[病毒样本] 58

显示全部楼层 · 发表于 2008-5-30 11:53:58

已刪除: 廣告軟體 not-a-virus:AdWare.Win32.WSearch.c 檔案: C:\Documents and Settings\kato9096\桌面\0530\531\531\afengspig.exe3
已刪除: 病毒 Worm.Win32.Downloader.nc 檔案: C:\Documents and Settings\kato9096\桌面\0530\531\531\b.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Agent.raq 檔案: C:\Documents and Settings\kato9096\桌面\0530\531\531\boxmod.exe3
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Agent.qzz 檔案: C:\Documents and Settings\kato9096\桌面\0530\531\531\crack.exe3
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aksr 檔案: C:\Documents and Settings\kato9096\桌面\0530\531\531\isndntio.dll
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aksn 檔案: C:\Documents and Settings\kato9096\桌面\0530\531\531\isndntio.exe3//FSG
已刪除: 特洛伊木馬程式 Trojan.Win32.Agent.qqx 檔案: C:\Documents and Settings\kato9096\桌面\0530\531\531\msoscqit00.dll//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.akdb 檔案: C:\Documents and Settings\kato9096\桌面\0530\531\531\msosmnsf00.dll//UPack
已刪除: 病毒 Worm.Win32.Downloader.nf 檔案: C:\Documents and Settings\kato9096\桌面\0530\531\531\msosmsfpfis64.sys3
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ajrr 檔案: C:\Documents and Settings\kato9096\桌面\0530\531\531\msosmsp2p32.sys2
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.akug 檔案: C:\Documents and Settings\kato9096\桌面\0530\531\531\msosping00.dll//UPack
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Delf.ihw 檔案: C:\Documents and Settings\kato9096\桌面\0530\531\531\net.exe3//PE_Patch.UPX//UPX
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ajrr 檔案: C:\Documents and Settings\kato9096\桌面\0530\531\531\nicomsp2p32.sys
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.Ejik.gi 檔案: C:\Documents and Settings\kato9096\桌面\0530\531\531\Skype3084.exe3//PE_Patch.PECompact//PecBundle//PECompact
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Losabel.nx 檔案: C:\Documents and Settings\kato9096\桌面\0530\531\531\soc.exe3//PE_Patch//UPack
已刪除: 病毒 Worm.Win32.Downloader.mt 檔案: C:\Documents and Settings\kato9096\桌面\0530\531\531\svchos.com3
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aksa 檔案: C:\Documents and Settings\kato9096\桌面\0530\531\531\ticisms.exe3//FSG
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.Ejik.gh 檔案: C:\Documents and Settings\kato9096\桌面\0530\531\531\wynsjceqji.dll//PE_Patch.PECompact//PecBundle//PECompact
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Delf.frg 檔案: C:\Documents and Settings\kato9096\桌面\0530\531\531\xz.exe3/baidu11.exe//data0003
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.QQHelper.bjh 檔案: C:\Documents and Settings\kato9096\桌面\0530\531\531\xz.exe3/ha_80113.exe
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.Cinmus.ibe 檔案: C:\Documents and Settings\kato9096\桌面\0530\531\531\xz.exe3/msn004.exe//stream//data0003//data0004

卡巴只报21个

上报

Hello,

######.txt,
22.exe_,
atielf.dat,
Atiptaxx.exe_,
A~NSISu_.exe_,
bootstat.dat,
cid_store.dat,
cmuninst.dat,
fltMc.exe_,
Googlekaba.exe_,
msoscqit.dat,
msosdohs.dat,
msosfmsq.dat,
msosjtio.dat,
msosmhfp.dat,
msosmnsf.dat,
msosping.dat,
msosptfs.dat,
nicozftp.dat,
presetup.cmd_,
pub_store.dat,
RSBDBACKUP.DLL2,
setupold.exe_,
VIRTUAL.dll,
wpa.dbl,
xbcvxb.dll3,
xlhcc.dat

No malicious code were found in these files.

