baidu.exe

冷冷

网络问题？
我都下载了
已经打包好

mofunzone

一个都下不了的人飘过。。

Starting the file scan:

Begin scan in 'E:\新建文件夹 (2)\baidu'
E:\新建文件夹 (2)\baidu\1.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.abtn
      --> Object
          [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.aji
      [NOTE]      The file was deleted!
E:\新建文件夹 (2)\baidu\2.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NVI.27
      [NOTE]      The file was deleted!
E:\新建文件夹 (2)\baidu\3.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
E:\新建文件夹 (2)\baidu\4.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
      [NOTE]      The file was deleted!
E:\新建文件夹 (2)\baidu\5.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
E:\新建文件夹 (2)\baidu\6.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
E:\新建文件夹 (2)\baidu\7.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.aji
      [DETECTION] Contains suspicious code HEUR/Malware
      [NOTE]      The fund was classified as suspicious.
      [NOTE]      The file was moved to '48751b6b.qua'!
E:\新建文件夹 (2)\baidu\8.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.QQpass.bri
      [NOTE]      The file was deleted!
E:\新建文件夹 (2)\baidu\9.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.aji
      [DETECTION] Contains suspicious code HEUR/Malware
      [NOTE]      The fund was classified as suspicious.
      [NOTE]      The file was moved to '49d5b09c.qua'!
E:\新建文件夹 (2)\baidu\10.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
E:\新建文件夹 (2)\baidu\11.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.abcr
      [NOTE]      The file was deleted!
E:\新建文件夹 (2)\baidu\12.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
E:\新建文件夹 (2)\baidu\13.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.abtp
      [NOTE]      The file was deleted!
E:\新建文件夹 (2)\baidu\14.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
E:\新建文件夹 (2)\baidu\15.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
E:\新建文件夹 (2)\baidu\16.exe
      [DETECTION] Is the Trojan horse TR/Onlinegames.NVI
      [NOTE]      The file was deleted!
E:\新建文件夹 (2)\baidu\17.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
E:\新建文件夹 (2)\baidu\18.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
E:\新建文件夹 (2)\baidu\19.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.aji
      [DETECTION] Contains suspicious code HEUR/Malware
      [NOTE]      The fund was classified as suspicious.
      [NOTE]      The file was moved to '483e1b7d.qua'!
E:\新建文件夹 (2)\baidu\20.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NVI.48
      [NOTE]      The file was deleted!
E:\新建文件夹 (2)\baidu\21.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
E:\新建文件夹 (2)\baidu\22.exe
      [DETECTION] Is the Trojan horse TR/PSW.16785
      [NOTE]      The file was deleted!
E:\新建文件夹 (2)\baidu\23.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
E:\新建文件夹 (2)\baidu\24.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
E:\新建文件夹 (2)\baidu\25.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.12377
      --> Object
          [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.ahy
      [NOTE]      The file was deleted!
E:\新建文件夹 (2)\baidu\26.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
E:\新建文件夹 (2)\baidu\27.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
E:\新建文件夹 (2)\baidu\28.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.aji
      [DETECTION] Contains suspicious code HEUR/Malware
      [NOTE]      The fund was classified as suspicious.
      [NOTE]      The file was moved to '483e1b8a.qua'!
E:\新建文件夹 (2)\baidu\29.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.aij
      [DETECTION] Contains suspicious code HEUR/Malware
      [NOTE]      The fund was classified as suspicious.
      [NOTE]      The file was moved to '483e1b8c.qua'!
E:\新建文件夹 (2)\baidu\30.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
        [2] Archive type: RSRC
        --> Object
            [DETECTION] Contains detection pattern of the SPR/PortScan.I program
        --> Object
            [DETECTION] Is the Trojan horse TR/Dldr.VB.dzy
      --> Object
          [DETECTION] Is the Trojan horse TR/Dldr.VB.VRF
      [NOTE]      The file was deleted!
E:\新建文件夹 (2)\baidu\31.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/Dldr.Agent.gxp
      [NOTE]      The file was deleted!


End of the scan: 2008年4月24日  13:32
Used time: 01:10 min

The scan has been done completely.

      1 Scanning directories
     31 Files were scanned
     35 viruses and/or unwanted programs were found
      5 Files were classified as suspicious:
     26 files were deleted
      0 files were repaired
      5 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     -4 Files not concerned
      0 Archives were scanned
      0 Warnings
     31 Notes

无尽藏海

正在扫描日志
病毒库版本: 3050 (20080423)
日期: 2008-4-24  时间: 13:32:14
已扫描的磁盘、文件夹和文件: E:\VIRUS\down(2).rar
E:\VIRUS\down(2).rar > RAR > 1.exe - 可能是 Win32/PSW.OnLineGames.NMQ 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 10.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 11.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 12.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 13.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 14.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 15.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 16.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 17.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 18.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 19.exe - 可能是 Win32/PSW.OnLineGames.NMQ 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 2.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 20.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 21.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 22.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 23.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 24.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 25.exe - 可能是 Win32/PSW.OnLineGames.NMQ 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 26.exe - 可能是 Win32/PSW.OnLineGames.NMQ 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 27.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 28.exe - 可能是 Win32/PSW.OnLineGames.NMQ 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 29.exe - Win32/PSW.OnLineGames.NMQ 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 3.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 30.exe - 未查明的 NewHeur_PE 病毒 [7]
E:\VIRUS\down(2).rar > RAR > 31.exe - 未查明的 NewHeur_PE 病毒 [7]
E:\VIRUS\down(2).rar > RAR > 4.exe - Win32/PSW.OnLineGames.ZJK 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 5.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 6.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 7.exe - Win32/PSW.OnLineGames.NMQ 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 8.exe - Win32/PSW.QQPass.NCZ 特洛伊木马 的变种
E:\VIRUS\down(2).rar > RAR > 9.exe - 可能是 Win32/PSW.OnLineGames.NMQ 特洛伊木马 的变种
已扫描的对象数: 31
发现的威胁数: 31
已清除对象数:0
完成时间: 13:32:17  总扫描时间: 3 秒 (00:00:03)

