RAR\upxdnd.exe
Trojan.Win32.Vaklik.gz (病毒)
I:\hanxiaojun\C(1).RAR\WinForm.exE
Trojan.Win32.Vaklik.gq (病毒)
I:\hanxiaojun\C(1).RAR\NVDispDRV.EXE
Trojan-PSW.Win32.QQPass.atl (病毒)
I:\hanxiaojun\C(1).RAR\Wn_Sys8x.Sys

冷冷

IK
I:\virus\C.RAR:\ntldr.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\C.RAR:\autoexcs.dll - Signature 'Trojan.Win32.BHO.e' found
I:\virus\C.RAR:\bot.exe - Signature 'Trojan-Proxy.Win32.Wopla.as' found
I:\virus\C.RAR:\bqrqeokn.exe - Signature 'Trojan-Spy.Win32.Agent.hz' found
I:\virus\C.RAR:\cblqirgq.dll - Signature 'Trojan-Dropper.Win32.Agent.ane' found
I:\virus\C.RAR:\DbgHlp32.exe - Signature 'Trojan-Spy.Win32.Agent.hz' found
I:\virus\C.RAR:\emhbquvkk.exe - Signature 'Trojan-Spy.Win32.Agent.hz' found
I:\virus\C.RAR:\emhbquvkk.exe.hiv
I:\virus\C.RAR:\LotusHlp.exe - Signature 'Trojan-Spy.Win32.Agent.hz' found
I:\virus\C.RAR:\NAVMon32.exE - Signature 'Trojan-Spy.Win32.Agent.hz' found
I:\virus\C.RAR:\PTSShell.exe - Signature 'Trojan-Spy.Win32.Agent.hz' found
I:\virus\C.RAR:\SHAProc.exe - Signature 'Trojan-Spy.Win32.Agent.hz' found
I:\virus\C.RAR:\upxdnd.exe - Signature 'Trojan-Spy.Win32.Agent.hz' found
I:\virus\C.RAR:\WinForm.exE - Signature 'Trojan-Spy.Win32.Agent.hz' found
I:\virus\C.RAR:\NVDispDRV.EXE - Signature 'Trojan-Spy.Win32.Agent.hz' found
I:\virus\C.RAR:\Sy_Win7k.Jmp
I:\virus\C.RAR:\Wn_Sys8x.Sys - Signature 'Trojan-Proxy.Win32.Delf.AN' found
I:\virus\C.RAR

        18 Files scanned
          (1 Archiv with 17 files)
        15 Signatures found
        0 Suspect code-parts found
        Used time: 0:00.281

==============================================================

ClamAV

I:\virus\test/bot.exe: Trojan.Proxy-1826 FOUND
I:\virus\test/bqrqeokn.exe: PUA.Packed.UPack-1 FOUND
I:\virus\test/cblqirgq.dll: PUA.Packed.UPack FOUND
I:\virus\test/DbgHlp32.exe: PUA.Packed.UPack-1 FOUND
I:\virus\test/emhbquvkk.exe: PUA.Packed.UPack-1 FOUND
I:\virus\test/LotusHlp.exe: PUA.Packed.UPack-1 FOUND
I:\virus\test/NAVMon32.exE: PUA.Packed.UPack-1 FOUND
I:\virus\test/ntldr.exe: PUA.Packed.UPack FOUND
I:\virus\test/NVDispDRV.EXE: PUA.Packed.UPack-1 FOUND
I:\virus\test/PTSShell.exe: PUA.Packed.UPack-1 FOUND
I:\virus\test/SHAProc.exe: PUA.Packed.UPack-1 FOUND
I:\virus\test/upxdnd.exe: PUA.Packed.UPack-1 FOUND
I:\virus\test/WinForm.exE: PUA.Packed.UPack-1 FOUND
I:\virus\test/Wn_Sys8x.Sys: Trojan.QQPass-493 FOUND
----------- SCAN SUMMARY -----------
Known viruses: 201991
Engine version: 0.92
Scanned directories: 1
Scanned files: 17
Infected files: 14
Data scanned: 0.73 MB
Time: 6.312 sec (0 m 6 s)

