番茄贴挖的

promised

C:\ABC\windows_2008\CcEvtSvc.exe - 特征码 'Trojan.Crypt.XPACK' 被发现
C:\ABC\windows_2008\fsavfpk.exe - 特征码 'Trojan.DNSChanger.BX' 被发现
C:\ABC\windows_2008\keygen.exe
C:\ABC\windows_2008\msvcrtd.exe - 特征码 'Backdoor.Win32.Agent.alm' 被发现
C:\ABC\windows_2008\onhtp.exe - 可疑代码段 被发现 (Level: 20)
C:\ABC\windows_2008\riode32.sys - 特征码 'Rootkit.Win32.Agent.ea' 被发现
C:\ABC\windows_2008\rsvlqer.exe - 可疑代码段 被发现 (Level: 10)
C:\ABC\windows_2008\spools.exe - 特征码 'Virus.Win32.Agent.OLI' 被发现
C:\ABC\windows_2008\stwojhwy.exe - 特征码 'Trojan-Dropper.Win32.Small.bgl' 被发现
9 文件被扫描
   (0 压缩档 0 文件)
6 特征码被侦测
2 可疑代码段被发现
耗时: 0:06.390

The EQs

C:\Documents and Settings\Don johnson\桌面\windows_2008.rar » RAR » windows_2008\CcEvtSvc.exe - Win32/SpamTool.Agent.NAQ trojan
C:\Documents and Settings\Don johnson\桌面\windows_2008.rar » RAR » windows_2008\fsavfpk.exe - Win32/TrojanDownloader.Small.NSL trojan
C:\Documents and Settings\Don johnson\桌面\windows_2008.rar » RAR » windows_2008\msvcrtd.exe - Win32/Agent.ALM trojan
C:\Documents and Settings\Don johnson\桌面\windows_2008.rar » RAR » windows_2008\riode32.sys - Win32/Rootkit.Agent.HU trojan
C:\Documents and Settings\Don johnson\桌面\windows_2008.rar » RAR » windows_2008\spools.exe - Win32/TrojanDownloader.Small.IUS trojan
C:\Documents and Settings\Don johnson\桌面\windows_2008.rar » RAR » windows_2008\stwojhwy.exe - Win32/TrojanDownloader.Small.IUS trojan

Joker

卡巴难得全灭。
9个
deleted: Trojan program Trojan-Downloader.Win32.Agent.kfd        File: C:\Documents and Settings\Administrator\×ÀÃæ\windows_2008.rar/windows_2008\CcEvtSvc.exe
deleted: Trojan program Trojan-Downloader.Win32.Agent.hyy        File: C:\Documents and Settings\Administrator\×ÀÃæ\windows_2008.rar/windows_2008\fsavfpk.exe
detected: virus Heur.Downloader (modification)        File: C:\Documents and Settings\Administrator\×ÀÃæ\windows_2008.rar/windows_2008\keygen.exe
deleted: Trojan program Backdoor.Win32.Agent.alm        File: C:\Documents and Settings\Administrator\×ÀÃæ\windows_2008.rar/windows_2008\msvcrtd.exe
deleted: Trojan program Trojan.Win32.Pakes.chm        File: C:\Documents and Settings\Administrator\×ÀÃæ\windows_2008.rar/windows_2008\onhtp.exe
deleted: Trojan program Rootkit.Win32.Agent.abe        File: C:\Documents and Settings\Administrator\×ÀÃæ\windows_2008.rar/windows_2008\riode32.sys
detected: virus Heur.Trojan.Generic        File: C:\Documents and Settings\Administrator\×ÀÃæ\windows_2008.rar/windows_2008\rsvlqer.exe
deleted: Trojan program Trojan-Downloader.Win32.Small.ius        File: C:\Documents and Settings\Administrator\×ÀÃæ\windows_2008.rar/windows_2008\spools.exe//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-Dropper.Win32.Small.bgl        File: C:\Documents and Settings\Administrator\×ÀÃæ\windows_2008.rar/windows_2008\stwojhwy.exe

曲中求

Start of the scan: 2008年3月8日  23:48

Starting the file scan:

Begin scan in 'E:\病毒\windows_2008.rar'
E:\病毒\windows_2008.rar
  [0] Archive type: RAR
  --> windows_2008\CcEvtSvc.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> windows_2008\fsavfpk.exe
      [DETECTION] Is the Trojan horse TR/Crypt.FSPM.Gen
  --> windows_2008\keygen.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Small.DDT.2
  --> windows_2008\msvcrtd.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.alm Backdoor server programs
  --> windows_2008\onhtp.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> windows_2008\riode32.sys
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> windows_2008\rsvlqer.exe
      [DETECTION] Is the Trojan horse TR/Buzus.apy
  --> windows_2008\spools.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
  --> windows_2008\stwojhwy.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [WARNING]   The file was ignored!


End of the scan: 2008年3月8日  23:48
Used time: 00:15 min

The scan has been done completely.

