9个

qianwenxiang

C:\Test\0803\Data07\NewDown\abcd02.exe加壳：Packed/uPacker(危险壳)，没有采取任何动作。
C:\Test\0803\Data07\NewDown\my_70145.exe启发：Elic/MicroDldr-01(Trj_GEN)，没有采取任何动作。
C:\Test\0803\Data07\NewDown\yeSetup.exe加壳：Packed/AsProtect 2.4(危险壳)，没有采取任何动作。

nosferatu

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\NewDown.rar'
C:\Documents and Settings\Administrator\桌面\NewDown.rar
  [0] Archive type: RAR
  --> my_70145.exe
      [DETECTION] Is the Trojan horse TR/Downloader.Gen
  --> my_70339.exe
      [DETECTION] Is the Trojan horse TR/Downloader.Gen
  --> server.exe
      [DETECTION] Is the Trojan horse TR/Agent.eok
  --> Setup805.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> yeSetup.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> abcd02.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
  --> ad_2517.exe
      [DETECTION] Contains detection pattern of the dropper DR/Boran.DQ
  --> dodolook375.exe
      [DETECTION] Contains detection pattern of the dropper DR/Cinmus.cex
      [INFO]      The file was deleted!


End of the scan: 星期五 2008年3月7日  20:01
Used time: 00:08 min

The scan has been done completely.

      0 Scanning directories
     10 Files were scanned
      8 viruses and/or unwanted programs were found

HC303

E:\virus test\NewDown.rar
  [0] Archive type: RAR
  --> my_70145.exe
      [DETECTION] Is the Trojan horse TR/Downloader.Gen
  --> my_70339.exe
      [DETECTION] Is the Trojan horse TR/Downloader.Gen
  --> server.exe
      [DETECTION] Is the Trojan horse TR/Agent.eok
  --> Setup805.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> yeSetup.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> abcd02.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
  --> ad_2517.exe
      [DETECTION] Contains detection pattern of the dropper DR/Boran.DQ
  --> dodolook375.exe
      [DETECTION] Contains detection pattern of the dropper DR/Cinmus.cex
      [WARNING]   The file was ignored!
杀了8只，还有1只上报。

HC303

毒霸只杀了1只。

wangjay1980

detected: adware not-a-virus:AdWare.Win32.Cinmus.ckl        File: C:\Documents and Settings\Owner\×ÀÃæ\NewDown.rar/dodolook591.exe//stream//data0002//data0004
detected: virus Heur.AntiAV (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\NewDown.rar/server.exe//NSPack
detected: adware not-a-virus:AdWare.Win32.Agent.ip        File: C:\Documents and Settings\Owner\×ÀÃæ\NewDown.rar/Setup805.exe
detected: Trojan program Trojan.Win32.Delf.bdh        File: C:\Documents and Settings\Owner\×ÀÃæ\NewDown.rar/yeSetup.exe//ASPack
detected: Trojan program Trojan-Spy.Win32.Agent.bml        File: C:\Documents and Settings\Owner\×ÀÃæ\NewDown.rar/abcd02.exe//PE_Patch//UPack//#
detected: adware not-a-virus:AdWare.Win32.Boran.dq        File: C:\Documents and Settings\Owner\×ÀÃæ\NewDown.rar/ad_2517.exe//stream//data0001
detected: adware not-a-virus:AdWare.Win32.Cinmus.cex        File: C:\Documents and Settings\Owner\×ÀÃæ\NewDown.rar/dodolook375.exe//stream//data0002//data0003
detected: adware not-a-virus:AdWare.Win32.Cinmus.cev        File: C:\Documents and Settings\Owner\×ÀÃæ\NewDown.rar/dodolook375.exe//stream//data0002//data0004

IllusionWing

5个...
不过看来UG搞定Cinmus还是有一套滴..

[ 本帖最后由 gankeyu 于 2008-3-7 20:09 编辑 ]

14206937

看样子还是红伞最多啦

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.DL.Win32.Mnless.yk
病毒： Trojan.DL.Win32.Mnless.zby
病毒： Trojan.DL.Win32.Mnless.zby
病毒： Trojan.Clicker.Win32.PopHot.jp
病毒： Trojan.Clicker.Win32.PopHot.jl

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.34.42

wangjay1980

Hello,

abcd02.exe_ - Trojan-Spy.Win32.Pophot.agh,

my_70145.exe_ - Trojan-Downloader.Win32.Agent.ksy,

my_70339.exe_ - Trojan-Downloader.Win32.Hmir.anr,

server.exe_ - Trojan-Downloader.Win32.Small.skt

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Dmitry Shvetsov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: NewDown.rar

傻猪猪米走鸡

Scan Log
Version of virus signature database: 2930 (20080307)
Date: 2008-3-7  Time: 23:26:31
Scanned disks, folders and files: E:\virus\NewDown
E:\virus\NewDown\abcd02.exe - a variant of Win32/Spy.Delf.NHF trojan - cleaned by deleting - quarantined [1]
E:\virus\NewDown\ad_2517.exe » NSIS » Entries.bin - is OK
E:\virus\NewDown\ad_2517.exe » NSIS » Strings.txt - is OK
E:\virus\NewDown\ad_2517.exe » NSIS » InsShell.exe - Win32/Adware.Boran application - was a part of the deleted object
E:\virus\NewDown\dodolook375.exe » NSIS » Entries.bin - is OK
E:\virus\NewDown\dodolook375.exe » NSIS » Strings.txt - is OK
E:\virus\NewDown\dodolook375.exe » NSIS » System.dll - is OK
E:\virus\NewDown\dodolook375.exe » NSIS » 137.exe » NSIS » Entries.bin - is OK
E:\virus\NewDown\dodolook375.exe » NSIS » 137.exe » NSIS » Strings.txt - is OK
E:\virus\NewDown\dodolook375.exe » NSIS » 137.exe » NSIS » System.dll - is OK
E:\virus\NewDown\dodolook375.exe » NSIS » 137.exe » NSIS » DoSSSetup.dll - is OK
E:\virus\NewDown\dodolook375.exe » NSIS » 137.exe » NSIS » acpidisk.sys - is OK
E:\virus\NewDown\dodolook591.exe » NSIS » Entries.bin - is OK
E:\virus\NewDown\dodolook591.exe » NSIS » Strings.txt - is OK
E:\virus\NewDown\dodolook591.exe » NSIS » System.dll - is OK
E:\virus\NewDown\dodolook591.exe » NSIS » 136.exe » NSIS » Entries.bin - is OK
E:\virus\NewDown\dodolook591.exe » NSIS » 136.exe » NSIS » Strings.txt - is OK
E:\virus\NewDown\dodolook591.exe » NSIS » 136.exe » NSIS » System.dll - is OK
E:\virus\NewDown\dodolook591.exe » NSIS » 136.exe » NSIS » DoSSSetup.dll - is OK
E:\virus\NewDown\dodolook591.exe » NSIS » 136.exe » NSIS » acpidisk.sys - probably a variant of Win32/Adware.Cinmus application - was a part of the deleted object
E:\virus\NewDown\my_70145.exe - is OK
E:\virus\NewDown\my_70339.exe - is OK
E:\virus\NewDown\server.exe - probably a variant of Win32/Genetik trojan - cleaned by deleting - quarantined [1]
E:\virus\NewDown\Setup805.exe - is OK
E:\virus\NewDown\yeSetup.exe » ASPack v2.12 - is OK
Number of scanned objects: 28
Number of threats found: 4
Time of completion: 23:27:01  Total scanning time: 30 sec (00:00:30)

Notes:
[1] Object has been deleted as it only contained the virus body.