华军软件园，小红伞报

alexto1926

http://bfidc.onlinedown.net/

大家看看是否是误报。

zdlzp

报了

hshhua01

进不去。

spaceplane

进不去了

wst1975

进不去

冷冷

SBie泡泡
简要：




下载回来的木马1[1]被调用


忘了吧ntuser打包。。。

[ 本帖最后由 冷_冷 于 2008-2-3 14:06 编辑 ]

Graybird

Starting the file scan:

Begin scan in 'E:\Content.IE5.rar'
E:\Content.IE5.rar
  [0] Archive type: RAR
  --> xxx[1].exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.ijw
  --> 1[1].exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.ijw
  --> 14[1].exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.YM
  --> cs[1].exe
      [DETECTION] Is the Trojan horse TR/Drop.Agent.11828
  --> jh[1].exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> tl[1].exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
  --> wd[1].exe
      [DETECTION] Is the Trojan horse TR/PSW.Delf.aob
  --> wm[1].exe
      [DETECTION] Is the Trojan horse TR/Drop.Agent.12210
      [WARNING]   The file was ignored!
Begin scan in 'E:\Temp.rar'
E:\Temp.rar
  [0] Archive type: RAR
  --> Temp\MicroSofts.pif
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.ijw
  --> Temp\tl[1]lt.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> Temp\wd[1]dw.dll
      [DETECTION] Is the Trojan horse TR/PSW.Delf.aoa
  --> Temp\~Fa32.tmp
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.ijw
  --> Temp\~Fa33.tmp
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.ijw
  --> Temp\~Fa34.tmp
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.ijw
      [WARNING]   The file was ignored!


End of the scan: 2008年2月3日  14:03
Used time: 00:23 min

The scan has been done completely.

      0 Scanning directories
     19 Files were scanned
     13 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      6 Files not concerned
      2 Archives were scanned
      2 Warnings
      0 Notes

The file 'MicroSofts.vbs' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.

The file 'tmp36.tmp' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.

[ 本帖最后由 Graybird 于 2008-2-3 14:06 编辑 ]

挪威的冬天

信息        2008-02-03  14:05:20        您此次查毒共查出12个病毒以及危险代码                       
信息        2008-02-03  14:05:20        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件32个                       
信息        2008-02-03  14:05:20        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
病毒        2008-02-03  14:05:20        C:\Users\挪威的冬天\Desktop\Content.IE5.rar\wd[1].exe        Win32.Troj.DownloaderT.m.101715        跳过，未处理       
病毒        2008-02-03  14:05:20        C:\Users\挪威的冬天\Desktop\Content.IE5.rar\tl[1].exe        Win32.Troj.DownloaderT.m.101715        跳过，未处理       
病毒        2008-02-03  14:05:20        C:\Users\挪威的冬天\Desktop\Content.IE5.rar\jh[1].exe        Win32.Troj.OnlineGamesT.nr.37008        跳过，未处理       
病毒        2008-02-03  14:05:20        C:\Users\挪威的冬天\Desktop\Content.IE5.rar\cs[1].exe        Win32.PSWTroj.OnLineGames.57344        跳过，未处理       
病毒        2008-02-03  14:05:20        C:\Users\挪威的冬天\Desktop\Content.IE5.rar\14[1].exe        Win32.Troj.DropDown.vv.77824        跳过，未处理       
病毒        2008-02-03  14:05:20        C:\Users\挪威的冬天\Desktop\Content.IE5.rar\1[1].exe        Win32.Troj.MachDogT.hl.98304        跳过，未处理       
病毒        2008-02-03  14:05:20        C:\Users\挪威的冬天\Desktop\Content.IE5.rar\xxx[1].exe        Win32.Troj.MachDogT.hl.98304        跳过，未处理       
病毒        2008-02-03  14:05:20        C:\Users\挪威的冬天\Desktop\Temp.rar\Temp\~Fa34.tmp        Win32.Troj.DownLoaderT.ib.997376        跳过，未处理       
病毒        2008-02-03  14:05:20        C:\Users\挪威的冬天\Desktop\Temp.rar\Temp\~Fa33.tmp        Win32.Troj.DownLoaderT.ib.997376        跳过，未处理       
病毒        2008-02-03  14:05:20        C:\Users\挪威的冬天\Desktop\Temp.rar\Temp\~Fa32.tmp        Win32.Troj.DownLoaderT.ib.997376        跳过，未处理       
病毒        2008-02-03  14:05:20        C:\Users\挪威的冬天\Desktop\Temp.rar\Temp\wd[1]dw.dll        Win32.PSWTroj.Delf.28384        跳过，未处理       
病毒        2008-02-03  14:05:20        C:\Users\挪威的冬天\Desktop\Temp.rar\Temp\MicroSofts.pif        Win32.Troj.MachDogT.hl.98304        跳过，未处理