0524.exe_ - Backdoor.Win32.Ceckno.ayv,

0529.exe_ - Backdoor.Win32.Agent.jgk,

a09.exe_ - Trojan-Downloader.Win32.Small.wmm,

drthte.dll - Trojan-PSW.Win32.OnLineGames.alcl,

ha_80029.exe_ - Trojan-Downloader.Win32.Agent.rgo,

ha_80170.exe_ - Trojan-Downloader.Win32.Agent.rgp,

ticisms.dll - Trojan-PSW.Win32.OnLineGames.alcr,

v1.exe_ - Trojan-Dropper.Win32.Flystud.fn,

zfdzb.dll - Trojan-PSW.Win32.OnLineGames.alcs

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

2.exe_ - not-a-virus:RemoteAdmin.Win32.RemoteExplorer.0.5.2.8

New potentially risk software was found in this file. It's detection will be included in the next update. Thank you for your help.

fjyjy.dll,
rdthr.dll

These files are corrupted.

--
Best regards, Mikhail Bulgakov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

[ 本帖最后由 kato9096 于 2008-5-30 20:32 编辑 ]

显示全部楼层 · 发表于 2008-5-30 12:01:26

17ge

显示全部楼层 · 发表于 2008-5-30 12:01:27

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\0531'
C:\Documents and Settings\Administrator\桌面\0531\531\531\0524.exe3
   [DETECTION] Is the Trojan horse TR/PSW.LdPinch.jm1
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0531\531\531\0529.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0531\531\531\2.exe3
   [DETECTION] Contains suspicious code HEUR/Crypted
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0531\531\531\a09.exe3
   [DETECTION] Is the Trojan horse TR/Downloader.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0531\531\531\afengspig.exe3
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Dudu.a.1.B
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0531\531\531\b.exe3
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0531\531\531\boxmod.exe3
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.zac
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0531\531\531\crack.exe3
   [DETECTION] Is the Trojan horse TR/Dldr.Zlob.mnd
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0531\531\531\ha_80029.exe3
   [DETECTION] Is the Trojan horse TR/Downloader.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0531\531\531\ha_80170.exe3
   [DETECTION] Is the Trojan horse TR/Downloader.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0531\531\531\isndntio.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aksr
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0531\531\531\isndntio.exe3
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aksn
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0531\531\531\msoscqit00.dll
   [DETECTION] Is the Trojan horse TR/Agent.qqx.1
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0531\531\531\msosmnsf00.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.akdb
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0531\531\531\msosmsp2p32.sys2
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajrr
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0531\531\531\msosping00.dll
   [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0531\531\531\net.exe3
   [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0531\531\531\nicomsp2p32.sys
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajrr
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0531\531\531\Skype3084.exe3
   [DETECTION] Is the Trojan horse TR/BHO.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0531\531\531\soc.exe3
   [DETECTION] Is the Trojan horse TR/Agent.22336
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0531\531\531\svchos.com3
   [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0531\531\531\ticisms.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NVI.197
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0531\531\531\ticisms.exe3
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aksa
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0531\531\531\v1.exe3
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Dudu.a.1.B
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0531\531\531\wynsjceqji.dll
   [DETECTION] Is the Trojan horse TR/BHO.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0531\531\531\xz.exe3
  [0] Archive type: RAR SFX (self extracting)
  --> baidu11.exe
   [DETECTION] Contains detection pattern of the dropper DR/Dldr.Delf.frg
  --> ha_80113.exe
   [DETECTION] Is the Trojan horse TR/Downloader.Gen
  --> install.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.QF.1
   [NOTE]    The file was deleted!

End of the scan: 星期五 2008年5月30日  12:00
Used time: 00:19 min

The scan has been done completely.

