[病毒样本] 8

显示全部楼层 · 发表于 2008-3-9 18:26:21

已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.sgz 檔案: C:\Documents and Settings\kato9096\桌面\4.rar/AtiSrv.exe2//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.rxpi 檔案: C:\Documents and Settings\kato9096\桌面\1.rar/Display3D.exe2//PE_Patch//UPack
已解毒: 病毒 Virus.Win32.Small.l 檔案: C:\Documents and Settings\kato9096\桌面\2.rar/Serverx.exe2
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.sea 檔案: C:\Documents and Settings\kato9096\桌面\3.rar/AtiSrv.exe2//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Delf.epw 檔案: C:\Documents and Settings\kato9096\桌面\3.rar/update.exe2//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Delf.epw 檔案: C:\Documents and Settings\kato9096\桌面\3.rar/.exe2//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Delf.epw 檔案: C:\Documents and Settings\kato9096\桌面\3.rar/2.exe2//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Delf.epw 檔案: C:\Documents and Settings\kato9096\桌面\3.rar/a.exe4//PE_Patch//UPack

沒有不报

[ 本帖最后由 kato9096 于 2008-3-9 18:27 编辑 ]

显示全部楼层 · 发表于 2008-3-9 18:28:35

C:\Documents and Settings\Don johnson\桌面\4.rar » RAR » AtiSrv.exe2 - a variant of Win32/TrojanDownloader.Agent.NWE trojan
C:\Documents and Settings\Don johnson\桌面\1.rar » RAR » Display3D.exe2 - a variant of Win32/TrojanDownloader.Agent.NWE trojan
C:\Documents and Settings\Don johnson\桌面\2.rar » RAR » Serverx.exe2 - probably unknown WIN32 virus
C:\Documents and Settings\Don johnson\桌面\3.rar » RAR » AtiSrv.exe2 - Win32/TrojanDownloader.Agent.NWD trojan
C:\Documents and Settings\Don johnson\桌面\3.rar » RAR » update.exe2 - Win32/TrojanDownloader.Delf.OBY trojan
C:\Documents and Settings\Don johnson\桌面\3.rar » RAR » .exe2 - a variant of Win32/TrojanDownloader.Delf.OBY trojan
C:\Documents and Settings\Don johnson\桌面\3.rar » RAR » 2.exe2 - Win32/TrojanDownloader.Delf.OBY trojan
C:\Documents and Settings\Don johnson\桌面\3.rar » RAR » a.exe4 - a variant of Win32/TrojanDownloader.Delf.OBY trojan

显示全部楼层 · 发表于 2008-3-9 18:30:35

C:\Documents and Settings\Administrator\桌面\1.rar>>Display3D.exe2 TrojanPSW.OnLineGames.rxpi.yfuz 木马还未处理
C:\Documents and Settings\Administrator\桌面\2.rar>>Serverx.exe2 W32.Small.l.jxmc 病毒还未处理
C:\Documents and Settings\Administrator\桌面\3.rar>>.exe2 TrojanDownloader.Delf.epw.ljqe 木马还未处理
C:\Documents and Settings\Administrator\桌面\3.rar>>2.exe2 TrojanDownloader.Delf.epw.tmkj 木马还未处理
C:\Documents and Settings\Administrator\桌面\3.rar>>a.exe4 TrojanDownloader.Delf.epw.ljqe 木马还未处理
C:\Documents and Settings\Administrator\桌面\3.rar>>AtiSrv.exe2 Trojan.Cap822819.oync 木马还未处理
C:\Documents and Settings\Administrator\桌面\3.rar>>update.exe2 TrojanDownloader.Delf.epw.tmkj 木马还未处理
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$DI00.000\AtiSrv.exe2 TrojanPSW.OnLineGames.sgz.swds 木马还未处理

显示全部楼层 · 发表于 2008-3-9 18:37:33

差不多都是这些 ..

