扔一包

mofunzone

双休日，免杀的估计也放假了，做的不是很好。。

Starting the file scan:

Begin scan in 'E:\AV\system32'
E:\AV\system32\bsF46.sys
  [0] Archive type: RSRC
  --> Object
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
E:\AV\system32\efcBqoNh.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [NOTE]      The file was deleted!
E:\AV\system32\msprint.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/Agent.fwi
      --> Object
          [DETECTION] Contains detection pattern of the dropper DR/Dldr.Zlob.ABMP.6
      [DETECTION] Is the Trojan horse TR/Downloader.Gen
      [NOTE]      The file was deleted!
E:\AV\system32\stdcons.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
E:\AV\system32\WinCtrl32.dll
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!


End of the scan: 2008年5月18日  11:45
Used time: 00:16 min

The scan has been done completely.

      1 Scanning directories
      7 Files were scanned
      7 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      5 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      0 Files not concerned
      0 Archives were scanned
      0 Warnings
      5 Notes

25021922	1xt6kn23fp.dat	71.71 KB	UNDER ANALYSIS
25021923	setup_526_1_.exe	32.5 KB	UNDER ANALYSIS

[ 本帖最后由 Exia 于 2008-5-18 11:45 编辑 ]

Palkia

rs 1
kav 1

dadingdading

avast 2
江民 1

[ 本帖最后由 dadingdading 于 2008-5-18 11:52 编辑 ]

挪威的冬天

信息        2008-05-18  12:37:00        您此次查毒清除了1个病毒                       
信息        2008-05-18  12:37:00        您此次查毒共查出1个病毒以及危险代码                       
信息        2008-05-18  12:37:00        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件9个                       
信息        2008-05-18  12:37:00        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
病毒        2008-05-18  12:37:00        D:\Desktop\system32.rar\system32\stdcons.exe        Win32.TrojDownloader.Mutant.xp.11776        清除成功

挪威的冬天

信息        2008-05-18  12:37:00        您此次查毒清除了1个病毒                       
信息        2008-05-18  12:37:00        您此次查毒共查出1个病毒以及危险代码                       
信息        2008-05-18  12:37:00        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件9个                       
信息        2008-05-18  12:37:00        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
病毒        2008-05-18  12:37:00        D:\Desktop\system32.rar\system32\stdcons.exe        Win32.TrojDownloader.Mutant.xp.11776        清除成功

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Dropper.Win32.Cutwail.t  
病毒： AdWare.Win32.BHO.ant     
病毒： AdWare.Win32.BHO.ant     
病毒： Trojan.Win32.Undef.gls   

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.44.62

allinwonderi

[Found security risk]         <W32/Agent.BD.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\system32.rar->system32\bsF46.sys
[Found downloader]         <W32/Downloader.Z1.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\system32.rar->system32\stdcons.exe
[Found downloader]         <W32/Downloader.Z1.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\system32.rar->system32\WinCtrl32.dll

---------------------------------------------------------------------
Scan ended:        2008-5-18, 20:34:56
Duration:        0:00:06

Scan result:

Scanned files:                 6
Infected objects:         3
Disinfected objects:         0
Quarantined files:         0
---------------------------------------------------------------------

allinwonderi

[Scanning : C:\Documents and Settings\All Users\Documents\Test]


C:\Documents and Settings\All Users\Documents\Test\system32.rar<RAR>:msprint.exe<PECompact2>:msprint.exe<DLLRES>:res1.exe<PECompact2>:res1.exe <- Downloader.Small.Ivo : No action
C:\Documents and Settings\All Users\Documents\Test\system32.rar<RAR>:msprint.exe<PECompact2>:msprint.exe<DLLRES>:res2.exe <- Downloader.Small.Ivo : No action
C:\Documents and Settings\All Users\Documents\Test\system32.rar<RAR>:msprint.exe<PECompact2>:msprint.exe<DLLRES>:res3.exe<UPX>:res3.exe <- Adware.E404.w : No action
C:\Documents and Settings\All Users\Documents\Test\system32.rar<RAR>:msprint.exe<PECompact2>:msprint.exe<DLLRES>:res3.exe<UPX>:res3.exe<DLLRES>:res0.exe <- Adware.E404.Ag : No action
C:\Documents and Settings\All Users\Documents\Test\system32.rar<RAR>:msprint.exe<PECompact2>:msprint.exe<DLLRES>:res3.exe<UPX>:res3.exe<DLLRES>:res0.exe<UPX>:res0.exe <- Adware.E404.ag : No action
C:\Documents and Settings\All Users\Documents\Test\system32.rar<RAR>:stdcons.exe <- Trojan.Downloader.Mutant.Xp : No action



Scanned objects : 22

Infected objects : 6
释放了很多生成物

sam.to

已刪除: 特洛伊木馬程式 Trojan-Dropper.Win32.Agent.ror        檔案: C:\Documents and Settings\kato9096\桌面\system32.rar/system32\bsF46.sys
已刪除: 特洛伊木馬程式 Trojan-Dropper.Win32.Agent.rph        檔案: C:\Documents and Settings\kato9096\桌面\system32.rar/system32\msprint.exe//PE_Patch.PECompact//PecBundle//PECompact
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.FraudLoad.abk        檔案: C:\Documents and Settings\kato9096\桌面\system32.rar/system32\setup_526_1_.exe
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Mutant.yf        檔案: C:\Documents and Settings\kato9096\桌面\system32.rar/system32\WinCtrl32.dll


to kl