   3 Scanning directories
   63 Files were scanned
   27 viruses and/or unwanted programs were found
   1 Files were classified as suspicious:
   26 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   36 Files not concerned
   2 Archives were scanned
   0 Warnings
   26 Notes

显示全部楼层 · 发表于 2008-5-30 12:01:37

Starting the file scan:

Begin scan in 'E:\AV\531'
E:\AV\531\531\0524.exe3
   [DETECTION] Is the Trojan horse TR/PSW.LdPinch.jm1
   [NOTE]    The file was deleted!
E:\AV\531\531\0529.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [NOTE]    The file was deleted!
E:\AV\531\531\2.exe3
   [DETECTION] Contains suspicious code HEUR/Crypted
   [NOTE]    The file was deleted!
E:\AV\531\531\a09.exe3
   [DETECTION] Is the Trojan horse TR/Downloader.Gen
   [NOTE]    The file was deleted!
E:\AV\531\531\afengspig.exe3
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Dudu.a.1.B
   [NOTE]    The file was deleted!
E:\AV\531\531\b.exe3
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\AV\531\531\boxmod.exe3
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.zac
   [NOTE]    The file was deleted!
E:\AV\531\531\crack.exe3
   [DETECTION] Is the Trojan horse TR/Dldr.Zlob.mnd
   [NOTE]    The file was deleted!
E:\AV\531\531\ha_80029.exe3
   [DETECTION] Is the Trojan horse TR/Downloader.Gen
   [NOTE]    The file was deleted!
E:\AV\531\531\ha_80170.exe3
   [DETECTION] Is the Trojan horse TR/Downloader.Gen
   [NOTE]    The file was deleted!
E:\AV\531\531\isndntio.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aksr
   [NOTE]    The file was deleted!
E:\AV\531\531\isndntio.exe3
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aksn
   [NOTE]    The file was deleted!
E:\AV\531\531\msoscqit00.dll
   [DETECTION] Is the Trojan horse TR/Agent.qqx.1
   [NOTE]    The file was deleted!
E:\AV\531\531\msosmnsf00.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.akdb
   [NOTE]    The file was deleted!
E:\AV\531\531\msosmsp2p32.sys2
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajrr
   [NOTE]    The file was deleted!
E:\AV\531\531\msosping00.dll
   [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
   [NOTE]    The file was deleted!
E:\AV\531\531\net.exe3
   [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
   [NOTE]    The file was deleted!
E:\AV\531\531\nicomsp2p32.sys
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajrr
   [NOTE]    The file was deleted!
E:\AV\531\531\Skype3084.exe3
   [DETECTION] Is the Trojan horse TR/BHO.Gen
   [NOTE]    The file was deleted!
E:\AV\531\531\soc.exe3
   [DETECTION] Is the Trojan horse TR/Agent.22336
   [NOTE]    The file was deleted!
E:\AV\531\531\svchos.com3
   [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
   [NOTE]    The file was deleted!
E:\AV\531\531\ticisms.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NVI.197
   [NOTE]    The file was deleted!
E:\AV\531\531\ticisms.exe3
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aksa
   [NOTE]    The file was deleted!
E:\AV\531\531\v1.exe3
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Dudu.a.1.B
   [NOTE]    The file was deleted!
E:\AV\531\531\wynsjceqji.dll
   [DETECTION] Is the Trojan horse TR/BHO.Gen
   [NOTE]    The file was deleted!
E:\AV\531\531\xz.exe3
  [0] Archive type: RAR SFX (self extracting)
  --> baidu11.exe
   [DETECTION] Contains detection pattern of the dropper DR/Dldr.Delf.frg
  --> ha_80113.exe
   [DETECTION] Is the Trojan horse TR/Downloader.Gen
  --> install.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.QF.1
   [NOTE]    The file was deleted!

End of the scan: 2008年5月30日  12:04
Used time: 00:15 min

The scan has been done completely.