显示全部楼层 · 发表于 2008-3-9 19:43:26

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.DL.Win32.Mnless.zbh
病毒： Worm.Madangel.a
病毒： Trojan.DL.Win32.Mnless.zan
病毒： Trojan.DL.Win32.Direct.me
病毒： Trojan.DL.Win32.Undef.az
病毒： Trojan.PSW.Win32.GameOL.mhg

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.34.62

显示全部楼层 · 发表于 2008-3-9 19:56:17

信息 1984-03-09  19:56:00 您此次查毒清除了7个病毒
信息 1984-03-09  19:56:00 您此次查毒共查出7个病毒以及危险代码
信息 1984-03-09  19:56:00 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件19个
信息 1984-03-09  19:56:00 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
病毒 1984-03-09  19:56:00 D:\Desktop\3.rar\a.exe4 Win32.TrojDownloader.Delf.43008 清除成功
病毒 1984-03-09  19:55:59 D:\Desktop\3.rar\2.exe2 Win32.TrojDownloader.Delf.43008 清除成功
病毒 1984-03-09  19:55:59 D:\Desktop\3.rar\.exe2 Win32.TrojDownloader.Delf.43008 清除成功
病毒 1984-03-09  19:55:59 D:\Desktop\3.rar\update.exe2 Win32.TrojDownloader.Delf.43008 清除成功
病毒 1984-03-09  19:55:59 D:\Desktop\3.rar\AtiSrv.exe2 Win32.PSWTroj.OnLineGames.90112 清除成功
病毒 1984-03-09  19:55:59 D:\Desktop\4.rar\AtiSrv.exe2 Win32.Troj.MacDog.aa.90112 清除成功
病毒 1984-03-09  19:55:59 D:\Desktop\2.rar\Serverx.exe2 Win32.Angel.a.4480 清除成功

显示全部楼层 · 发表于 2008-3-9 20:00:30

all killed

显示全部楼层 · 发表于 2008-3-9 20:08:21

Begin scan in 'C:\Documents and Settings\haha\桌面\4.rar'
C:\Documents and Settings\haha\桌面\4.rar
  [0] Archive type: RAR
  --> AtiSrv.exe2
   [DETECTION] Contains detection pattern of the rootkit RKIT/HideProcess.B
   [INFO]    A backup was created as '4845d36f.qua'  ( QUARANTINE )
Begin scan in 'C:\Documents and Settings\haha\桌面\1.rar'
C:\Documents and Settings\haha\桌面\1.rar
  [0] Archive type: RAR
  --> Display3D.exe2
   [DETECTION] Contains detection pattern of the rootkit RKIT/HideProcess.B
   [INFO]    A backup was created as '49e4a4d0.qua'  ( QUARANTINE )
Begin scan in 'C:\Documents and Settings\haha\桌面\2.rar'
C:\Documents and Settings\haha\桌面\2.rar
  [0] Archive type: RAR
  --> Serverx.exe2
   [DETECTION] Contains code of the Windows virus W32/Small.L
   [INFO]    A backup was created as '4845d371.qua'  ( QUARANTINE )
Begin scan in 'C:\Documents and Settings\haha\桌面\3.rar'
C:\Documents and Settings\haha\桌面\3.rar
  [0] Archive type: RAR
  --> AtiSrv.exe2
   [DETECTION] Contains detection pattern of the rootkit RKIT/HideProcess.B
  --> update.exe2
   [DETECTION] Is the Trojan horse TR/Dldr.Delf.epw.1
  --> .exe2
   [DETECTION] Is the Trojan horse TR/Dldr.Delf.epw.1
  --> 2.exe2
   [DETECTION] Is the Trojan horse TR/Dldr.Delf.epw.1
  --> a.exe4
   [DETECTION] Is the Trojan horse TR/Dldr.Delf.epw.1
   [INFO]    A backup was created as '49e4a4d2.qua'  ( QUARANTINE )

