virus

显示全部楼层 · 发表于 2008-5-28 14:53:21

生成物

显示全部楼层 · 发表于 2008-5-28 14:55:58

Starting the file scan:

Begin scan in 'E:\AV\virus\AUTORUN.INF'
Begin scan in 'E:\AV\virus\MSDS.PIF'
E:\AV\virus\MSDS.PIF
   [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\virus\0.pif'
E:\AV\virus\0.pif
  [0] Archive type: RAR
  --> ￕￕￆﾬ                                     .exe
   [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\virus\11.pif'
E:\AV\virus\11.pif
   [DETECTION] Contains detection pattern of the dropper DR/Rootkit.gez.11
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\virus\3.pif'
E:\AV\virus\3.pif
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\virus\5.pif'
E:\AV\virus\5.pif
--> Object
   [1] Archive type: RSRC
   --> Object
         [DETECTION] Is the Trojan horse TR/CrashSystem.C
   --> Object
         [DETECTION] Is the Trojan horse TR/PSW.Onlineg.KC.2
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\virus\6.pif'
E:\AV\virus\6.pif
   [DETECTION] Contains detection pattern of the Windows virus W32/Hllp.Alcaul.e
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\virus\7.pif'
E:\AV\virus\7.pif
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\virus\8.pif'
E:\AV\virus\8.pif
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!

End of the scan: 2008年5月28日  14:58
Used time: 00:35 min

The scan has been done completely.

   0 Scanning directories
   10 Files were scanned
   9 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   8 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   0 Warnings
   8 Notes

显示全部楼层 · 发表于 2008-5-28 15:33:14

C:\Documents and Settings\Administrator\桌面\fs.rar > RAR > MSDS.PIF - Win32/AutoRun.JO 蠕虫的变种
C:\Documents and Settings\Administrator\桌面\fs.rar > RAR > 0.pif > RAR > 照片 .exe - Win32/AutoRun.JO 蠕虫的变种
C:\Documents and Settings\Administrator\桌面\fs.rar > RAR > 3.pif - 可能是 Win32/Genetik 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\fs.rar > RAR > 5.pif - 可能是 Win32/PSW.OnLineGames.MUG 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\fs.rar > RAR > 6.pif - 可能是 Win32/PSW.OnLineGames.NML 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\fs.rar > RAR > 7.pif - 可能是 Win32/PSW.OnLineGames.NML 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\fs.rar > RAR > 8.pif - 可能是 Win32/PSW.OnLineGames.NML 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\fs.rar > RAR > 11.pif - Win32/TrojanDownloader.Delf.OBY 特洛伊木马的变种
已扫描的对象数: 10
发现的威胁数: 8

显示全部楼层 · 发表于 2008-5-28 15:34:28

信息 2008-05-28  15:34:14 您此次查毒清除了5个病毒
信息 2008-05-28  15:34:14 您此次查毒共查出5个病毒以及危险代码
信息 2008-05-28  15:34:14 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件23个
信息 2008-05-28  15:34:14 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
病毒 2008-05-28  15:34:14 D:\Desktop\virus.rar\11.pif Win32.TrojDownloader.Delf.43008 清除成功
病毒 2008-05-28  15:34:13 D:\Desktop\virus.rar\5.pif Win32.Troj.OnLineGamesT.en.5437 清除成功
病毒 2008-05-28  15:34:13 D:\Desktop\virus.rar\3.pif Win32.Troj.OnlineGamesT.ny.102456 清除成功
病毒 2008-05-28  15:34:13 D:\Desktop\virus.rar\0.pif\照片                                     .exe Win32.Troj.Downloader.if.109568 清除成功
病毒 2008-05-28  15:34:13 D:\Desktop\virus.rar\MSDS.PIF Win32.Troj.Downloader.if.109568 清除成功