   2 Scanning directories
   63 Files were scanned
   27 viruses and/or unwanted programs were found
   1 Files were classified as suspicious:
   26 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   36 Files not concerned
   2 Archives were scanned
   0 Warnings
   26 Notes

25032002  22.exe3  61.95 KB  DAMAGED FILE (UNKNOWN)
25032003  A~NSISu_.exe3  61.89 KB  CLEAN
25032004  atielf.dat  7.97 KB  CLEAN
25032005  Atiptaxx.exe3  125.34 KB  DAMAGED FILE (UNKNOWN)
25032006  cid_store.dat  776 Byte  CLEAN
25032007  cmuninst.dat  120 KB  CLEAN
25032008  drthte.dll  8.13 KB  DAMAGED FILE (UNKNOWN)
25032009  fjyjy.dll  28.68 KB  DAMAGED FILE (UNKNOWN)
25032010  Googlekaba.exe3  36 KB  CLEAN
25032011  msoscqit.dat  256 Byte  DAMAGED FILE (UNKNOWN)
25032012  msosdohs.dat  512 Byte  DAMAGED FILE (UNKNOWN)
25032013  msosfmsq.dat  256 Byte  DAMAGED FILE (UNKNOWN)
25032014  msosjtio.dat  256 Byte  DAMAGED FILE (UNKNOWN)
25003834  msosmhfp.dat  256 Byte  CLEAN
25032015  msosmnsf.dat  256 Byte  DAMAGED FILE (UNKNOWN)
25032016  msosmsfpfis64.sys3  3.25 KB  MALWARE
1084443  bootstat.dat  2 KB  KNOWN CLEAN
448054  fltMc.exe3  22.5 KB  KNOWN CLEAN
25032018  msosping.dat  128 Byte  UNDER ANALYSIS
25032019  msosptfs.dat  128 Byte  UNDER ANALYSIS
25032020  nicozftp.dat  256 Byte  UNDER ANALYSIS
25032021  presetup.cmd3  2.97 KB  UNDER ANALYSIS
25032022  pub_store.dat  20 Byte  UNDER ANALYSIS
25032023  rdthr.dll  32.48 KB  UNDER ANALYSIS
254460  RSBDBACKUP.DLL2  16 Byte  CLEAN
25032024  setupold.exe3  28 KB  UNDER ANALYSIS
25032025  VIRTUAL.dll  1.68 KB  UNDER ANALYSIS
25032026  wpa.dbl  2.15 KB  UNDER ANALYSIS
25032027  xbcvxb.dll3  27.74 KB  UNDER ANALYSIS
25032028  xlhcc.dat  26 Byte  UNDER ANALYSIS
25032029  zfdzb.dll  29.25 KB  UNDER ANALYSIS
25032030  ############.txt  863 Byte  UNDER ANALYSIS

[ 本帖最后由 Exia 于 2008-5-30 19:02 编辑 ]

