很多个

显示全部楼层 · 发表于 2008-2-28 00:22:09

已刪除: 病毒 Virus.Win32.Xorer.ec 檔案: C:\Documents and Settings\kato9096\桌面\複製 -virus.rar/AUTORUN\pagefile.pif//PE_Patch.UPX//UPX
已刪除: 病毒 Worm.Win32.AutoRun.cks 檔案: C:\Documents and Settings\kato9096\桌面\複製 -virus.rar/avp\avp.exe
已刪除: 病毒 Worm.Win32.AutoRun.cks 檔案: C:\Documents and Settings\kato9096\桌面\複製 -virus.rar/avp\win.exe

不报的上报

显示全部楼层 · 发表于 2008-2-28 00:24:33

江民杀毒软件报告文件
北京江民新科技术有限公司
扫描引擎 11.00.703
病毒库日期 2008-02-27
更新日期 2008-02-28
扫描目标 C:\Documents and Settings\Administrator\桌面\virus.rar
开始时间 2008-02-28 00:23:35
在 C:\Documents and Settings\Administrator\桌面\virus.rar->AUTORUN\AUTORUN.INF 中发现 Trojan/INF.z 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\virus.rar->AUTORUN\pagefile.pif 中发现 Win32/Kdcyy.bl 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\virus.rar->avp\avp.exe 中发现 Worm/AutoRun.ku 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\virus.rar->avp\win.exe 中发现 Worm/AutoRun.kt 病毒, 已删除
正常结束。
扫描结果:
               文件数 :722                               病毒体 :4
               删除 :4                                  解毒 :0
扫描速度(千字节/秒) :9060                            扫描时间 :00:00:19
扫描文件速度(个/秒) :38

显示全部楼层 · 发表于 2008-2-28 00:29:37

FS结果: 找到 4 恶意软件
IRC-Worm.Win32.Delf.as (病毒)
D:\Virus\Test\?セ\SSDPDiscovv.exe 操作: 删除
Worm.Win32.AutoRun.cks (病毒)
D:\Virus\Test\avp\avp.exe 操作: 删除
D:\Virus\Test\avp\win.exe 操作: 删除
Virus:W32/Xorer.D (病毒)
D:\Virus\Test\AUTORUN\pagefile.pif 操作: 删除

显示全部楼层 · 发表于 2008-2-28 00:32:18

winsys目录里的文件不对，好像被江民删了

显示全部楼层 · 发表于 2008-2-28 00:33:33

McAfee Downloader-BFO

显示全部楼层 · 发表于 2008-2-28 01:02:40

winsys和win13死掉了

显示全部楼层 · 发表于 2008-2-28 04:05:45

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\virus.rar'
C:\Documents and Settings\Administrator\My Documents\
  virus.rar
[0] Archive type: RAR
--> �ﾩﾥﾻ\AutoRun.inf
--> �ﾩﾥﾻ\SSDPDiscovv.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
--> AUTORUN\AUTORUN.INF
      [DETECTION] Is the Trojan horse TR/Harnig.WA
      [WARNING] Infected files in archives cannot be repaired!
--> AUTORUN\pagefile.pif
      [DETECTION] Is the Trojan horse TR/Drop.Xorer.C
      [WARNING] Infected files in archives cannot be repaired!
--> avp\avp.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> avp\win.exe
      [DETECTION] Is the Trojan horse TR/Agent.47104.B
      [WARNING] Infected files in archives cannot be repaired!
--> win13\win13.pif
--> winsys\winsys.exe
--> winsys\winsys.inf
--> winsys\winsys.sys
   [WARNING] The file was ignored!
  virus.rar:Zone.Identifier

End of the scan: 2008年2月27日  12:05
Used time: 00:03 min

The scan has been done completely.

   0 Scanning directories
   12 Files were scanned
   4 viruses and/or unwanted programs were found
   1 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   8 Files not concerned
   1 Archives were scanned
   6 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-2-28 08:45:00

木马名称:Trojan.Win32.Genetik.fqq

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$DI00.610\PAGEFILE.PIF
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan.Win32.Genetik.fqq

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.328\AUTORUN\PAGEFILE.PIF
是木马程序!
已成功阻止其运行,是否要删除此文件?

蠕虫名称:Worm.Win32.AutoRun.akf

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.328\AVP\AVP.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?

蠕虫名称:Worm.Win32.AutoRun.akm

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.328\AVP\WIN.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan.Win32.Genetik.fqq

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX05.844\AUTORUN\PAGEFILE.PIF
是木马程序!
已成功阻止其运行,是否要删除此文件?

蠕虫名称:Worm.Win32.AutoRun.akf

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX05.844\AVP\AVP.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan.Win32.Genetik.fqq

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX09.672\AUTORUN\PAGEFILE.PIF
是木马程序!
已成功阻止其运行,是否要删除此文件?

发现未知间谍软件，是否删除？
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX09.672\样本\SSDPDISCOVV.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\SSDPDISCOVV.EXE
是否删除木马程序及其衍生物?

[ 本帖最后由 taiw_1144 于 2008-2-28 08:46 编辑 ]

显示全部楼层 · 发表于 2008-2-28 10:08:16

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Worm.Win32.DiskGen.geu
病毒： Worm.Win32.DownLoad.geu
病毒： Worm.Win32.DownLoad.ges

用户来源：互联网

软件版本：20.33.22

显示全部楼层 · 发表于 2008-2-28 10:34:32

Start of the scan: 2008年2月28日  10:34

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\virus.rar'
C:\Documents and Settings\Administrator\桌面\virus.rar
  [0] Archive type: RAR
  --> ý©¥»\SSDPDiscovv.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> AUTORUN\AUTORUN.INF
   [DETECTION] Is the Trojan horse TR/Harnig.WA
  --> AUTORUN\pagefile.pif
   [DETECTION] Is the Trojan horse TR/Drop.Xorer.C
  --> avp\avp.exe
   [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> avp\win.exe
   [DETECTION] Is the Trojan horse TR/Agent.47104.B
   [INFO]    A backup was created as '48381e02.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!

[病毒样本] 很多个

本帖子中包含更多资源

本帖子中包含更多资源