7个

显示全部楼层 · 发表于 2008-2-29 18:36:48

费尔全杀

显示全部楼层 · 发表于 2008-2-29 18:41:26

7
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.lbb File: C:\Documents and Settings\Administrator\×ÀÃæ\windows.rar/3EC849F38E63.dll
deleted: virus Worm.Win32.AutoRun.crn File: C:\Documents and Settings\Administrator\×ÀÃæ\windows.rar/32875CB4.DLL
deleted: virus Worm.Win32.AutoRun.crn File: C:\Documents and Settings\Administrator\×ÀÃæ\windows.rar/F58AA83C.EXE//PE_Patch//UPack
deleted: Trojan program Rootkit.Win32.Agent.kb File: C:\Documents and Settings\Administrator\×ÀÃæ\windows.rar/symavc32.sys
deleted: Trojan program Trojan.Win32.Agent.fdj File: C:\Documents and Settings\Administrator\×ÀÃæ\windows.rar/glass215.exe
deleted: virus Worm.Win32.AutoRun.crn File: C:\Documents and Settings\Administrator\×ÀÃæ\windows.rar/last.exe//PE_Patch//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.lbb File: C:\Documents and Settings\Administrator\×ÀÃæ\windows.rar/tt1.exe

显示全部楼层 · 发表于 2008-2-29 18:46:49

[0] Archive type: RAR
  --> 3EC849F38E63.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.lbb.1
  --> 32875CB4.DLL
   [DETECTION] Is the Trojan horse TR/Autorun.CA
  --> F58AA83C.EXE
   [DETECTION] Contains detection pattern of the worm WORM/Autorun.crn
  --> symavc32.sys
   [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> glass215.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
  --> last.exe
   [DETECTION] Contains detection pattern of the worm WORM/Autorun.crn
  --> tt1.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.lbb
   [INFO]    The file was deleted!

End of the scan: 2008年2月29日  18:45
Used time: 00:08 min

The scan has been done completely.

   0 Scanning directories
   9 Files were scanned
   7 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes

毒霸2008报3个。

显示全部楼层 · 发表于 2008-2-29 18:59:41

Result: 7 malware found
Trojan-PSW.Win32.OnLineGames.lbb (virus)
C:\Documents and Settings\028222\×ÀÃæ\windows.rar\3EC849F38E63.dll
C:\Documents and Settings\028222\×ÀÃæ\windows.rar\tt1.exe
Worm.Win32.AutoRun.crn (virus)
C:\Documents and Settings\028222\×ÀÃæ\windows.rar\32875CB4.DLL
C:\Documents and Settings\028222\×ÀÃæ\windows.rar\F58AA83C.EXE
C:\Documents and Settings\028222\×ÀÃæ\windows.rar\last.exe
Rootkit.Win32.Agent.kb (virus)
C:\Documents and Settings\028222\×ÀÃæ\windows.rar\symavc32.sys
Trojan.Win32.Agent.fdj (virus)
C:\Documents and Settings\028222\×ÀÃæ\windows.rar\glass215.exe

显示全部楼层 · 发表于 2008-2-29 19:16:18

Beta5

Begin scan in 'C:\Documents and Settings\haha\桌面\windows.rar'
C:\Documents and Settings\haha\桌面\windows.rar
  [0] Archive type: RAR
  --> 3EC849F38E63.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.lbb.1
  --> 32875CB4.DLL
   [DETECTION] Is the Trojan horse TR/Autorun.CA
  --> F58AA83C.EXE
   [DETECTION] Contains detection pattern of the worm WORM/Autorun.crn
  --> symavc32.sys
   [DETECTION] Is the Trojan horse TR/Rootkit.Gen
--> glass215.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
  --> last.exe
   [DETECTION] Contains detection pattern of the worm WORM/Autorun.crn
  --> tt1.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.lbb
   [INFO]    A backup was created as '4835e9ec.qua'  ( QUARANTINE )

显示全部楼层 · 发表于 2008-2-29 19:30:34

Scanning : C:\Test]

C:\Test\windows.rar<RAR>:3EC849F38E63.dll <- Trojan.Psw.Onlinegames.Lbb : No action
C:\Test\windows.rar<RAR>:32875CB4.DLL <- Worm.Autorun.Crn : No action
C:\Test\windows.rar<RAR>:F58AA83C.EXE <- Heur.Win32.I : No action
C:\Test\windows.rar<RAR>:symavc32.sys <- Trojan.Rootkit.Agent.Kb : No action
C:\Test\windows.rar<RAR>:glass215.exe <- Trojan.Rootkit.Agent.Kb : No action
C:\Test\windows.rar<RAR>:glass215.exe<UPX>:glass215.exe <- Trojan.Rootkit.Agent.Kb : No action
C:\Test\windows.rar<RAR>:last.exe <- Heur.Win32.I : No action
C:\Test\windows.rar<RAR>:tt1.exe <- Trojan.Psw.Onlinegames.Lbb : No action
C:\Test\windows.rar<RAR>:tt1.exe<DLLRES>:YU0.exe <- Trojan.Psw.Onlinegames.Lbb : No action

Scanned objects : 12

Infected objects : 9

显示全部楼层 · 发表于 2008-2-29 19:31:11

[Found password stealer] <W32/OnlineGames.B.gen!Eldorado (not disinfectable, generic)> C:\Test\windows.rar->3EC849F38E63.dll
[Found downloader] <W32/Downloader.C.gen!Eldorado (not disinfectable, generic)> C:\Test\windows.rar->32875CB4.DLL
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Test\windows.rar->F58AA83C.EXE->(UPack)
[Found security risk] <W32/Rootkit.AHI (exact, not disinfectable)> C:\Test\windows.rar->symavc32.sys
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Test\windows.rar->last.exe->(UPack)
[Found Trojan] <W32/Trojan2.RNO (exact, not disinfectable)> C:\Test\windows.rar->tt1.exe

---------------------------------------------------------------------
Scan ended: 2008-2-29, 19:30:01
Duration: 0:00:10

Scan result:

Scanned files:    6
Infected objects:    6
Disinfected objects:    0
Quarantined files:    0

显示全部楼层 · 发表于 2008-2-29 19:38:37

BD 4
项目: 32875CB4.DLL
检查档案: E:\pic\_PICtemp\windows.rar
状态: 发现病毒
病毒: Win32.Worm.Winko.I (BD 引擎)
项目: F58AA83C.EXE
检查档案: E:\pic\_PICtemp\windows.rar
状态: 发现病毒
病毒: Win32.Worm.Winko.I (BD 引擎)
项目: last.exe
检查档案: E:\pic\_PICtemp\windows.rar
状态: 发现病毒
病毒: Win32.Worm.Winko.I (BD 引擎)
项目: tt1.exe
检查档案: E:\pic\_PICtemp\windows.rar
状态: 发现病毒
病毒: Trojan.PWS.OnlineGames.NZN (BD 引擎)

显示全部楼层 · 发表于 2008-2-29 20:24:38

C:\Documents and Settings\Administrator\桌面\windows.rar > RAR > F58AA83C.EXE - 可能是 Win32/Genetik 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\windows.rar > RAR > symavc32.sys - Win32/Rootkit.Agent.HU 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\windows.rar > RAR > glass215.exe - Win32/Rootkit.Agent.NEL 特洛伊木马
C:\Documents and Settings\Administrator\桌面\windows.rar > RAR > last.exe - 可能是 Win32/Genetik 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\windows.rar > RAR > tt1.exe - Win32/PSW.OnLineGames.PLR 特洛伊木马的变种

[病毒样本] 7个

本帖子中包含更多资源

5