显示全部楼层 · 发表于 2008-5-30 12:06:13

如果没猜错的话。。。
生成物还少了几个DLL。。。
DAT的不是病毒。。。

扫描系统区域...
扫描所选择的目录和文件...
对象: 0524.exe3
路径: C:\Documents and Settings\wangcheng\桌面\531\531
Status: 已发现病毒
病毒: Trojan.Dropper.Microjoin.WA (BD 引擎)
对象: 0529.exe3
路径: C:\Documents and Settings\wangcheng\桌面\531\531
Status: 已发现病毒
病毒: GenPack:Backdoor.Small.CHJ (BD 引擎)
对象: a09.exe3
路径: C:\Documents and Settings\wangcheng\桌面\531\531
Status: 已发现病毒
病毒: DeepScan:Generic.Malware.dld!!.54C5BCAD (BD 引擎)
对象: afengspig.exe3
路径: C:\Documents and Settings\wangcheng\桌面\531\531
Status: 已发现病毒
病毒: Adware.Generic.17753 (BD 引擎)
对象: b.exe3
路径: C:\Documents and Settings\wangcheng\桌面\531\531
Status: 已发现病毒
病毒: Generic.Malware.P!Pk!g.A948056A (BD 引擎)
对象: isndntio.dll
路径: C:\Documents and Settings\wangcheng\桌面\531\531
Status: 已发现病毒
病毒: Trojan.PWS.OnLineGames.NVI (BD 引擎)
对象: isndntio.exe3
路径: C:\Documents and Settings\wangcheng\桌面\531\531
Status: 已发现病毒
病毒: Trojan.PWS.OnLineGames.NVI (BD 引擎)
对象: msosmsp2p32.sys2
路径: C:\Documents and Settings\wangcheng\桌面\531\531
Status: 已发现病毒
病毒: Trojan.Generic.283840 (BD 引擎)
对象: net.exe3
路径: C:\Documents and Settings\wangcheng\桌面\531\531
Status: 可疑病毒
病毒: BehavesLike:Trojan.StartPage (BD 引擎)
对象: nicomsp2p32.sys
路径: C:\Documents and Settings\wangcheng\桌面\531\531
Status: 已发现病毒
病毒: Trojan.Generic.283840 (BD 引擎)
对象: soc.exe3
路径: C:\Documents and Settings\wangcheng\桌面\531\531
Status: 已发现病毒
病毒: Generic.Malware.P!BPk!g.950B2973 (BD 引擎)
对象: svchos.com3
路径: C:\Documents and Settings\wangcheng\桌面\531\531
Status: 已发现病毒
病毒: GenPack:Generic.Malware.PVdldPkg.BBD40019 (BD 引擎)
对象: ticisms.dll
路径: C:\Documents and Settings\wangcheng\桌面\531\531
Status: 已发现病毒
病毒: Trojan.PWS.OnLineGames.NVI (BD 引擎)
对象: ticisms.exe3
路径: C:\Documents and Settings\wangcheng\桌面\531\531
Status: 已发现病毒
病毒: Generic.PWS.Games.4.CBFF8050 (BD 引擎)
对象: v1.exe3
路径: C:\Documents and Settings\wangcheng\桌面\531\531
Status: 已发现病毒
病毒: Trojan.Flooder.AladUDP.A (BD 引擎)
对象: (RAR Sfx o) baidu11.exe
在压缩档案里: C:\Documents and Settings\wangcheng\桌面\531\531\xz.exe3
Status: 已发现病毒
病毒: Trojan.Generic.253486 (BD 引擎)
对象: (RAR Sfx o)=>msn004.exe=>(NSIS o) lzma_solid_nsis0000
在压缩档案里: C:\Documents and Settings\wangcheng\桌面\531\531\xz.exe3
Status: 已发现病毒
病毒: Adware.Cinmus.XY (BD 引擎)
对象: (RAR Sfx o)=>msn004.exe=>(NSIS o)=>lzma_solid_nsis0002=>(NSIS o) lzma_nsis0002
在压缩档案里: C:\Documents and Settings\wangcheng\桌面\531\531\xz.exe3
Status: 已发现病毒
病毒: Generic.Adware.Cinmus.495054ED (BD 引擎)
对象: (RAR Sfx o)=>msn004.exe=>(NSIS o)=>lzma_solid_nsis0003=>(NSIS o) lzma_nsis0000
在压缩档案里: C:\Documents and Settings\wangcheng\桌面\531\531\xz.exe3
Status: 已发现病毒
病毒: Adware.Cinmus.XY (BD 引擎)
对象: (RAR Sfx o)=>msn004.exe=>(NSIS o)=>lzma_solid_nsis0003=>(NSIS o) lzma_nsis0002
在压缩档案里: C:\Documents and Settings\wangcheng\桌面\531\531\xz.exe3
Status: 已发现病毒
病毒: Adware.Cinmus.Gen (BD 引擎)
对象: xz.exe3
路径: C:\Documents and Settings\wangcheng\桌面\531\531
Status: 已发现病毒
病毒: Trojan.Generic.253486, Adware.Cinmus.XY (2x), Generic.Adware.Cinmus.495054ED, Adware.Cinmus.Gen (BD 引擎)
扫描完成: 2008-5-30 12:04
已检查 58 个文件
已发现 15 个染毒文件
。。

显示全部楼层 · 发表于 2008-5-30 12:16:42

avast!

