15 PCS

显示全部楼层 · 发表于 2008-3-1 16:54:31

第二部分

显示全部楼层 · 发表于 2008-3-1 16:56:38

已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Agent.kdv 檔案: C:\Documents and Settings\kato9096\桌面\002\21[1].kdg//data0002
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.Cinmus.bjh 檔案: C:\Documents and Settings\kato9096\桌面\002\acpidisk.sys
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Delf.bmx 檔案: C:\Documents and Settings\kato9096\桌面\002\bobo.exe//data0003
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Delf.bmx 檔案: C:\Documents and Settings\kato9096\桌面\002\bpbp[1].exe
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Delf.bmx 檔案: C:\Documents and Settings\kato9096\桌面\002\bq10.exe
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.BHO.te 檔案: C:\Documents and Settings\kato9096\桌面\002\cpush.dll
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.Cinmus.bjh 檔案: C:\Documents and Settings\kato9096\桌面\002\dodolook029.exe//stream//data0002//data0004
已刪除: 特洛伊木馬程式 Backdoor.Win32.Delf.ash 檔案: C:\Documents and Settings\kato9096\桌面\002\Rpcs.exe
已刪除: 特洛伊木馬程式 Backdoor.Win32.Delf.ash 檔案: C:\Documents and Settings\kato9096\桌面\002\servciesd.exe
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.BHO.aai 檔案: C:\Documents and Settings\kato9096\桌面\002\UPD82.tmp
已刪除: 特洛伊木馬程式 Backdoor.Win32.Delf.ash 檔案: C:\Documents and Settings\kato9096\桌面\002\weiwei[1].exe

11，不报的上报

显示全部楼层 · 发表于 2008-3-1 16:58:21

扫描系统区域...
扫描所选择的目录和文件...
对象: acpidisk.sys
在压缩档案里: C:\Documents and Settings\Administrato\桌面\002.rar
状态: 已发现病毒
病毒: not-a-virus:AdWare.Win32.Cinmus.bjh (KAV 引擎)
对象: dodolook029.exe/stream/data0002 data0004
在压缩档案里: C:\Documents and Settings\Administrato\桌面\002.rar
状态: 已发现病毒
病毒: not-a-virus:AdWare.Win32.Cinmus.bjh (KAV 引擎)
对象: cpush.dll
在压缩档案里: C:\Documents and Settings\Administrato\桌面\002.rar
状态: 已发现病毒
病毒: not-a-virus:AdWare.Win32.BHO.te (KAV 引擎)
对象: UPD82.tmp
在压缩档案里: C:\Documents and Settings\Administrato\桌面\002.rar
状态: 已发现病毒
病毒: not-a-virus:AdWare.Win32.BHO.aai (KAV 引擎)
对象: Rpcs.exe
在压缩档案里: C:\Documents and Settings\Administrato\桌面\002.rar
状态: 已发现病毒
病毒: Backdoor.Win32.Delf.ash (KAV 引擎)
对象: servciesd.exe
在压缩档案里: C:\Documents and Settings\Administrato\桌面\002.rar
状态: 已发现病毒
病毒: Backdoor.Win32.Delf.ash (KAV 引擎)
对象: weiwei[1].exe
在压缩档案里: C:\Documents and Settings\Administrato\桌面\002.rar
状态: 已发现病毒
病毒: Backdoor.Win32.Delf.ash (KAV 引擎)
对象: bobo.exe data0003
在压缩档案里: C:\Documents and Settings\Administrato\桌面\002.rar
状态: 已发现病毒
病毒: Trojan-Downloader.Win32.Delf.bmx (KAV 引擎)
对象: 002.rar
路径: C:\Documents and Settings\Administrato\桌面
状态: 已发现病毒
病毒: not-a-virus:AdWare.Win32.Cinmus.bjh (2x), not-a-virus:AdWare.Win32.BHO.te, not-a-virus:AdWare.Win32.BHO.aai, Backdoor.Win32.Delf.ash (3x), Trojan-Downloader.Win32.Delf.bmx (KAV 引擎)
分析完成: 3/1/2008 16:57
已扫描 1 个文件
已发现 1 个染毒文件
发现 0 个可疑文件

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrato\桌面\002.rar'
C:\Documents and Settings\Administrato\桌面\002.rar
  [0] Archive type: RAR
  --> 21[1].kdg
   [DETECTION] Is the Trojan horse TR/Drop.Ag.kka
  --> acpidisk.sys
   [DETECTION] Contains detection pattern of the rootkit RKIT/Cinmus.M
  --> cpush.dll
   [DETECTION] Is the Trojan horse TR/PSW.Agent.258560
  --> UPD82.tmp
   [DETECTION] Is the Trojan horse TR/PSW.Agent.258560
  --> nsr7C.tmp
   [DETECTION] Is the Trojan horse TR/PSW.Agent.258560
  --> Rpcs.exe
   [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> servciesd.exe
   [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> weiwei[1].exe
   [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> bobo.exe
   [DETECTION] Contains detection pattern of the dropper DR/Dldr.Delf.bmx.4
  --> bpbp[1].exe
   [DETECTION] Contains detection pattern of the dropper DR/Dldr.Delf.bmx.4
  --> bq10.exe
   [DETECTION] Contains detection pattern of the dropper DR/Dldr.Delf.bmx.4
   [INFO]    The file was moved to '47fb1ad4.qua'!

