来个

流清泉

http://eynh888.128.tofor.com/hack/zp.exe
http://down.rebornidea.com/game/gameSetup.exe
http://cm999.hostfree.com.cn/tt/QQ2008gj.rar
http://www.vshi.com/VIPdown/setup7_8.exe

[ 本帖最后由 流清泉 于 2008-2-20 16:44 编辑 ]

Graybird

Starting the file scan:

Begin scan in 'E:\Antivir\zp.exe'
E:\Antivir\zp.exe
      [DETECTION] Is the Trojan horse TR/Spy.QQpass
      [INFO]      The file was deleted!
Begin scan in 'E:\Antivir\gameSetup.exe'
E:\Antivir\gameSetup.exe
  [0] Archive type: RAR SFX (self extracting)
  --> my_200801.exe
      [DETECTION] Contains detection pattern of the dropper DR/Dldr.Delf.emu
  --> pv0063.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Zlob.dgf.1
  --> SkypeClient.exe
      [DETECTION] Is the Trojan horse TR/Baidu.H.2
  --> dodolook269.exe
      [DETECTION] Contains detection pattern of the dropper DR/Rbot.155815
      [WARNING]   The file was ignored!
Begin scan in 'E:\Antivir\QQ2008gj.rar'
E:\Antivir\QQ2008gj.rar
  [0] Archive type: RAR
  --> QQ2008×îпÉÓùһúÍâ¹Ò.exe
      [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/Themida). Please verify the origin of the file
      [WARNING]   The file was ignored!

Starting the file scan:
Begin scan in 'E:\Antivir\setup7_8.exe'
E:\Antivir\setup7_8.exe
      [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
      [INFO]      The file was deleted!

The file 'QQ2008################.exe' has been determined to be 'MALWARE'.
Our analysts discovered that the file is a Trojan. In general this kind of programs contains harmful functionality called payload. Detection will be added to our virus definition file (VDF) with one of the next updates. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: PCK/Themida.

The file 'gameSetup.exe' has been determined to be 'MALWARE'.
Our analysts named the threat DR/Agent.LN. The term "DR/" denotes a program that is able to place a virus or a malware discretely on a system.Detection will be added to our virus definition file (VDF) with one of the next updates.

[ 本帖最后由 Graybird 于 2008-2-20 18:44 编辑 ]

taiw_1144

发现未知间谍软件，是否删除？
程序:
C:\DOWNLOADS\ZP.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\LOADMSG.EXE
2) F:\TENCENT\QQ\QQ.EXE
是否删除木马程序及其衍生物?（这个打开QQ微点才会报，明显盗QQ的）

木马名称:Trojan-Downloader.Win32.Delf.iza

程序:
C:\DOCUMENTS AND SETTINGS\WO\LOCAL SETTINGS\TEMP\RARSFX0\MY_200801.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?


程序:
C:\DOCUMENTS AND SETTINGS\WO\LOCAL SETTINGS\TEMP\RAR$EX00.328\QQ2008最新可用挂机外挂.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\WO\LOCAL SETTINGS\TEMP\RAR$EX00.328\FORQQ1.4_CRACKED.EXE
2) C:\WINDOWS\SYSTEM32\5.EXE
3) C:\WINDOWS\WINDOUSCM.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\WO\LOCAL SETTINGS\TEMP\RAR$EX00.328\QQ2008最新可用挂机外挂.EXE
并生成以下文件:
1) D:\AUTORUN.INF
2) C:\WINDOUSCM.EXE
3) C:\AUTORUN.INF

是否删除木马程序及其衍生物?

wangjay1980

detected: Trojan program Trojan-PSW.Win32.QQPass.amf        File: E:\ÏÂÔØ»ùµØ\zp.exe//PE_Patch//UPack
detected: Trojan program Trojan-Dropper.Win32.Agent.bdz        File: E:\ÏÂÔØ»ùµØ\QQ2008gj.rar/QQ2008×îпÉÓùһúÍâ¹Ò.exe
detected: Trojan program Trojan-Downloader.Win32.Delf.emu        File: E:\ÏÂÔØ»ùµØ\gameSetup.exe//data.rar/my_200801.exe//data0003
detected: Trojan program Backdoor.Win32.Rbot.hla        File: E:\ÏÂÔØ»ùµØ\gameSetup.exe//data.rar/dodolook269.exe//data0002
detected: Trojan program Trojan-Downloader.NSIS.Agent.y        File: E:\ÏÂÔØ»ùµØ\setup7_8.exe//NSPack

kkgh

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.DL.Win32.Mnless.zp
病毒： Dropper.Delf.bql         
病毒： Trojan.PSW.Win32.QQPass.yyb

用户来源：互联网

软件版本：20.32.21

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Worm.Win32.Cnt.a         
病毒： Trojan.PSW.Win32.OnlineGames.yjb

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.32.22

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.QQPass.yyb
病毒： Trojan.DL.Win32.Mnless.zp

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.32.22

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Dropper.Delf.bql         

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.32.22