E:\VirusZoo\MalCol\531\531\0524.exe3 [L] Win32:Joiner-H [Trj] (0)
E:\VirusZoo\MalCol\531\531\0529.exe3\[BeRoEXE] [L] Win32:Agent-MLJ [Trj] (0)
E:\VirusZoo\MalCol\531\531\2.exe3\[UPX] [L] Win32:JunkPoly [Cryp] (0)
E:\VirusZoo\MalCol\531\531\b.exe3\[Upack]\[Embedded#03008]\[Embedded#a808] [L] Win32:Trojan-gen {Other} (0)
E:\VirusZoo\MalCol\531\531\isndntio.dll [L] Win32:OnLineGames-DQS [Trj] (0)
E:\VirusZoo\MalCol\531\531\isndntio.exe3\[FSG] [L] Win32:OnLineGames-DQS [Trj] (0)
E:\VirusZoo\MalCol\531\531\msoscqit00.dll\[Upack] [L] Win32:Agent-BQC [Trj] (0)
E:\VirusZoo\MalCol\531\531\msosmnsf00.dll\[Upack] [L] Win32:Agent-BQC [Trj] (0)
E:\VirusZoo\MalCol\531\531\msosping00.dll\[Upack] [L] Win32:Agent-BQC [Trj] (0)
E:\VirusZoo\MalCol\531\531\net.exe3\[UPX] [L] Win32:Downloader-AVW (0)
E:\VirusZoo\MalCol\531\531\Skype3084.exe3\[PECompact]\[Embedded#AAA]\[PECompact] [L] Win32:Ejik-B [Adw] (0)
E:\VirusZoo\MalCol\531\531\soc.exe3\[Upack]\[Embedded#07e8c]\[Embedded#4000] [L] Win32:Rootkit-gen [Rtk] (0)
E:\VirusZoo\MalCol\531\531\ticisms.dll [L] Win32:OnLineGames-DQS [Trj] (0)
E:\VirusZoo\MalCol\531\531\ticisms.exe3\[FSG] [L] Win32:OnLineGames-DQS [Trj] (0)
E:\VirusZoo\MalCol\531\531\v1.exe3\[NsPack] [L] Win32:FlyStudio-B [Trj] (0)
E:\VirusZoo\MalCol\531\531\wynsjceqji.dll\[PECompact] [L] Win32:Ejik-B [Adw] (0)
E:\VirusZoo\MalCol\531\531\xz.exe3\baidu11.exe [L] Win32:Trojan-gen {Other} (0)
E:\VirusZoo\MalCol\531\531\xz.exe3\msn004.exe\$TEMP\3_7804.exe [L] Win32:Trojan-gen {Other} (0)
E:\VirusZoo\MalCol\531\531\xz.exe3\msn004.exe\$TEMP\$TEMP\3.exe\$TEMP\acpidisk.sys [L] Win32:Cinmus-J [Rtk] (0)
E:\VirusZoo\MalCol\531\531\xz.exe3\msn004.exe [L] Win32:Adware-gen [Adw] (0)
E:\VirusZoo\MalCol\531\531\xz.exe3\install.exe [E] RAR archive is corrupted. (42126)
E:\VirusZoo\MalCol\531\531\xz.exe3 [L] Win32:Trojan-gen {Other} (0)
Infected files: 21