显示全部楼层 · 发表于 2008-3-9 21:34:38

Found possible security risk] <W32/Heuristic-114!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\1.rar->Display3D.exe2->(UPack)
[Found virus] <Smallnew or modified (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\2.rar->Serverx.exe2
[Found possible security risk] <W32/Heuristic-114!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\3.rar->AtiSrv.exe2->(UPack)
[Found downloader] <W32/Banload.B.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\3.rar->update.exe2
[Found downloader] <W32/Banload.B.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\3.rar->.exe2
[Found downloader] <W32/Banload.B.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\3.rar->2.exe2
[Found downloader] <W32/Banload.B.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\3.rar->a.exe4
[Warning] <Could not open file> C:\Documents and Settings\All Users\Documents\Test\3.rar.part
[Found possible security risk] <W32/Heuristic-114!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\4.rar->AtiSrv.exe2->(UPack)

---------------------------------------------------------------------
Scan ended: 2008-3-9, 21:34:31
Duration: 0:00:07

Scan result:

Scanned files:    9
Infected objects:    8
Disinfected objects:    0

显示全部楼层 · 发表于 2008-3-9 21:35:20

[Scanning : C:\Documents and Settings\All Users\Documents\Test]

C:\Documents and Settings\All Users\Documents\Test\1.rar<RAR>:Display3D.exe2 <- Heur.Win32.I : No action
C:\Documents and Settings\All Users\Documents\Test\1.rar<RAR>:Display3D.exe2<UPack>:Display3D.exe2 <- Heur.RoundKick : No action
C:\Documents and Settings\All Users\Documents\Test\2.rar<RAR>:Serverx.exe2 <- W32.ChineHacker.B : No action
C:\Documents and Settings\All Users\Documents\Test\3.rar<RAR>:AtiSrv.exe2 <- Trojan.Psw.Onlinegames.Sea : No action
C:\Documents and Settings\All Users\Documents\Test\3.rar<RAR>:AtiSrv.exe2<UPack>:AtiSrv.exe2 <- Heur.RoundKick : No action
C:\Documents and Settings\All Users\Documents\Test\3.rar<RAR>:update.exe2 <- Heur.Win32.I : No action
C:\Documents and Settings\All Users\Documents\Test\3.rar<RAR>:update.exe2<UPack>:update.exe2<DLLRES>:IFTDLL0.exe <- Trojan.Downloader.Delf.Epw : No action
C:\Documents and Settings\All Users\Documents\Test\3.rar<RAR>:.exe2 <- Heur.Win32.I : No action
C:\Documents and Settings\All Users\Documents\Test\3.rar<RAR>:.exe2<UPack>:.exe2<DLLRES>:IFTDLL0.exe <- Trojan.Downloader.Delf.Epw : No action
C:\Documents and Settings\All Users\Documents\Test\3.rar<RAR>:2.exe2 <- Heur.Win32.I : No action
C:\Documents and Settings\All Users\Documents\Test\3.rar<RAR>:2.exe2<UPack>:2.exe2<DLLRES>:IFTDLL0.exe <- Trojan.Downloader.Delf.Epw : No action
C:\Documents and Settings\All Users\Documents\Test\3.rar<RAR>:a.exe4 <- Heur.Win32.I : No action
C:\Documents and Settings\All Users\Documents\Test\3.rar<RAR>:a.exe4<UPack>:a.exe4<DLLRES>:IFTDLL0.exe <- Trojan.Downloader.Delf.Epw : No action
C:\Documents and Settings\All Users\Documents\Test\4.rar<RAR>:AtiSrv.exe2 <- Trojan.Psw.Onlinegames.Sgz : No action
C:\Documents and Settings\All Users\Documents\Test\4.rar<RAR>:AtiSrv.exe2<UPack>:AtiSrv.exe2 <- Heur.RoundKick : No action

Scanned objects : 24

Infected objects : 15

[病毒样本] 8

本帖子中包含更多资源

8

8

21/8

本帖子中包含更多资源