5

sam.to

已刪除: 病毒 Worm.Win32.AutoRun.brq        檔案: C:\Documents and Settings\kato9096\桌面\6.rar/6\?解?种子.exe//data.rar/賤揤佽隴.exe//PE_Patch


上报卡巴

已刪除: 特洛伊木馬程式 Trojan.Win32.Delf.bgx        檔案: C:\Documents and Settings\kato9096\桌面\5.rar/6\yyhelp.exe2
已刪除: 特洛伊木馬程式 Trojan-Spy.Win32.Delf.blw        檔案: C:\Documents and Settings\kato9096\桌面\5.rar/6\yyplay.exe2
已刪除: 特洛伊木馬程式 Trojan-Spy.Win32.Delf.blw        檔案: C:\Documents and Settings\kato9096\桌面\5.rar/6\yyplay.sys2
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Todon.aq        檔案: C:\Documents and Settings\kato9096\桌面\5.rar/6\8.exe2//data.rar/賤揤佽隴.exe

[ 本帖最后由 kato9096 于 2008-3-14 19:40 编辑 ]

Kakura

C:\Users\Peter\Desktop\5.rar > RAR > 6\8.exe2 > RAR > 解压说明.exe - 可能是 Win32/Delf.NDF 蠕虫 的变种

无尽藏海

Begin scan in 'E:\VIRUS\61.rar'
E:\VIRUS\61.rar
  [0] Archive type: RAR
  --> 6\yyhelp.exe2
      [DETECTION] Contains suspicious code HEUR/Malware
    --> 6\8.exe2
      [1] Archive type: RAR SFX (self extracting)
      --> ½âѹ˵Ã÷.exe
          [DETECTION] Contains detection pattern of the worm WORM/Autorun.brq.1

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\5.rar'
C:\Documents and Settings\Administrator\My Documents\
  5.rar
    [0] Archive type: RAR
    --> 6\yyhelp.exe2
        [DETECTION] Contains suspicious code HEUR/Malware
    --> 6\yyplay.exe2
    --> 6\yyplay.sys2
      --> 6\8.exe2
        [1] Archive type: RAR SFX (self extracting)
发表帖子[完成后        --> ﾽ￢￑ﾹￋﾵￃ?.exe
            [DETECTION] Contains detection pattern of the worm WORM/Autorun.brq.1
            [WARNING]   Infected files in archives cannot be repaired!
        --> ﾼﾫￆﾷￖￖￗￓ.torrent
      [WARNING]   The file was ignored!
  5.rar:Zone.Identifier


End of the scan: 2008年3月13日  22:27
Used time: 00:04 min

The scan has been done completely.

      0 Scanning directories
      8 Files were scanned
      1 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      7 Files not concerned
      2 Archives were scanned
      2 Warnings
      0 Notes

stonejr

剩1个0字节文件，yyplay.exe运行后加载了几个库文件。没看见其他动作

kkgh

诺顿1个，瑞星一个不杀

啊弥陀佛

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\5\6\YYHELP.EXE
是否删除木马程序及其衍生物?

kiki

路径：HKEY_CURRENT_USER\MACHINE\SOFTWARE\MICROSOFT\Windows\CURRENTVERSION\Run

备份文件：C:\Sandbox\Administrator\DefaultBox\drive\C\Program Files\2.hiv
影响路径下所有键值
描述：注册表常规启动项


路径：HKEY_CURRENT_USER\MACHINE\SOFTWARE\MICROSOFT\Windows\CURRENTVERSION\Run

键名：wenxiuv
新键值："C:\Program Files\Common Files\System\vwjhduu.exe"

描述：注册表常规启动项

路径：HKEY_CURRENT_USER\MACHINE\SOFTWARE\MICROSOFT\Windows\CURRENTVERSION\Run

备份文件：C:\Sandbox\Administrator\DefaultBox\drive\C\Program Files\4.hiv
影响路径下所有键值
描述：注册表常规启动项

路径：HKEY_CURRENT_USER\MACHINE\SOFTWARE\MICROSOFT\Windows\CURRENTVERSION\Run

键名：qfglffh
新键值："C:\Program Files\Common Files\Microsoft Shared\ymywwpa.exe"

描述：注册表常规启动项

hahacomcn

C:\Documents and Settings\cnelf\桌面\5.rar >>RAR >>6\8.exe2 >>RAR >>解压说明.exe - 可能是 Win32/Delf.NDF 蠕虫 的一个变种

qigang

rising20.35.41未杀！