备注:
[7] 对象可能感染了未知病毒。

csjhy

kis8.0.0.348没检测出来。。。。晕

aerbeisi

[Found possible security risk]         <W32/Heuristic-162!Eldorado (damaged, not disinfectable)>        C:\test\baidu.rar->Baidu.exe->(UPack)

The file 'Baidu.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/Dldr.Agent.wta. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Malware.

啊弥陀佛

木马名称:Trojan-PSW.Win32.OL-Game.div
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\27.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-Downloader.Win32.Agent.rmu
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\31.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\1.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TMPA4.TMP
2) C:\WINDOWS\SYSTEM32\MSOSMHFP00.DLL
3) C:\WINDOWS\SYSTEM32\DRIVERS\MSOSMSFPFIS64.SYS
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\2.EXE
木马程序生成以下文件:
1) C:\WINDOWS\WSOCKDRV32.EXE
2) C:\WINDOWS\SYSTEM32\WSOCKDRV32.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\3.EXE
木马程序生成以下文件:
1) C:\WINDOWS\ANISTIO.EXE
2) C:\WINDOWS\SYSTEM32\ANISTIO.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\4.EXE
是可疑程序!
试图修改关键系统文件!
是否阻止该进程继续运行?


程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\5.EXE
木马程序生成以下文件:
1) C:\WINDOWS\DIONPIS.EXE
2) C:\WINDOWS\SYSTEM32\DIONPIS.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\6.EXE
木马程序生成以下文件:
1) C:\WINDOWS\FIOSECTC.EXE
2) C:\WINDOWS\SYSTEM32\FIOSECTC.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\7.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TMPA6.TMP
2) C:\WINDOWS\SYSTEM32\MSOSDOHS00.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\8.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\NT_SYS32.SYS
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\9.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TMPA8.TMP
2) C:\WINDOWS\SYSTEM32\MSOSCQIT00.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\10.EXE
木马程序生成以下文件:
1) C:\WINDOWS\HEFCNDY.EXE
2) C:\WINDOWS\SYSTEM32\HEFCNDY.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\11.EXE
木马程序生成以下文件:
1) C:\WINDOWS\TCIOCP32.EXE
2) C:\WINDOWS\SYSTEM32\TCIOCP32.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\12.EXE
木马程序生成以下文件:
1) C:\WINDOWS\FMSBBQI.EXE
2) C:\WINDOWS\SYSTEM32\FMSBBQI.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\13.EXE
木马程序生成以下文件:
1) C:\WINDOWS\BINCDWSA.EXE
2) C:\WINDOWS\SYSTEM32\BINCDWSA.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\14.EXE
木马程序生成以下文件:
1) C:\WINDOWS\DBHLP32.EXE
2) C:\WINDOWS\SYSTEM32\DBHLP32.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\15.EXE
木马程序生成以下文件:
1) C:\WINDOWS\FMSJHIF.EXE
2) C:\WINDOWS\SYSTEM32\FMSJHIF.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\16.EXE
木马程序生成以下文件:
1) C:\WINDOWS\GWSMHXUQ.EXE
2) C:\WINDOWS\SYSTEM32\RZYSDHBX.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\17.EXE
木马程序生成以下文件:
1) C:\WINDOWS\PTSHELL.EXE
2) C:\WINDOWS\SYSTEM32\PTSHELL.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\18.EXE
木马程序生成以下文件:
1) C:\WINDOWS\TICISMS.EXE
2) C:\WINDOWS\SYSTEM32\TICISMS.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\19.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TMPAA.TMP
2) C:\WINDOWS\SYSTEM32\MSOSMNSF00.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\20.EXE
木马程序生成以下文件:
1) C:\WINDOWS\HUIFITC.EXE
2) C:\WINDOWS\SYSTEM32\HUIFITC.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\21.EXE
木马程序生成以下文件:
1) C:\WINDOWS\YUIABCT.EXE
2) C:\WINDOWS\SYSTEM32\YUIABCT.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\22.EXE
木马程序生成以下文件:
1) C:\WINDOWS\MFCHLP64.EXE
2) C:\WINDOWS\SYSTEM32\MFCHLP64.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\23.EXE
木马程序生成以下文件:
1) C:\WINDOWS\DNDSIOC.EXE
2) C:\WINDOWS\SYSTEM32\DNDSIOC.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\24.EXE
木马程序生成以下文件:
1) C:\WINDOWS\WINSVR64.EXE
2) C:\WINDOWS\SYSTEM32\WINSVR64.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\25.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TMPAE.TMP
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\26.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TMPB0.TMP
2) C:\WINDOWS\SYSTEM32\MSOSPING00.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\28.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TMPB2.TMP
2) C:\WINDOWS\SYSTEM32\MSOSFMSQ00.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN\29.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TMPB4.TMP
2) C:\WINDOWS\SYSTEM32\MSOSJTIO00.DLL
是否删除木马程序及其衍生物?

lzj520501

用伞扫描压缩包都报了

28654621

卡巴斯基反病毒 7.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=248504 is infected with Trojan-Downloader.Win32.Murlo.lv virus