6个

显示全部楼层 · 发表于 2008-2-26 21:20:26

Premium Security Suite
Report file date: 2008年2月26日星期二  21:23

Scanning for 1125445 virus strains and unwanted programs.

Version information:
BUILD.DAT    : 8.1.00.74    26052 Bytes 2008-2-18 12:13:00
AVSCAN.EXE : 8.1.2.4       311553 Bytes 2008-2-7 01:15:14
AVSCAN.DLL : 8.1.1.0       53505 Bytes 2008-2-7 01:43:37
LUKE.DLL    : 8.1.1.0       151809 Bytes 2008-1-30 08:11:22
LUKERES.DLL : 8.1.1.0       12033 Bytes 2008-1-29 06:50:22
ANTIVIR0.VDF  : 6.40.0.0    11030528 Bytes 2007-7-18 01:33:43
ANTIVIR1.VDF  : 7.0.1.95    3367424 Bytes  2007-12-14 04:30:16
ANTIVIR2.VDF  : 7.0.2.181    1993728 Bytes 2008-2-24 10:06:07
ANTIVIR3.VDF  : 7.0.2.194    58368 Bytes 2008-2-26 13:15:53
Engineversion : 8.1.0.8
AEVDF.DLL    : 8.1.0.3       86388 Bytes 2008-2-12 00:58:34
AESCRIPT.DLL  : 8.1.0.5       213368 Bytes 2008-2-13 04:44:47
AESCN.DLL    : 8.1.0.1       106834 Bytes 2008-1-30 07:28:55
AERDL.DLL    : 8.1.0.4       422226 Bytes 2008-1-30 07:28:55
AEPACK.DLL : 8.1.0.1       356692 Bytes 2008-1-30 07:28:55
AEOFFICE.DLL  : 8.1.0.2       180567 Bytes 2008-2-12 00:58:34
AEHEUR.DLL : 8.1.0.5    1028470 Bytes 2008-2-12 00:58:34
AEHELP.DLL : 8.1.0.3       106870 Bytes 2008-2-12 00:58:34
AEGEN.DLL    : 8.1.0.3       282996 Bytes 2008-2-12 00:58:33
AEEMU.DLL    : 8.1.0.1       430418 Bytes 2008-1-30 07:28:55
AECORE.DLL : 8.1.0.7       156022 Bytes 2008-2-12 00:58:33
AVWINLL.DLL : 1.0.0.7       14593 Bytes 2008-1-23 07:30:03
AVPREF.DLL : 8.0.0.1       25857 Bytes 2008-2-18 03:37:50
AVREP.DLL    : 7.0.0.1       155688 Bytes 2007-5-9 02:23:22
AVREG.DLL    : 8.0.0.0       30977 Bytes 2008-1-23 10:07:49
AVARKT.DLL : 1.0.0.23    307457 Bytes 2008-2-12 01:29:15
AVEVTLOG.DLL  : 8.0.0.7       102657 Bytes 2008-2-12 01:05:33
SQLITE3.DLL : 3.3.17.1    339968 Bytes 2008-1-22 10:28:02
SMTPLIB.DLL : 1.2.0.19       28929 Bytes 2008-1-23 10:08:39
NETNT.DLL    : 8.0.0.1       7937 Bytes 2008-1-25 05:05:03
RCIMAGE.DLL : 8.0.0.25    3494145 Bytes 2008-2-14 06:35:23
RCTEXT.DLL : 8.0.29.0       86273 Bytes 2008-2-18 04:13:23

Configuration settings for the scan:
Jobname..........................: ShlExt
Configuration file...............: D:\temp\d0c4be08.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: D:,
Scan memory......................: on
Process scan.....................: off
Scan registry....................: off
Search for rootkits..............: off
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: off
Smart extensions.................: on
Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,
Macro heuristic..................: on
File heuristic...................: high
Deviating risk categories........: +APPL,+GAME,+JOKE,+PCK,+SPR,

Start of the scan: 2008年2月26日星期二  21:23

Starting the file scan:

Begin scan in 'D:\TDdownload\net.rar'
D:\TDdownload\net.rar
  [0] Archive type: RAR
--> sta.exe
   --> Object
      [2] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/Dldr.Delf.epw.1
  --> la.exe
   [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> vip.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppu
--> svcos.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
--> ad.cab
   [1] Archive type: CAB (Microsoft)
   --> bd.exe
      --> Object
      [3] Archive type: RSRC
      --> Object
            [DETECTION] Is the Trojan horse TR/Dldr.Delf.epw.1
--> rl.exe
   --> Object
      [2] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/Dldr.Delf.epw.1
   [WARNING] The file was ignored!

