高手帮我找个专杀吧

pfish

VirSCAN.org Scanned Report :
Scanned time   : 2008/03/02 01:15:09 (CST)
Scanner results: 22%的杀软(8/36)报告发现病毒
File Name      : Recover4all-Professional.exe
File Size      : 440332 byte
File Type      : MS-DOS executable (EXE), OS/2 or MS Windows
MD5            : 4b8df83b37a0d13026250ec855683842
SHA1           : 0b2c93c1187bea6bd380f95730bf7ff126008ea0
Online report  : http://virscan.org/report/1c915184cbf8e2c8a1da80f0ead76b68.html
Scanner        Engine Ver      Sig Ver           Sig Date    Time   Scan result
a-squared      3.0.0.126       2008.03.01        2008-03-01  4.64   -
安博士V3       2008.03.01.00   2008.03.01        2008-03-01  1.28   -
AntiVir        7.6.0.73        7.0.2.215         2008-02-29  7.11   TR/Drop.Xorer.C
Arcavir        1.0.4           200803011126      2008-03-01  5.64   -
AVAST          1.0.8           080301-0          2008-03-01  6.54   -
AVG            7.5.51.442      269.21.2/1305     2008-02-29  5.15   Agent.3.E
BitDefender    7.60825.984716  7.17816           2008-03-01  8.15   -
CA (VET)       9.0.0.143       31.3.5574         2008-02-29  12.99  -
ClamAV         0.92            6064              2008-03-02  0.10   -
Comodo         2.11            2.0.0.451         2008-03-01  1.21   -
CP Secure      1.1.0.715       2008.02.28        2008-02-28  6.99   -
Dr.WEB         4.44.0.9170     2008.03.01        2008-03-01  7.38   -
ewido          4.0.0.2         2008.03.01        2008-03-01  2.44   -
F-PROT         4.4.1.52        20080229          2008-02-29  2.00   -
F-SECURE       5.51.6100       2008.03.01.01     2008-03-01  6.51   -
飞塔           2.81-3.11       8.804             2008-03-01  2.24   Suspicious
ViRobot        20080229        2008.02.29        2008-02-29  0.75   -
IKARUS         T3.1.01.20      2008.02.26.70368  2008-02-26  3.68   Trojan-Dropper.Xorer.C
江民杀毒       10.00.650       2008.03.01        2008-03-01  1.43   -
卡巴斯基       5.5.10          2008.03.01        2008-03-01  7.94   -
金山毒霸       2007.6.20.249   2008.3.1          2008-03-01  1.09   Worm.VcingT.z.102400
迈克菲         5.2.00          5237              2008-02-25  3.87   -
Microsoft      1.3301          2008.03.01        2008-03-01  7.60   Virus:Win32/Xorer.F
MKS_VIR        2.01            2008.03.01        2008-03-01  3.15   -
NORMAN         5.91.10         5.90              2008-02-28  6.87   -
熊猫卫士       9.04.03.0001    2008.03.01        2008-03-01  3.15   -
趋势           8.500-1001      5.132.19          2008-03-01  0.09   -
Prevx          V2              20080302          2008-03-02  10.36  TROJAN.DOWNLOADER.GEN
QuickHeal      9.00            2008.03.01        2008-03-01  2.21   -
瑞星           20.0            20.32.42.00       2008-02-22  1.86   -
SOPHOS         2.70.1          4.26              2008-02-26  4.16   -
赛门铁克       1.3.0.24        20080301.003      2008-03-01  0.29   -
nProtect       2008-03-01.00   1187789           2008-03-01  4.72   -
The Hacker     6.2.9           v00229            2008-02-25  1.23   -
VBA32          3.12.6.2        20080229.2311     2008-02-29  2.13   -
VirusBuster    4.3.19:9        9.121.23/11.0     2008-02-25  4.96   Win32.Xorer.Gen

woai_jolin

2008/3/2 1:23:38        Real-time file system protection        file        G:\v\Recover4all-Professional.exe        probably a variant of Win32/Genetik trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: D:\Program Files\WinRAR\WinRAR.exe.

ALEXBLAIR

fd:
%windir%\system32\com\
生成以下文件
smss.exe
lsass.exe
~~~~~~~~~
rd:
太多了都在附件里
不过我用了专储，都是这样的格式
[HKEY_USERS\7777\machine]
[HKEY_USERS\7777\machine]--〉HKEY_LOCAL_MACHINE
[HKEY_USERS\7777\user]--〉HKEY_CURRENT_USER
对比一下就知道了

[ 本帖最后由 ALEXBLAIR 于 2008-3-2 02:03 编辑 ]

woai_jolin

Hello,

Thanks for taking the time to submit your samples to the Norman
Sandbox Information Center.  Customer delight is our top priority at
Norman.  With that in mind we have developed Sandbox Solutions for
organizations that are committed to speedy analysis and debugging.

Norman Sandbox Solutions give your organization the opportunity to
analyze files immediately in your own environment.

To find out how to bring the power of Norman Sandbox into your test
environments follow the links below.

Norman Sandbox Solutions
http://www.norman.com/Product/Sandbox-products/

Norman Sandbox Analyzer
http://www.norman.com/Product/Sandbox-products/Analyzer/

Norman Sandbox Analyzer Pro
http://www.norman.com/Product/Sandbox-products/Analyzer-pro/

Norman SandBox Reporter
http://www.norman.com/Product/Sandbox-products/Reporter/

Recover4all-Professional.exe : Not detected by Sandbox (Signature: NO_VIRUS)


[ DetectionInfo ]
    * Sandbox name: NO_MALWARE
    * Signature name: NO_VIRUS
    * Compressed: YES
    * TLS hooks: NO
    * Executable type: Application
    * Executable file structure: OK

[ General information ]
    * Application uses MFC.DLL.
    * Decompressing UPX3.
    * File length:       440332 bytes.
    * MD5 hash: 4b8df83b37a0d13026250ec855683842.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.

This file is not flagged as malicious by the Norman Sandbox Information Center. However, we can not guarantee that the file is harmless. If you still suspect the file to be malicious and if you urgently need to know for sure, please submit it to your local Norman support department for manual analysis.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

hahacomcn

Begin scan in 'C:\Documents and Settings\haha\桌面\xxx.rar'
C:\Documents and Settings\haha\桌面\xxx.rar
  [0] Archive type: RAR
  --> Recover4all-Professional.exe
      [DETECTION] Is the Trojan horse TR/Drop.Xorer.C
      [INFO]      A backup was created as '48422a22.qua'  ( QUARANTINE )

gh1234j

TR/Drop.Xorer.C

dd2006

C:\Documents and Settings\Administrator\桌面\xxx.rar>>Recover4all-Professional.exe        Worm.DiskGen.gfc.tpkr        病毒

Nblock

还是磁碟 微点杀

qcqyt

瑞星的磁碟机专杀可以清理.29号已经升级为1.1版了.直接运行就可以.不会被关闭了.注意不能清理压缩文件rar.zip和htm.html文件.
下载地址：http://download.rising.com.cn/zsgj/ravDiskGen.exe

qigang

7/2

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Worm.Win32.DiskGen.cy   
病毒： Worm.Win32.DiskGen.gfc   

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.33.62