virus2

显示全部楼层 · 发表于 2008-5-28 14:55:09

继续生成物

显示全部楼层 · 发表于 2008-5-28 14:58:41

Starting the file scan:

Begin scan in 'E:\AV\virus'
E:\AV\virus\waucl1.exe
   [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
   [NOTE]    The file was deleted!
E:\AV\virus\EntMian.exe
   [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
   [NOTE]    The file was deleted!
E:\AV\virus\maxpaynow1.exe
   [DETECTION] Contains detection pattern of the worm WORM/Zhelatin.Gen
   [NOTE]    The file was deleted!
E:\AV\virus\maxpaynow.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Tibs.WW
   [NOTE]    The file was deleted!
E:\AV\virus\maxpaynow.game
   [DETECTION] Is the Trojan horse TR/Dldr.Tibs.WW
   [NOTE]    The file was deleted!
E:\AV\virus\iexplorer.exe
   [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
   [NOTE]    The file was deleted!

End of the scan: 2008年5月28日  15:01
Used time: 00:17 min

The scan has been done completely.

   1 Scanning directories
   8 Files were scanned
   6 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   6 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   0 Archives were scanned
   0 Warnings
   6 Notes

4138760	k1ogon.dll	1.11 MB	KNOWN CLEAN
4217241	npptools.dll	53 KB	KNOWN CLEAN

[ 本帖最后由 Exia 于 2008-5-28 15:07 编辑 ]

显示全部楼层 · 发表于 2008-5-28 15:28:46

C:\Documents and Settings\Administrator\桌面\virus2.rar > RAR > virus2\iexplorer.exe - Win32/AutoRun.JO 蠕虫的变种
C:\Documents and Settings\Administrator\桌面\virus2.rar > RAR > virus2\maxpaynow.exe - Win32/TrojanDownloader.Tiny.NDI 特洛伊木马
C:\Documents and Settings\Administrator\桌面\virus2.rar > RAR > virus2\maxpaynow.game - Win32/TrojanDownloader.Tiny.NDI 特洛伊木马
C:\Documents and Settings\Administrator\桌面\virus2.rar > RAR > virus2\waucl1.exe - Win32/AutoRun.JO 蠕虫的变种
已扫描的对象数: 8
发现的威胁数: 4
信息 2008-05-28  15:29:34 您此次查毒清除了4个病毒
信息 2008-05-28  15:29:34 您此次查毒共查出4个病毒以及危险代码
信息 2008-05-28  15:29:34 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件16个
信息 2008-05-28  15:29:34 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
病毒 2008-05-28  15:29:34 C:\Documents and Settings\Administrator\桌面\virus2.rar\virus2\waucl1.exe Win32.Troj.Downloader.if.109568 清除成功
病毒 2008-05-28  15:29:34 C:\Documents and Settings\Administrator\桌面\virus2.rar\virus2\maxpaynow.game Win32.TrojDownloader.Tibs.ww.5120 清除成功
病毒 2008-05-28  15:29:34 C:\Documents and Settings\Administrator\桌面\virus2.rar\virus2\maxpaynow.exe Win32.TrojDownloader.Tibs.ww.5120 清除成功
病毒 2008-05-28  15:29:34 C:\Documents and Settings\Administrator\桌面\virus2.rar\virus2\iexplorer.exe Win32.Troj.Downloader.if.109568 清除成功

[ 本帖最后由 yunhan123 于 2008-5-28 15:29 编辑 ]

显示全部楼层 · 发表于 2008-5-28 15:31:29

信息 2008-05-28  15:31:07 您此次查毒清除了4个病毒
信息 2008-05-28  15:31:07 您此次查毒共查出4个病毒以及危险代码
信息 2008-05-28  15:31:07 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件15个
信息 2008-05-28  15:31:07 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
病毒 2008-05-28  15:31:07 D:\Desktop\virus2\waucl1.exe Win32.Troj.Downloader.if.109568 清除成功
病毒 2008-05-28  15:31:07 D:\Desktop\virus2\maxpaynow.game Win32.TrojDownloader.Tibs.ww.5120 清除成功
病毒 2008-05-28  15:31:07 D:\Desktop\virus2\maxpaynow.exe Win32.TrojDownloader.Tibs.ww.5120 清除成功
病毒 2008-05-28  15:31:07 D:\Desktop\virus2\iexplorer.exe Win32.Troj.Downloader.if.109568 清除成功

mark 一下

显示全部楼层 · 发表于 2008-5-28 17:42:26

木马名称:未知木马
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS2[1]\WAUCL1.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:未知木马
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS2[1]\IEXPLORER.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS2[1]\MAXPAYNOW1.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\MAXPAYNOW1.EXE
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2008-5-28 20:07:36

[Scanning : C:\Documents and Settings\All Users\Documents\Test]

C:\Documents and Settings\All Users\Documents\Test\virus2.part2.rar<RAR>:maxpaynow1.exe <- Heur.W32 : No action
C:\Documents and Settings\All Users\Documents\Test\virus2.part2.rar<RAR>:maxpaynow.exe <- Downloader.Tibs.Ww : No action
C:\Documents and Settings\All Users\Documents\Test\virus2.part2.rar<RAR>:maxpaynow.game <- Downloader.Tibs.Ww : No action

Scanned objects : 9

Infected objects : 3

显示全部楼层 · 发表于 2008-5-28 20:07:59

[Found backdoor] <W32/Ciadoor.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\virus2.part1.rar->waucl1.exe
[Found security risk] <W32/Tibs.S2.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\virus2.part2.rar->maxpaynow1.exe
[Found downloader] <W32/Downldr2.BIHP (exact, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\virus2.part2.rar->maxpaynow.exe
[Found downloader] <W32/Downldr2.BIHP (exact, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\virus2.part2.rar->maxpaynow.game
[Found backdoor] <W32/Ciadoor.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\virus2.part3.rar->iexplorer.exe

---------------------------------------------------------------------
Scan ended: 2008-5-28, 20:07:46
Duration: 0:00:04

Scan result:

Scanned files:    8
Infected objects:    5
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

显示全部楼层 · 发表于 2008-5-28 20:42:43

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Worm.Mail.Win32.Zhelatin.wy

MAC 地址：00:0C:29:DE:9A:3B

用户来源：局域网

软件版本：20.46.22

显示全部楼层 · 发表于 2008-5-28 20:44:40

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Worm.Mail.Win32.Zhelatin.wy

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.46.22

[病毒样本] virus2

本帖子中包含更多资源

本帖子中包含更多资源

ArcaVir2008

F-Prot 4.4.4

12/1