End of the scan: 2008年2月26日星期二  21:23
Used time: 00:10 min

The scan has been done completely.

   0 Scanning directories
   8 Files were scanned
   6 viruses and/or unwanted programs were found
   3 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   5 Archives were scanned
   1 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-2-26 21:21:00

C:\Documents and Settings\VIP\桌面\net.rar>>ad.cab>>bd.exe TrojanDownloader.Delf.epw.hvvh 木马还未处理
C:\Documents and Settings\VIP\桌面\net.rar>>la.exe TrojanDownloader.Delf.epw.qpmt 木马还未处理
C:\Documents and Settings\VIP\桌面\net.rar>>rl.exe TrojanDownloader.Delf.epw.hvvh 木马还未处理
C:\Documents and Settings\VIP\桌面\net.rar>>sta.exe TrojanDownloader.Delf.epw.pwyc 木马还未处理
C:\Documents and Settings\VIP\桌面\net.rar>>svcos.exe Heuri.Suspicious.ERNM 启发式扫描还未处理
C:\Documents and Settings\VIP\桌面\net.rar>>vip.exe TrojanPSW.OnlineGames.GEN.gugq 木马还未处理

显示全部楼层 · 发表于 2008-2-26 21:22:44

===================================================================================================
手动扫描器 7.0.0.10

NSE revision 5.91.10
nvcbin.def revision 5.90.00 of 2008/02/25 07:04:57 (1324899 variants)
nvcmacro.def revision 5.90.00 of 2008/02/04 16:47:24 (20430 variants)
Total number of variants: 1345329
===================================================================================================

   Time  Filename                                                    Virus name
---------------------------------------------------------------------------------------------------

- Scanning drive: D:\
- Scanning system areas of drive: D:\
- Scanning files matching: D:\TDdownload\ad.cab
      0 ms D:\TDdownload\ad.cab : bd.exe                               Security Risk W32/Suspicious_N.gen ()
      0 ms D:\TDdownload\ad.cab
- Scanning files matching: D:\TDdownload\la.exe
      0 ms D:\TDdownload\la.exe                                        Trojan W32/Delf.BKCG ()
- Scanning files matching: D:\TDdownload\rl.exe
      0 ms D:\TDdownload\rl.exe                                        Security Risk W32/Suspicious_N.gen ()
- Scanning files matching: D:\TDdownload\sta.exe
   31 ms D:\TDdownload\sta.exe                                     Security Risk W32/Suspicious_U.gen ()
- Scanning files matching: D:\TDdownload\svcos.exe
   16 ms D:\TDdownload\svcos.exe                                     Security Risk W32/Suspicious_U.gen ()
- Scanning files matching: D:\TDdownload\vip.exe
   16 ms D:\TDdownload\vip.exe                                     Trojan W32/Agent.EDOA ()

===================================================================================================

The scanning started: 2008/02/26 21:24:33
            ended: 2008/02/26 21:24:38

Scanning results:
Total number of files found..............................:    7
Number of files scanned..................................:    7
Number of files/directories skipped due to exclude list..:    0
Number of files that could not be opened.................:    0
Number of archive files unpacked.........................:    1
Number of archive files not unpacked.....................:    0
Number of infections.....................................:    6

Copyright (c) 1993-2007 Norman ASA.