显示全部楼层 · 发表于 2008-3-1 17:00:49

IK
16 Files scanned
(1 Archiv with 15 files)
6 Signatures found
0 Suspect code-parts found
Used time: 0:00.562

显示全部楼层 · 发表于 2008-3-1 17:10:13

BD 13

显示全部楼层 · 发表于 2008-3-1 17:29:29

Begin scan in 'C:\Documents and Settings\haha\桌面\002.rar'
C:\Documents and Settings\haha\桌面\002.rar
  [0] Archive type: RAR
  --> 21[1].kdg
   [DETECTION] Is the Trojan horse TR/Drop.Ag.kka
  --> acpidisk.sys
   [DETECTION] Contains detection pattern of the rootkit RKIT/Cinmus.M
  --> cpush.dll
   [DETECTION] Is the Trojan horse TR/PSW.Agent.258560
  --> UPD82.tmp
   [DETECTION] Is the Trojan horse TR/PSW.Agent.258560
  --> nsr7C.tmp
   [DETECTION] Is the Trojan horse TR/PSW.Agent.258560
--> Rpcs.exe
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
--> servciesd.exe
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
--> weiwei[1].exe
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> bobo.exe
   [DETECTION] Contains detection pattern of the dropper DR/Dldr.Delf.bmx.4
  --> bpbp[1].exe
   [DETECTION] Contains detection pattern of the dropper DR/Dldr.Delf.bmx.4
  --> bq10.exe
   [DETECTION] Contains detection pattern of the dropper DR/Dldr.Delf.bmx.4
   [INFO]    A backup was created as '47fb220f.qua'  ( QUARANTINE )

End of the scan: 2008年3月1日  17:29
Used time: 00:02 min

The scan has been done completely.

   0 Scanning directories
   16 Files were scanned
   11 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   1 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   5 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-3-1 17:32:57

D:\病毒测试\未解压样本\002.rar » RAR » 21[1].kdg » NSIS » 21.exe - a variant of Win32/Ysmarsys.A trojan
D:\病毒测试\未解压样本\002.rar » RAR » dodolook029.exe » NSIS » 27.exe » NSIS » DoSSSetup.dll - a variant of Win32/Adware.Cinmus application
D:\病毒测试\未解压样本\002.rar » RAR » UPD82.tmp - Win32/Adware.Cinmus application
D:\病毒测试\未解压样本\002.rar » RAR » Rpcs.exe - a variant of Win32/PSW.QQRob.NAQ trojan
D:\病毒测试\未解压样本\002.rar » RAR » servciesd.exe - a variant of Win32/PSW.QQRob.NAQ trojan
D:\病毒测试\未解压样本\002.rar » RAR » weiwei[1].exe - a variant of Win32/PSW.QQRob.NAQ trojan
D:\病毒测试\未解压样本\002.rar » RAR » bobo.exe » NSIS » svchost.exe - probably a variant of Win32/TrojanDownloader.Delf trojan
D:\病毒测试\未解压样本\002.rar » RAR » bpbp[1].exe » NSIS » svchost.exe - probably a variant of Win32/TrojanDownloader.Delf trojan
D:\病毒测试\未解压样本\002.rar » RAR » bq10.exe » NSIS » svchost.exe - probably a variant of Win32/TrojanDownloader.Delf trojan

显示全部楼层 · 发表于 2008-3-1 17:35:51

显示全部楼层 · 发表于 2008-3-1 17:40:36

E:\Downloads\002.rar » RAR » 21[1].kdg » NSIS » 21.exe - a variant of Win32/Ysmarsys.A trojan
E:\Downloads\002.rar » RAR » dodolook029.exe » NSIS » 27.exe » NSIS » DoSSSetup.dll - a variant of Win32/Adware.Cinmus application
E:\Downloads\002.rar » RAR » UPD82.tmp - Win32/Adware.Cinmus application
E:\Downloads\002.rar » RAR » Rpcs.exe - a variant of Win32/PSW.QQRob.NAQ trojan
E:\Downloads\002.rar » RAR » servciesd.exe - a variant of Win32/PSW.QQRob.NAQ trojan
E:\Downloads\002.rar » RAR » weiwei[1].exe - a variant of Win32/PSW.QQRob.NAQ trojan
E:\Downloads\002.rar » RAR » bobo.exe » NSIS » svchost.exe - probably a variant of Win32/TrojanDownloader.Delf trojan
E:\Downloads\002.rar » RAR » bpbp[1].exe » NSIS » svchost.exe - probably a variant of Win32/TrojanDownloader.Delf trojan
E:\Downloads\002.rar » RAR » bq10.exe » NSIS » svchost.exe - probably a variant of Win32/TrojanDownloader.Delf trojan

显示全部楼层 · 发表于 2008-3-1 17:44:26

C:\Documents and Settings\Administrator\桌面\002.rar > RAR > 21[1].kdg > NSIS > 21.exe - Win32/Ysmarsys.A 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\002.rar > RAR > dodolook029.exe > NSIS > 27.exe > NSIS > DoSSSetup.dll - Win32/Adware.Cinmus 应用程序的变种
C:\Documents and Settings\Administrator\桌面\002.rar > RAR > UPD82.tmp - Win32/Adware.Cinmus 应用程序
C:\Documents and Settings\Administrator\桌面\002.rar > RAR > Rpcs.exe - Win32/PSW.QQRob.NAQ 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\002.rar > RAR > servciesd.exe - Win32/PSW.QQRob.NAQ 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\002.rar > RAR > weiwei[1].exe - Win32/PSW.QQRob.NAQ 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\002.rar > RAR > bobo.exe > NSIS > svchost.exe - 可能是 Win32/TrojanDownloader.Delf 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\002.rar > RAR > bpbp[1].exe > NSIS > svchost.exe - 可能是 Win32/TrojanDownloader.Delf 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\002.rar > RAR > bq10.exe > NSIS > svchost.exe - 可能是 Win32/TrojanDownloader.Delf 特洛伊木马的变种

[病毒样本] 15 PCS

本帖子中包含更多资源

本帖子中包含更多资源