spaceplane

AVAST 12

qigang

1)http://bfidc.onlinedown.net/images/css1.css
2)http://bfidc.onlinedown.net/newhuagg/adhuajun6.js
3)http://bfidc.onlinedown.net/adhuajun2.js
4)http://bfidc.onlinedown.net/newhuagg/999aadbak.js
5)http://bfidc.onlinedown.net/newhuagg/21cn1.js
6)http://bfidc.onlinedown.net/newhuagg/newhua_banner.js
7)http://bfidc.onlinedown.net/newhuagg/pcsoft_banner.js
8)http://bfidc.onlinedown.net/newhuagg/News_New_Softnews.js.js
9)http://bfidc.onlinedown.net/newhuagg/News_New_net.js.js
10)http://bfidc.onlinedown.net/newhuagg/News_new_hard.js.js
11)http://bfidc.onlinedown.net/newhuagg/flash.js
12)http://bfidc.onlinedown.net/images/hittop.js
13)http://bfidc.onlinedown.net/newhuagg/News_New_Skill.js.js
14)http://bfidc.onlinedown.net/newhuagg/News_New_test.js.js
15)http://bfidc.onlinedown.net/newhuagg/News_new_diy.js.js
16)http://bfidc.onlinedown.net/newhuagg/News_new_digital.js.js
17)http://bfidc.onlinedown.net/newhuagg/News_New_games.js.js
18)http://bfidc.onlinedown.net/newhuagg/News_New_Design.js.js
19)http://bfidc.onlinedown.net/newhuagg/News_New_Deve.js.js
20)http://bfidc.onlinedown.net/newhuagg/wp-newhua.js
21)http://www.ectrust.cn/seal/LogoAuth.aspx?authid=1000013
22)http://61.232.206.218/click.js?user_id=70002&l=504
23)http://61.232.206.218/click.js?user_id=70000&l=504
24)http://bfidc.onlinedown.net/newhuagg/adhuajun6.js
25)http://bfidc.onlinedown.net/adhuajun2.js
26)http://bfidc.onlinedown.net/newhuagg/999aadbak.js
27)http://bfidc.onlinedown.net/newhuagg/21cn1.js
28)http://bfidc.onlinedown.net/newhuagg/newhua_banner.js
29)http://bfidc.onlinedown.net/newhuagg/pcsoft_banner.js
30)http://bfidc.onlinedown.net/newhuagg/News_New_Softnews.js.js
31)http://bfidc.onlinedown.net/newhuagg/News_New_net.js.js
32)http://bfidc.onlinedown.net/newhuagg/News_new_hard.js.js
33)http://bfidc.onlinedown.net/newhuagg/flash.js
34)http://bfidc.onlinedown.net/images/hittop.js
35)http://bfidc.onlinedown.net/newhuagg/News_New_Skill.js.js
36)http://bfidc.onlinedown.net/newhuagg/News_New_test.js.js
37)http://bfidc.onlinedown.net/newhuagg/News_new_diy.js.js
38)http://bfidc.onlinedown.net/newhuagg/News_new_digital.js.js
39)http://bfidc.onlinedown.net/newhuagg/News_New_games.js.js
40)http://bfidc.onlinedown.net/newhuagg/News_New_Design.js.js
41)http://bfidc.onlinedown.net/newhuagg/News_New_Deve.js.js
42)http://bfidc.onlinedown.net/newhuagg/wp-newhua.js
43)http://www.ectrust.cn/seal/LogoAuth.aspx?authid=1000013
44)http://61.232.206.218/click.js?user_id=70002&l=504
45)http://61.232.206.218/click.js?user_id=70000&l=504
46)bfidc.onlinedown.net/