显示全部楼层 · 发表于 2008-5-30 12:17:22

D:\病毒测试\临时解压\531\531\0524.exe3 - 特征码 'Trojan-Dropper.Win32.Microjoin' 被发现
D:\病毒测试\临时解压\531\531\0529.exe3 - 特征码 'Trojan.Popwin.R' 被发现
D:\病毒测试\临时解压\531\531\2.exe3
D:\病毒测试\临时解压\531\531\22.exe3
D:\病毒测试\临时解压\531\531\a09.exe3
D:\病毒测试\临时解压\531\531\afengspig.exe3 - 特征码 'not-a-virus:AdWare.Win32.WSearch.c' 被发现
D:\病毒测试\临时解压\531\531\atielf.dat
D:\病毒测试\临时解压\531\531\Atiptaxx.exe3
D:\病毒测试\临时解压\531\531\A~NSISu_.exe3
D:\病毒测试\临时解压\531\531\b.exe3
D:\病毒测试\临时解压\531\531\bootstat.dat
D:\病毒测试\临时解压\531\531\boxmod.exe3 - 特征码 'Trojan-Downloader.Win32.Agent.fgf' 被发现
D:\病毒测试\临时解压\531\531\cid_store.dat
D:\病毒测试\临时解压\531\531\cmuninst.dat
D:\病毒测试\临时解压\531\531\crack.exe3
D:\病毒测试\临时解压\531\531\drthte.dll
D:\病毒测试\临时解压\531\531\fjyjy.dll
D:\病毒测试\临时解压\531\531\fltMc.exe3
D:\病毒测试\临时解压\531\531\Googlekaba.exe3 - 特征码 'Email-Worm.Win32.VB.bs' 被发现
D:\病毒测试\临时解压\531\531\ha_80029.exe3
D:\病毒测试\临时解压\531\531\ha_80170.exe3 - 特征码 'Trojan-Downloader' 被发现
D:\病毒测试\临时解压\531\531\isndntio.dll
D:\病毒测试\临时解压\531\531\isndntio.exe3 - 可疑代码段被发现 (Level: 140)
D:\病毒测试\临时解压\531\531\msoscqit.dat
D:\病毒测试\临时解压\531\531\msoscqit00.dll - 特征码 'Virus.Win32.Agent.BQC' 被发现
D:\病毒测试\临时解压\531\531\msosdohs.dat
D:\病毒测试\临时解压\531\531\msosfmsq.dat
D:\病毒测试\临时解压\531\531\msosjtio.dat
D:\病毒测试\临时解压\531\531\msosmhfp.dat
D:\病毒测试\临时解压\531\531\msosmnsf.dat
D:\病毒测试\临时解压\531\531\msosmnsf00.dll - 特征码 'Virus.Win32.Agent.BQC' 被发现
D:\病毒测试\临时解压\531\531\msosmsfpfis64.sys3
D:\病毒测试\临时解压\531\531\msosmsp2p32.sys2 - 特征码 'Win32.SuspectCrc' 被发现
D:\病毒测试\临时解压\531\531\msosping.dat
D:\病毒测试\临时解压\531\531\msosping00.dll - 特征码 'Virus.Win32.Agent.BQC' 被发现
D:\病毒测试\临时解压\531\531\msosptfs.dat
D:\病毒测试\临时解压\531\531\net.exe3 - 特征码 'BehavesLikeWin32.ExplorerHijack' 被发现
D:\病毒测试\临时解压\531\531\nicomsp2p32.sys - 特征码 'Win32.SuspectCrc' 被发现
D:\病毒测试\临时解压\531\531\nicozftp.dat
D:\病毒测试\临时解压\531\531\presetup.cmd3
D:\病毒测试\临时解压\531\531\pub_store.dat
D:\病毒测试\临时解压\531\531\rdthr.dll
D:\病毒测试\临时解压\531\531\RSBDBACKUP.DLL2
D:\病毒测试\临时解压\531\531\setupold.exe3
D:\病毒测试\临时解压\531\531\Skype3084.exe3
D:\病毒测试\临时解压\531\531\soc.exe3 - 特征码 'Win32.SuspectCrc' 被发现
D:\病毒测试\临时解压\531\531\svchos.com3 - 特征码 'Trojan-PWS.Win32.Agent.iv' 被发现
D:\病毒测试\临时解压\531\531\ticisms.dll
D:\病毒测试\临时解压\531\531\ticisms.exe3 - 可疑代码段被发现 (Level: 140)
D:\病毒测试\临时解压\531\531\v1.exe3 - 特征码 'Trojan-PWS.Win32.Agent.BU' 被发现
D:\病毒测试\临时解压\531\531\VIRTUAL.dll
D:\病毒测试\临时解压\531\531\wpa.dbl
D:\病毒测试\临时解压\531\531\wynsjceqji.dll
D:\病毒测试\临时解压\531\531\xbcvxb.dll3
D:\病毒测试\临时解压\531\531\xlhcc.dat
D:\病毒测试\临时解压\531\531\xz.exe3:\baidu11.exe - 特征码 'Trojan-Downloader.Win32.Delf.asz' 被发现
D:\病毒测试\临时解压\531\531\xz.exe3:\ha_80113.exe - 特征码 'Trojan-Downloader' 被发现
D:\病毒测试\临时解压\531\531\xz.exe3:\msn004.exe
D:\病毒测试\临时解压\531\531\xz.exe3:\install.exe
D:\病毒测试\临时解压\531\531\xz.exe3
D:\病毒测试\临时解压\531\531\zfdzb.dll
D:\病毒测试\临时解压\531\531\木马下载地址.txt