显示全部楼层 · 发表于 2008-2-26 21:30:14

费尔扫描出6个

显示全部楼层 · 发表于 2008-2-26 22:10:50

信息 2008-02-26  22:10:47 您此次查毒共查出6个病毒以及危险代码
信息 2008-02-26  22:10:47 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件12个
信息 2008-02-26  22:10:47 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
病毒 2008-02-26  22:10:47 C:\Documents and Settings\Administrator\桌面\net.rar\rl.exe Win32.TrojDownloader.Delf.43008 跳过，未处理
病毒 2008-02-26  22:10:47 C:\Documents and Settings\Administrator\桌面\net.rar\ad.cab\bd.exe Win32.TrojDownloader.Delf.43008 跳过，未处理
病毒 2008-02-26  22:10:47 C:\Documents and Settings\Administrator\桌面\net.rar\svcos.exe Win32.Troj.DownloaderT.pm.36884 跳过，未处理
病毒 2008-02-26  22:10:47 C:\Documents and Settings\Administrator\桌面\net.rar\vip.exe Win32.PSWTroj.OnLineGames.98304 跳过，未处理
病毒 2008-02-26  22:10:47 C:\Documents and Settings\Administrator\桌面\net.rar\la.exe Win32.TrojDownloader.Delf.43008 跳过，未处理
病毒 2008-02-26  22:10:47 C:\Documents and Settings\Administrator\桌面\net.rar\sta.exe Win32.TrojDownloader.Delf.43008 跳过，未处理
信息 2008-02-26  22:10:39 金山毒霸主程序启动查毒过程，查毒方式：命令行查毒
信息 2008-02-26  22:10:38 金山毒霸主程序启动
信息 2008-02-26  20:20:43 金山毒霸主程序退出

显示全部楼层 · 发表于 2008-2-26 22:15:47

-----------------------------SCAN REPORT-----------------------------
F-PROT Antivirus for Windows

Antivirus Scanning Engine version number: 4.4.2
Virus signature file from: 2008-2-26, 4:15

Scan name: Virus tester
Path to scan: C:\Test\|

Normal scan
Also scan: Inside subfolders, Compressed files, Streams

Scan started: 2008-2-26, 22:14:27
---------------------------------------------------------------------

[Error] <Scanning error> F:
[Error] <Scanning error> E:
[Found downloader] <W32/Banload.B.gen!Eldorado (not disinfectable, generic)> C:\Test\net.rar->sta.exe
[Found possible virus] <W32/Downloader-WebExe-based!Maximus (not disinfectable)> C:\Test\net.rar->la.exe->(UPX)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\Test\net.rar->svcos.exe->(UPack)->(PecBundle)
[Found downloader] <W32/Banload.B.gen!Eldorado (not disinfectable, generic)> C:\Test\net.rar->ad.cab->bd.exe->(NSPack)->(PE_Patch)
[Found downloader] <W32/Banload.B.gen!Eldorado (not disinfectable, generic)> C:\Test\net.rar->rl.exe->(NSPack)->(PE_Patch)

---------------------------------------------------------------------
Scan ended: 2008-2-26, 22:14:34
Duration: 0:00:07

Scan result:

Scanned files:    6
Infected objects:    5
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

显示全部楼层 · 发表于 2008-2-26 22:35:56

2008-2-26 22:36:36 Kernel File 'D:\firefox download\net.rar' was sent to ESET for analysis.

显示全部楼层 · 发表于 2008-2-26 23:13:01

FS结果: 找到 6 恶意软件
Trojan-Downloader:W32/Agent.FWK (病毒)
D:\Virus\Test\ad.cab\bd.exe
D:\Virus\Test\la.exe
D:\Virus\Test\rl.exe 操作: 删除
D:\Virus\Test\sta.exe 操作: 删除
Trojan-Downloader.Win32.Delf.epw (病毒)
D:\Virus\Test\svcos.exe 操作: 删除
Trojan-PSW.Win32.OnLineGames.ppu (病毒)
D:\Virus\Test\vip.exe 操作: 删除

显示全部楼层 · 发表于 2008-2-26 23:50:09

显示全部楼层 · 发表于 2008-2-26 23:51:22

全部拿下~~

[病毒样本] 6个

本帖子中包含更多资源