09

Nerazzurri

deleted: Trojan program Trojan.Win32.Inject.hh        File: C:\Users\Nerazzurri\Desktop\cpack.rar/test.exe
deleted: Trojan program Trojan-Spy.Win32.Pophot.abr        File: C:\Users\Nerazzurri\Desktop\cpack.rar/myself.exe//PE_Patch//UPack
deleted: virus Worm.Win32.Downloader.hf        File: C:\Users\Nerazzurri\Desktop\cpack.rar/ogame.exe//PE_Patch//UPack
deleted: Trojan program Trojan.Win32.DNSChanger.ik        File: C:\Users\Nerazzurri\Desktop\cpack.rar/pageticket2000.exe//stream
deleted: Trojan program Trojan-PSW.Win32.Maran.ff        File: C:\Users\Nerazzurri\Desktop\cpack.rar/r2o.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.Maran.gen        File: C:\Users\Nerazzurri\Desktop\cpack.rar/ro.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.Delf.aih        File: C:\Users\Nerazzurri\Desktop\cpack.rar/rse.exe//UPX
deleted: Trojan program Trojan-Downloader.Win32.Small.tnt        File: C:\Users\Nerazzurri\Desktop\cpack.rar/serial.exe//PE_Patch.Upolyx//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ufl        File: C:\Users\Nerazzurri\Desktop\cpack.rar/sytem.exe//UPX

wangjay1980

k

gaojun7206

cpack.rar
    [0] Archive type: RAR
    --> test.exe
        [DETECTION] Is the Trojan horse TR/Inject.HH
        [WARNING]   Infected files in archives cannot be repaired!
    --> myself.exe
        [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
        [WARNING]   Infected files in archives cannot be repaired!
    --> ogame.exe
        [DETECTION] Is the Trojan horse TR/Dldr.Agent.45056
        [WARNING]   Infected files in archives cannot be repaired!
    --> pageticket2000.exe
        [DETECTION] Is the Trojan horse TR/DNSChanger.iik
        [WARNING]   Infected files in archives cannot be repaired!
    --> r2o.exe
        [DETECTION] Is the Trojan horse TR/PSW.Maran.AU
        [WARNING]   Infected files in archives cannot be repaired!
    --> ro.exe
        [DETECTION] Is the Trojan horse TR/PSW.Maran.AU
        [WARNING]   Infected files in archives cannot be repaired!
    --> rse.exe
        [DETECTION] Is the Trojan horse TR/Copiet.B.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> serial.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> sytem.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.rra
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was moved to '48535b7b.qua'!

leonfg

原帖由 无尽藏海 于 2008-4-1 22:43 发表
E:\VIRUS\cpack\myself.exe - Win32/Spy.Delf.NHF 特洛伊木马 的变种
E:\VIRUS\cpack\ogame.exe - Win32/Jalous 蠕虫 的变种
E:\VIRUS\cpack\pageticket2000.exe > NSIS > 00.exe > RAR > 01.exe - Win32/TrojanDo ...

睡了一觉 多加了一个
D:\download\virus1\cpack.rar » RAR » cpack\pageticket2000.exe » NSIS » 00.exe » RAR » 01.exe - a variant of Win32/TrojanDownloader.Zlob trojan

gho

2008-4-2 18:35:55        gho        432        Sign of "Win32:Trojan-gen {Other}" has been found in "D:\cpack.rar\test.exe" file.  
2008-4-2 18:36:32        gho        432        Sign of "Win32:Agent-ICL [Trj]" has been found in "D:\cpack.rar\myself.exe\[Upack]\[Embedded#DLL]" file.  
2008-4-2 18:36:32        gho        432        Sign of "Win32:Downloader-RT [Wrm]" has been found in "D:\cpack.rar\ogame.exe\[Upack]\[Embedded#03008]\[Embedded#107c0]" file.  
2008-4-2 18:36:32        gho        432        Sign of "Win32:PolyCrypt-D [Trj]" has been found in "D:\cpack.rar\pageticket2000.exe\$TEMP\00.exe\01.exe" file.  
2008-4-2 18:36:32        gho        432        Sign of "Win32:Trojan-gen {Other}" has been found in "D:\cpack.rar\pageticket2000.exe" file.  
2008-4-2 18:36:32        gho        432        Sign of "Win32:Maran-BM [Trj]" has been found in "D:\cpack.rar\r2o.exe" file.  
2008-4-2 18:36:32        gho        432        Sign of "Win32:Maran-BM [Trj]" has been found in "D:\cpack.rar\ro.exe" file.  
2008-4-2 18:36:32        gho        432        Sign of "Win32:Delf-GXX [Trj]" has been found in "D:\cpack.rar\rse.exe\[UPX]\[Embedded#05304]" file.  
2008-4-2 18:36:32        gho        432        Sign of "Win32:Small-JMH [Trj]" has been found in "D:\cpack.rar\serial.exe\[UPX]" file.  
2008-4-2 18:36:32        gho        432        Sign of "Win32:OnLineGames-BTI [Trj]" has been found in "D:\cpack.rar\sytem.exe\[UPX]\[Embedded#04308]" file.

电影结束了

对象: test.exe
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\cpack.rar
        Status: 已发现病毒
        病毒: Trojan.Generic.103861 (BD 引擎)
对象: myself.exe
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\cpack.rar
        Status: 已发现病毒
        病毒: Generic.Onlinegames.5.B5770342 (BD 引擎)
对象: ogame.exe
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\cpack.rar
        Status: 已发现病毒
        病毒: Generic.Malware.P!Pk!g.F3CC9B89 (BD 引擎)
对象: pageticket2000.exe
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\cpack.rar
        Status: 已发现病毒
        病毒: Dropped:Trojan.DNSChanger.OT (BD 引擎)
对象: r2o.exe
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\cpack.rar
        Status: 已发现病毒
        病毒: Generic.PWS.Maran.A9F67324 (BD 引擎)
对象: ro.exe
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\cpack.rar
        Status: 已发现病毒
        病毒: Generic.PWS.Maran.1BD3F27D (BD 引擎)
对象: rse.exe
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\cpack.rar
        Status: 已发现病毒
        病毒: Trojan.Dropper.RLV (BD 引擎)
对象: serial.exe
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\cpack.rar
        Status: 已发现病毒
        病毒: Trojan.Retapu.D (BD 引擎)

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Win32.Agent.zzs   
病毒： Trojan.Clicker.Win32.PopHot.gy
病毒： Dropper.OnlineGames.bd   
病毒： Trojan.PSW.WoWar.GEN     
病毒： Trojan.PSW.Win32.GameOnline.arc

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.38.21