显示全部楼层 · 发表于 2008-5-28 16:38:39

28:05:2008 16:37:26 SEARCHTASK "USER_DEFINED" started...
scan item: E:\VIRUS\virus
File scanned: E:\VIRUS\virus\0.pif - SIGNATURE FOUND "Trojan-PWS.Win32.QQRob.1028"
File scanned: E:\VIRUS\virus\11.pif - SIGNATURE FOUND "Trojan.Rootkit.GEZ"
File scanned: E:\VIRUS\virus\3.pif - SIGNATURE FOUND "Trojan-Dropper.Win32.Agent.ane"
File scanned: E:\VIRUS\virus\5.pif - SIGNATURE FOUND "Trojan-Downloader.Win32.Zlob.and"
File scanned: E:\VIRUS\virus\6.pif - SIGNATURE FOUND "Trojan-Downloader.Win32.Zlob.and"
File scanned: E:\VIRUS\virus\7.pif - SIGNATURE FOUND "Trojan-Downloader.Win32.Zlob.and"
File scanned: E:\VIRUS\virus\8.pif - SIGNATURE FOUND "Trojan-Downloader.Win32.Zlob.and"
File scanned: E:\VIRUS\virus\MSDS.PIF - SIGNATURE FOUND "Trojan-PWS.Win32.QQRob.1028"
28:05:2008 16:37:27 SEARCHTASK "USER_DEFINED" FINISHED...
----------------------------------------------------
Directories scanned: 1
Files scanned: 9
Virus found: 8

显示全部楼层 · 发表于 2008-5-28 17:20:55

木马名称:未知木马
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\MSDS.PIF
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\3.PIF
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\MNMHDSRV.DLL
2) C:\WINDOWS\SYSTEM32\ISMHASRV.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\5.PIF
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\YWG32.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\6.PIF
是可疑程序!
试图删除关键系统文件!
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\7.PIF
是可疑程序!
试图删除关键系统文件!
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\8.PIF
是可疑程序!
试图删除关键系统文件!
是否阻止该进程继续运行?

显示全部楼层 · 发表于 2008-5-28 20:12:26

[Scanning : C:\Documents and Settings\All Users\Documents\Test]

C:\Documents and Settings\All Users\Documents\Test\virus.rar<RAR>:3.pif <- Trojan.Psw.Onlinegames.Ajec : No action
C:\Documents and Settings\All Users\Documents\Test\virus.rar<RAR>:3.pif<UPack>:3.pif<DLLRES>:MAIN0.exe <- Trojan.Psw.Onlinegames.Ajed : No action
C:\Documents and Settings\All Users\Documents\Test\virus.rar<RAR>:5.pif<UPack>:5.pif<DLLRES>:res0.exe<UPack>:res0.exe<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Inr : No action

Scanned objects : 22

Infected objects : 3

显示全部楼层 · 发表于 2008-5-28 20:12:58

[Found backdoor] <W32/Ciadoor.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\virus.rar->MSDS.PIF
[Found backdoor] <W32/Ciadoor.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\virus.rar->0.pif->照片                                     .exe
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\virus.rar->3.pif->(UPack)
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\virus.rar->5.pif
[Found security risk] <W32/Nilage.gen!GSA (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\virus.rar->6.pif->(UPack)
[Found security risk] <W32/Nilage.gen!GSA (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\virus.rar->7.pif->(UPack)
[Found security risk] <W32/Nilage.gen!GSA (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\virus.rar->8.pif->(UPack)
[Found downloader] <W32/Banload.B.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\virus.rar->11.pif

---------------------------------------------------------------------
Scan ended: 2008-5-28, 20:12:44
Duration: 0:00:11

Scan result:

Scanned files:    6
Infected objects:    8
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

显示全部楼层 · 发表于 2008-5-28 20:40:21

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.QQGame.bz
病毒： Trojan.PSW.Win32.GameOL.nig
病毒： Trojan.PSW.Win32.GamesOnline.wt
病毒： Trojan.PSW.Win32.GameOL.nrv
病毒： Trojan.PSW.Win32.GameOL.ntd
病毒： Trojan.DL.Win32.Direct.me

MAC 地址：00:0C:29:DE:9A:3B

用户来源：局域网

软件版本：20.46.22

显示全部楼层 · 发表于 2008-5-28 21:16:28

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.QQGame.bz
病毒： Trojan.PSW.Win32.GameOL.nig
病毒： Trojan.PSW.Win32.GamesOnline.wt
病毒： Trojan.PSW.Win32.GameOL.nrv
病毒： Trojan.PSW.Win32.GameOL.ntd
病毒： Trojan.DL.Win32.Direct.me

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.46.22

[病毒样本] virus

本帖子中包含更多资源

IK

本帖子中包含更多资源

ArcaVir2008

F-Prot 4.4.4

22/7

22/7