[ 本帖最后由 冷_冷 于 2008-2-2 18:46 编辑 ]

woai_jolin

2008-2-2 18:46:49        Real-time file system protection        file        G:\v\Wn_Sys8x.Sys        probably a variant of Win32/AutoRun.Q worm        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-2-2 18:46:48        Real-time file system protection        file        G:\v\NVDispDRV.EXE        a variant of Win32/PSW.OnLineGames.NFL trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-2-2 18:46:46        Real-time file system protection        file        G:\v\WinForm.exE        a variant of Win32/PSW.OnLineGames.NFL trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-2-2 18:46:45        Real-time file system protection        file        G:\v\upxdnd.exe        probably a variant of Win32/PSW.OnLineGames.NFL trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-2-2 18:46:44        Real-time file system protection        file        G:\v\SHAProc.exe        a variant of Win32/PSW.OnLineGames.NFL trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-2-2 18:46:42        Real-time file system protection        file        G:\v\PTSShell.exe        probably a variant of Win32/PSW.OnLineGames.NFL trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-2-2 18:46:41        Real-time file system protection        file        G:\v\NAVMon32.exE        a variant of Win32/PSW.OnLineGames.NFL trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-2-2 18:46:39        Real-time file system protection        file        G:\v\LotusHlp.exe        a variant of Win32/PSW.OnLineGames.NFL trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-2-2 18:46:38        Real-time file system protection        file        G:\v\emhbquvkk.exe        a variant of Win32/PSW.OnLineGames.NLY trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-2-2 18:46:36        Real-time file system protection        file        G:\v\DbgHlp32.exe        a variant of Win32/PSW.OnLineGames.NFL trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-2-2 18:46:34        Real-time file system protection        file        G:\v\cblqirgq.dll        a variant of Win32/PSW.OnLineGames.NLY trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-2-2 18:46:33        Real-time file system protection        file        G:\v\bqrqeokn.exe        a variant of Win32/PSW.OnLineGames.NLY trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-2-2 18:46:32        Real-time file system protection        file        G:\v\bot.exe        Win32/TrojanProxy.Wopla.AS trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-2-2 18:46:31        Real-time file system protection        file        G:\v\autoexcs.dll        Win32/TrojanClicker.BHO.NAU trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-2-2 18:46:29        Real-time file system protection        file        G:\v\ntldr.exe        a variant of Win32/Anilogo worm        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.

Joker

原帖由 kato9096 于 2008-2-2 18:43 发表
已刪除: 病毒 Worm.Win32.AutoRun.bkt        檔案: C:\Documents and Settings\kato9096\桌面\197418.RAR/ntldr.exe//UPack
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.BHO.sb        檔案: C:\Documents and Settings\kato9096 ...

15
deleted: virus Worm.Win32.AutoRun.bkt File: C:\Documents and Settings\Administrator\×ÀÃæ\C.RAR/ntldr.exe//UPack
deleted: adware not-a-virus:AdWare.Win32.BHO.sb File: C:\Documents and Settings\Administrator\×ÀÃæ\C.RAR/autoexcs.dll
deleted: Trojan program Trojan-Proxy.Win32.Wopla.as File: C:\Documents and Settings\Administrator\×ÀÃæ\C.RAR/bot.exe
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.pmw File: C:\Documents and Settings\Administrator\×ÀÃæ\C.RAR/bqrqeokn.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.qbt File: C:\Documents and Settings\Administrator\×ÀÃæ\C.RAR/cblqirgq.dll//UPack
deleted: Trojan program Trojan.Win32.Vaklik.hb File: C:\Documents and Settings\Administrator\×ÀÃæ\C.RAR/DbgHlp32.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.pmw File: C:\Documents and Settings\Administrator\×ÀÃæ\C.RAR/emhbquvkk.exe//UPack
deleted: Trojan program Trojan.Win32.Vaklik.hc File: C:\Documents and Settings\Administrator\×ÀÃæ\C.RAR/LotusHlp.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.nkq File: C:\Documents and Settings\Administrator\×ÀÃæ\C.RAR/NAVMon32.exE//UPack//PE_Patch
deleted: Trojan program Trojan-PSW.Win32.Nilage.bxx File: C:\Documents and Settings\Administrator\×ÀÃæ\C.RAR/PTSShell.exe//UPack
deleted: Trojan program Trojan.Win32.Vaklik.ig File: C:\Documents and Settings\Administrator\×ÀÃæ\C.RAR/SHAProc.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.qfw File: C:\Documents and Settings\Administrator\×ÀÃæ\C.RAR/upxdnd.exe//UPack
deleted: Trojan program Trojan.Win32.Vaklik.gz File: C:\Documents and Settings\Administrator\×ÀÃæ\C.RAR/WinForm.exE//UPack
deleted: Trojan program Trojan.Win32.Vaklik.gq File: C:\Documents and Settings\Administrator\×ÀÃæ\C.RAR/NVDispDRV.EXE//UPack//PE_Patch
deleted: Trojan program Trojan-PSW.Win32.QQPass.atl File: C:\Documents and Settings\Administrator\×ÀÃæ\C.RAR/Wn_Sys8x.Sys

