1

tonger2003

Starting the file scan:

Begin scan in 'E:\AV\ntuser.rar'
E:\AV\ntuser.rar
  [0] Archive type: RAR
  --> ntuser.com
      [DETECTION] Contains suspicious code HEUR/Malware
      [NOTE]      The file was deleted!

电影结束了

下载物。。。
http://xiaba66.cn/yood.exe
http://xiaba66.cn/yoo0.exe
http://xiaba66.cn/yoo1.exe
http://xiaba66.cn/yoo2.exe

[ 本帖最后由 电影结束了 于 2008-5-27 17:46 编辑 ]

Starting the file scan:

Begin scan in 'E:\AV\1234.rar'
E:\AV\1234.rar
  [0] Archive type: RAR
  --> yoo0[1].exe
      [DETECTION] Is the Trojan horse TR/Agent.nbj
  --> yood[1].exe
      [DETECTION] Is the Trojan horse TR/Agent.nbl
    --> yoo1[1].exe
          [DETECTION] Is the Trojan horse TR/Click.121856
    --> yoo2[1].exe
      --> Object
        [2] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.Steal.44657
      [NOTE]      The file was deleted!

HC303

C:\Documents and Settings\桌面\1234.rar
  [0] Archive type: RAR
  --> yoo0[1].exe
      [DETECTION] Is the Trojan horse TR/Agent.nbj
  --> yood[1].exe
      [DETECTION] Is the Trojan horse TR/Agent.nbl
    --> yoo1[1].exe
          [DETECTION] Is the Trojan horse TR/Click.121856
    --> yoo2[1].exe
      --> Object
        [2] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.Steal.44657
      [NOTE]      The file was deleted!

慢了一步。

电影结束了

生成物8个

5
Starting the file scan:

Begin scan in 'E:\AV\新建文件夹'
E:\AV\新建文件夹\2.tmp
      [DETECTION] Is the Trojan horse TR/Click.121856
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\3.tmp
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.Steal.44657
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\0.tmp
      [DETECTION] Is the Trojan horse TR/Agent.nbl
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\1.tmp
      [DETECTION] Is the Trojan horse TR/Agent.nbj
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\Nt_Sys32.Sys
      [DETECTION] Is the Trojan horse TR/PSW.Steal.44657
      [NOTE]      The file was deleted!


End of the scan: 2008年5月27日  17:40
Used time: 00:14 min

The scan has been done completely.

      1 Scanning directories
      8 Files were scanned
      5 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      5 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      0 Archives were scanned
      0 Warnings
      5 Notes

25029434	edit.tmp	2 Byte	CLEAN
25029435	list.tmp	116 Byte	CLEAN
25029436	Nt_Win32.Jmp	30.11 KB	CLEAN

[ 本帖最后由 Exia 于 2008-5-27 18:00 编辑 ]

shanghaiplmm

234杀出来的。

检测到的安全风险总数: 2
已解决的项目总数: 0
需要注意的项目总数: 2
已解决的风险:

未解决的风险:
Trojan Horse
病毒 ID: 25464
类型: 已压缩
风险: 高 (高 隐蔽性，高 清除可能，高 性能，高 隐私)  
类别: 病毒
状态: 删除失败
-----------
1 文件
[yoo0[1].exe] 位于[e:\新建文件夹bingdu\1234.rar] - 已感染

Infostealer.Gampass
病毒 ID: 40673
类型: 已压缩
风险: 高 (高 隐蔽性，高 清除可能，高 性能，高 隐私)  
类别: 病毒
状态: 删除失败
-----------
1 文件
[yoo2[1].exe] 位于[e:\新建文件夹bingdu\1234.rar] - 已感染

shanghaiplmm

原帖由 电影结束了 于 2008-5-27 17:35 发表
生成物8个

诺顿杀出的。

检测到的安全风险总数: 3
已解决的项目总数: 0
需要注意的项目总数: 3
已解决的风险:

未解决的风险:
Infostealer.Gampass
病毒 ID: 40673
类型: 已压缩
风险: 高 (高 隐蔽性，高 清除可能，高 性能，高 隐私)  
类别: 病毒
状态: 删除失败
-----------
1 文件
[3.tmp] 位于[e:\新建文件夹bingdu\8.rar] - 已感染

Trojan Horse
病毒 ID: 25464
类型: 已压缩
风险: 高 (高 隐蔽性，高 清除可能，高 性能，高 隐私)  
类别: 病毒
状态: 删除失败
-----------
1 文件
[1.tmp] 位于[e:\新建文件夹bingdu\8.rar] - 已感染

Infostealer.Gampass
病毒 ID: 40673
类型: 已压缩
风险: 高 (高 隐蔽性，高 清除可能，高 性能，高 隐私)  
类别: 病毒
状态: 删除失败
-----------
1 文件
[nt_sys32.sys] 位于[e:\新建文件夹bingdu\8.rar] - 已感染

The file 'ntuser.com' has been determined to be 'MALWARE'. Our analysts discovered that the file is a Trojan containing download functionality. Detection will be added to our virus definition file (VDF) with one of the next updates. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Malware.