      0 Scanning directories
     10 Files were scanned
      8 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      1 Archives were scanned
      1 Warnings
      0 Notes

rest1min

江民杀毒软件报告文件

        北京江民新科技术有限公司

        扫描引擎 11.00.703
        病毒库日期 2008-03-08
        更新日期 2008-03-08

扫描目标 C:\Documents and Settings\Administrator\桌面\windows_2008.rar

开始时间 2008-03-08 23:51:05

在 C:\Documents and Settings\Administrator\桌面\windows_2008.rar->windows_2008\CcEvtSvc.exe 中发现 TrojanDownloader.Agent.abzl 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\windows_2008.rar->windows_2008\fsavfpk.exe 中发现 TrojanDownloader.Agent.yup 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\windows_2008.rar->windows_2008\msvcrtd.exe 中发现 Backdoor/Agent.abdo 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\windows_2008.rar->windows_2008\riode32.sys 中发现 Trojan/Srizbi.b 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\windows_2008.rar->windows_2008\rsvlqer.exe 中发现 Trojan/Buzus.b 病毒, 已删除
正常结束。

扫描结果:
                 文件数 :741                                 病毒体 :5         
                   删除 :5                                     解毒 :0         
    扫描速度(千字节/秒) :8278                              扫描时间 :00:00:21
    扫描文件速度(个/秒) :35

hj5abc

4

Sign of "Win32:Agent-JDR [Trj]" has been found in "F:\windows_2008\windows_2008\msvcrtd.exe" file.  
Sign of "Win32:Srizbi [Trj]" has been found in "F:\windows_2008\windows_2008\riode32.sys" file.  
Sign of "Win32:Pakes-AJN [Trj]" has been found in "F:\windows_2008\windows_2008\stwojhwy.exe" file.  
Sign of "Win32:Agent-OLI [Trj]" has been found in "F:\windows_2008\windows_2008\spools.exe\[UPX]\[Embedded#0c3ec]" file.  

只能说avast的监控太不厚道了 监控3个 扫描再抓1个.




[ 本帖最后由 hj5abc 于 2008-3-8 23:57 编辑 ]

woai_jolin

===================================================================================================
On-demand scanner 7.0.0.10

NSE revision 5.91.10
nvcbin.def revision 5.90.00 of 2008/03/07 16:10:27 (1356064 variants)
nvcmacro.def revision 5.90.00 of 2008/02/04 16:47:24 (20430 variants)
Total number of variants: 1376494
===================================================================================================


*** Possible virus found ***
*** G:\v\windows_2008.rar : windows_2008\CcEvtSvc.exe -> Trojan W32/Agent.EJRX ()
- File G:\v\windows_2008.rar quarantined.
*** G:\v\windows_2008.rar : windows_2008\fsavfpk.exe -> Trojan W32/Agent.EDTN ()
- File G:\v\windows_2008.rar quarantined.
*** G:\v\windows_2008.rar : windows_2008\keygen.exe -> Virus W32/Downloader ()
- File G:\v\windows_2008.rar quarantined.
*** G:\v\windows_2008.rar : windows_2008\msvcrtd.exe -> Backdoor W32/Agent.EAST ()
- File G:\v\windows_2008.rar quarantined.
*** G:\v\windows_2008.rar : windows_2008\riode32.sys -> Trojan W32/Rootkit.AVX ()
- File G:\v\windows_2008.rar quarantined.
*** G:\v\windows_2008.rar : windows_2008\rsvlqer.exe -> Trojan W32/Malware.CCSH ()
- File G:\v\windows_2008.rar quarantined.
*** G:\v\windows_2008.rar : windows_2008\spools.exe -> Trojan W32/DLoader.FTDZ ()
- File G:\v\windows_2008.rar quarantined.

===================================================================================================

The scanning started: 2008/03/08 23:55:43
               ended: 2008/03/08 23:55:56
Logged on as        : Jason
on hostname         : JASON-PC

Scanning results:
   Total number of files found..............................:      11
   Number of files scanned..................................:      11
   Number of files/directories skipped due to exclude list..:       0
   Number of files that could not be opened.................:       0
   Number of archive files unpacked.........................:       1
   Number of archive files not unpacked.....................:       0
   Number of infections.....................................:       7

Copyright (c) 1993-2007 Norman ASA.

微点卫士

木马名称:Trojan-Downloader.Win32.Agent.qcg

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\WINDOWS_2008\CCEVTSVC.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Downloader.Win32.Agent.qao

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\WINDOWS_2008\FSAVFPK.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Backdoor.Win32.Agent.fpl

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\WINDOWS_2008\MSVCRTD.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\WINDOWS_2008\KEYGEN.EXE
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\WINDOWS_2008\KEYGEN.EXE
是否删除病毒程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\WINDOWS_2008\RSVLQER.EXE
是可疑程序!
试图修改关键系统文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\WINDOWS_2008\RSVLQER.EXE
是否删除病毒程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\WINDOWS_2008\SPOOLS.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\APPLICATION DATA\CFTMON.EXE
2) C:\WINDOWS.0\SYSTEM32\DRIVERS\SPOOLS.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\WINDOWS_2008\STWOJHWY.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\0.EXE
2) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\1.EXE
3) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\2.EXE
是否删除木马程序及其衍生物?

[ 本帖最后由 微点卫士 于 2008-3-9 01:29 编辑 ]

kkgh

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Backdoor.Win32.Agent.alm
病毒： Trojan.Win32.Undef.czb   

用户来源：互联网

软件版本：20.34.52

诺顿5个

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Backdoor.Win32.Agent.alm
病毒： Trojan.Win32.Undef.czb   

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.34.52