virus3

显示全部楼层 · 发表于 2008-5-28 14:55:59

继续生成物

显示全部楼层 · 发表于 2008-5-28 15:00:32

Starting the file scan:

Begin scan in 'E:\AV\virus'
E:\AV\virus\wyrsdj.dll
   [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
   [NOTE]    The file was deleted!
E:\AV\virus\found.exe.exe
   [DETECTION] Contains detection pattern of the worm WORM/Zhelatin.yw
   [NOTE]    The file was deleted!
E:\AV\virus\found[1].exe
   [DETECTION] Contains detection pattern of the worm WORM/Zhelatin.yw
   [NOTE]    The file was deleted!
E:\AV\virus\herjek.exe
   [DETECTION] Contains detection pattern of the worm WORM/Zhelatin.yw
   [NOTE]    The file was deleted!
E:\AV\virus\tmp12.tmp
   [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
   [NOTE]    The file was deleted!
E:\AV\virus\mfdesy.dll
   [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
   [NOTE]    The file was deleted!
E:\AV\virus\dionpis.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
E:\AV\virus\dionpis.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NVI.170
   [NOTE]    The file was deleted!

End of the scan: 2008年5月28日  15:03
Used time: 00:20 min

The scan has been done completely.

   1 Scanning directories
   11 Files were scanned
   8 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   8 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   3 Files not concerned
   0 Archives were scanned
   0 Warnings
   8 Notes

25030390	herjek.config	45.37 KB	UNDER ANALYSIS
1298586	ponto.DLL	399 Byte	CLEAN
25030391	winlogon.exe	112 KB	UNDER ANALYSIS

[ 本帖最后由 Exia 于 2008-5-28 15:08 编辑 ]

显示全部楼层 · 发表于 2008-5-28 15:24:03

信息 2008-05-28  15:23:46 您此次查毒隔离了3个文件
信息 2008-05-28  15:23:46 您此次查毒共查出3个病毒以及危险代码
信息 2008-05-28  15:23:46 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件19个
信息 2008-05-28  15:23:46 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
病毒 2008-05-28  15:23:46 D:\Desktop\virus3\wyrsdj.dll Win32.PSWTroj.GameOL.225792 隔离成功
病毒 2008-05-28  15:23:46 D:\Desktop\virus3\dionpis.exe Win32.Troj.OnlineGameT.nc.61440 隔离成功
病毒 2008-05-28  15:23:44 D:\Desktop\virus3\dionpis.dll Win32.Troj.OnlineGamesT.se.29480 隔离成功

显示全部楼层 · 发表于 2008-5-28 15:26:34

已扫描的磁盘、文件夹和文件: C:\Documents and Settings\Administrator\桌面\virus3.rar
C:\Documents and Settings\Administrator\桌面\virus3.rar > RAR > virus3\dionpis.exe - Win32/PSW.OnLineGames.NWC 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\virus3.rar > RAR > virus3\mfdesy.dll - Win32/PSW.OnLineGames.NOA 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\virus3.rar > RAR > virus3\tmp12.tmp - Win32/PSW.OnLineGames.NMQ 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\virus3.rar > RAR > virus3\wyrsdj.dll - Win32/PSW.OnLineGames.NOA 特洛伊木马的变种
已扫描的对象数: 11
发现的威胁数: 4

显示全部楼层 · 发表于 2008-5-28 15:31:44

2008-5-28 15:34:03 文件系统实时防护文件 D:\firefox download\5.28\virus3\dionpis.exe Win32/PSW.OnLineGames.NWC 特洛伊木马的变种通过删除清除 - 已隔离 NT AUTHORITY\SYSTEM 在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2008-5-28 15:34:01 文件系统实时防护文件 D:\firefox download\5.28\virus3\mfdesy.dll Win32/PSW.OnLineGames.NOA 特洛伊木马的变种通过删除清除 - 已隔离 NT AUTHORITY\SYSTEM 在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2008-5-28 15:33:57 文件系统实时防护文件 D:\firefox download\5.28\virus3\tmp12.tmp Win32/PSW.OnLineGames.NMQ 特洛伊木马的变种通过删除清除 - 已隔离 NT AUTHORITY\SYSTEM 在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2008-5-28 15:33:52 文件系统实时防护文件 D:\firefox download\5.28\virus3\wyrsdj.dll Win32/PSW.OnLineGames.NOA 特洛伊木马的变种通过删除清除 - 已隔离 NT AUTHORITY\SYSTEM 在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.

显示全部楼层 · 发表于 2008-5-28 17:37:15

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS3[1]\FOUND.EXE.EXE
木马程序生成以下文件:
1) C:\WINDOWS\HERJEK.EXE
是否删除木马程序及其衍生物?

木马名称:未知木马
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS3[1]\FOUND[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:未知木马
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS3[1]\HERJEK.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS3[1]\DIONPIS.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS3[1]\WINLOGON.EXE
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2008-5-28 17:52:05

怎么俺扫描的是七个啊，红伞和OUTPOST都报七个

显示全部楼层 · 发表于 2008-5-28 17:53:20

AVG全灭

显示全部楼层 · 发表于 2008-5-28 19:59:58

MISS

显示全部楼层 · 发表于 2008-5-28 20:00:18

[Found possible virus] <W32/VB-Wird-based!Maximus (not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\virus3.part1.rar->winlogon.exe
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\virus3.part1.rar->tmp12.tmp

---------------------------------------------------------------------
Scan ended: 2008-5-28, 19:59:37
Duration: 0:00:00

Scan result:

Scanned files:    7
Infected objects:    2
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

[病毒样本] virus3

本帖子中包含更多资源

本帖子中包含更多资源

ArcaVir2008

F-Prot 4.4.4