woai_jolin

2008-2-2 18:50:29        Kernel        File  'G:\v\Sy_Win7k.Jmp' was sent to ESET for analysis.       
2008-2-2 18:50:08        Kernel        File  'G:\v\emhbquvkk.exe.hiv' was sent to ESET for analysis.

挪威的冬天

信息        2008-02-02  18:50:41        您此次查毒共查出13个病毒以及危险代码                       
信息        2008-02-02  18:50:41        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件29个                       
信息        2008-02-02  18:50:41        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
病毒        2008-02-02  18:50:41        C:\Users\挪威的冬天\Desktop\C.RAR\Wn_Sys8x.Sys        Worm.AutoRun.Q.48768        跳过，未处理       
病毒        2008-02-02  18:50:41        C:\Users\挪威的冬天\Desktop\C.RAR\NVDispDRV.EXE        Win32.Troj.OnlineGamesT.ty.98304        跳过，未处理       
病毒        2008-02-02  18:50:41        C:\Users\挪威的冬天\Desktop\C.RAR\WinForm.exE        Win32.Troj.OnlineGamesT.ty.98304        跳过，未处理       
病毒        2008-02-02  18:50:41        C:\Users\挪威的冬天\Desktop\C.RAR\upxdnd.exe        Win32.Troj.OnlineGamesT.ty.98304        跳过，未处理       
病毒        2008-02-02  18:50:41        C:\Users\挪威的冬天\Desktop\C.RAR\SHAProc.exe        Win32.Troj.OnlineGamesT.ky.151552        跳过，未处理       
病毒        2008-02-02  18:50:41        C:\Users\挪威的冬天\Desktop\C.RAR\PTSShell.exe        Win32.Troj.OnlineGamesT.ty.98304        跳过，未处理       
病毒        2008-02-02  18:50:41        C:\Users\挪威的冬天\Desktop\C.RAR\NAVMon32.exE        Win32.PSWTroj.OnLineGames.16545        跳过，未处理       
病毒        2008-02-02  18:50:41        C:\Users\挪威的冬天\Desktop\C.RAR\LotusHlp.exe        Win32.Troj.OnlineGamesT.ty.98304        跳过，未处理       
病毒        2008-02-02  18:50:41        C:\Users\挪威的冬天\Desktop\C.RAR\emhbquvkk.exe        Win32.PSWTroj.OnLineGames.77824        跳过，未处理       
病毒        2008-02-02  18:50:41        C:\Users\挪威的冬天\Desktop\C.RAR\DbgHlp32.exe        Win32.Troj.OnlineGamesT.e.94315        跳过，未处理       
病毒        2008-02-02  18:50:41        C:\Users\挪威的冬天\Desktop\C.RAR\cblqirgq.dll        Win32.Troj.OnlineGamesT.xy.118784        跳过，未处理       
病毒        2008-02-02  18:50:41        C:\Users\挪威的冬天\Desktop\C.RAR\bqrqeokn.exe        Win32.PSWTroj.OnLineGames.77824        跳过，未处理       
病毒        2008-02-02  18:50:41        C:\Users\挪威的冬天\Desktop\C.RAR\ntldr.exe        Win32.Troj.AutoRunT.up.151552        跳过，未处理