再來四个

sam.to

Scanned file:   sys.rar  - Infected
sys.rar/msosmsfpfis64.sys - infected by Rootkit.Win32.Agent.ajb
sys.rar/RESS.sys - infected by Rootkit.Win32.Agent.ajv
sys.rar/pop.sys - infected by Trojan-PSW.Win32.OnLineGames.ppu
sys.rar/DeepFrz.sys - OK

上报卡巴

Hello,

AutoRun.inf, DeepFrz.sys, np27.tmp_, np28.tmp_, np29.tmp_, tem14.tmp_, tmp37.tmp_, tmp3F.tmp_, tmp52.tmp_, tmp53.tmp_, tmp54.tmp_, upload.dll, Ying-UnInstall.exe_

No malicious code were found in these files.

Please quote all when answering.

--
Best regards, Yury Nesmachny
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

[ 本帖最后由 kato9096 于 2008-4-29 15:09 编辑 ]

红心王子

木马名称:Rootkit.Win32.Agent.va

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\MSOSMSFPFIS64.SYS
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.OLGames.kcz

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\POP.SYS
是木马程序!
已成功阻止其运行,是否要删除此文件?

Starting the file scan:

Begin scan in 'E:\AV\新建文件夹\sys.rar'
E:\AV\新建文件夹\sys.rar
  [0] Archive type: RAR
  --> msosmsfpfis64.sys
      [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.ajb
  --> RESS.sys
      [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.ajv
  --> pop.sys
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppu.1
      [NOTE]      The file was deleted!

wangjay1980

k

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： RootKit.Win32.HideFile.g

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.42.01

傻猪猪米走鸡

D:\firefox download\sys.rar » RAR » msosmsfpfis64.sys - a variant of Win32/PSW.OnLineGames.NMQ trojan - was a part of the deleted object
D:\firefox download\sys.rar » RAR » RESS.sys - is OK
D:\firefox download\sys.rar » RAR » pop.sys - Win32/TrojanDownloader.Small.NZS trojan - was a part of the deleted object
D:\firefox download\sys.rar » RAR » DeepFrz.sys - is OK

allinwonderi

[Found password stealer]        <W32/Pws.AHAV (exact, not disinfectable)>        C:\Documents and Settings\All Users\Documents\Test\sys.rar->pop.sys

---------------------------------------------------------------------
Scan ended:        2008-4-28, 22:21:31
Duration:        0:00:01

Scan result:

Scanned files:                 6
Infected objects:         1
Disinfected objects:         0
Quarantined files:         0
---------------------------------------------------------------------

allinwonderi

[Scanning : C:\Documents and Settings\All Users\Documents\Test]

Base date : 2008.04.27 13:49:56





[Scanning : C:\Documents and Settings\All Users\Documents\Test]


C:\Documents and Settings\All Users\Documents\Test\sys.rar<RAR>:msosmsfpfis64.sys <- Trojan.Rootkit.Agent.Ajb : No action -> No action
C:\Documents and Settings\All Users\Documents\Test\sys.rar<RAR>:pop.sys <- Trojan.Psw.Onlinegames.Ppu : No action -> No action



Scanned objects : 5

Infected objects : 2

yk1234

红伞未报deepfrz.sys

scottxzt

[发现密码盗取病毒： ]        <W32/Pws.AHAV (确切, not disinfectable)>        C:\Documents and Settings\Administrator\桌面\sys.rar->pop.sys
[包含被传染的对象]        C:\Documents and Settings\Administrator\桌面\sys.rar
[已隔离]        C:\Documents and Settings\Administrator\桌面\sys.rar->DeepFrz.sys