62 文件被扫描
(2 压缩档 4 文件)
17 特征码被侦测
2 可疑代码段被发现
耗时: 0:27.880

显示全部楼层 · 发表于 2008-5-30 19:49:54

[Scanning : C:\Documents and Settings\All Users\Documents\Test]

C:\Documents and Settings\All Users\Documents\Test\0531.part1.rar<RAR>:0529.exe3 <- Trojan.Agent.Ary : No action
C:\Documents and Settings\All Users\Documents\Test\0531.part1.rar<RAR>:afengspig.exe3 <- Adware.Wsearch.D : No action
C:\Documents and Settings\All Users\Documents\Test\0531.part1.rar<RAR>:b.exe3<UPack>:b.exe3 <- Heur.RoundKick : No action
C:\Documents and Settings\All Users\Documents\Test\0531.part2.rar<RAR>:crack.exe3 <- Heur.W32 : No action
C:\Documents and Settings\All Users\Documents\Test\0531.part2.rar<RAR>:msosmnsf00.dll <- Trojan.Psw.Onlinegames.Akdb : No action
C:\Documents and Settings\All Users\Documents\Test\0531.part2.rar<RAR>:net.exe3<UPX>:net.exe3 <- W32.Dr.Agent.Bsv : No action
C:\Documents and Settings\All Users\Documents\Test\0531.part3.rar<RAR>:soc.exe3 <- Trojan.Downloader.Losabel.Nx : No action
C:\Documents and Settings\All Users\Documents\Test\0531.part3.rar<RAR>:soc.exe3<UPack>:soc.exe3 <- Heur.RoundKick : No action

Scanned objects : 74

Infected objects : 8

显示全部楼层 · 发表于 2008-5-30 19:50:52

[Found security risk] <W32/Nilage.gen!GSA (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\0531.part1.rar->531\531\0524.exe3->(embedded)->(UPack)
[Found possible security risk] <W32/Heuristic-210!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\0531.part1.rar->531\531\b.exe3->(UPack)
[Found security risk] <W32/Tibs.M.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\0531.part2.rar->531\531\crack.exe3
[Found downloader] <W32/Downloader.D.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\0531.part2.rar->531\531\ha_80029.exe3
[Found downloader] <W32/Downloader.D.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\0531.part2.rar->531\531\ha_80170.exe3
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\0531.part2.rar->531\531\msoscqit00.dll
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\0531.part2.rar->531\531\msosmnsf00.dll
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\0531.part2.rar->531\531\msosping00.dll
[Found downloader] <W32/DelfDldr.C.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\0531.part2.rar->531\531\net.exe3->(UPX)
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\0531.part3.rar->531\531\soc.exe3->(UPack)
[Found backdoor] <W32/Ciadoor.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\0531.part3.rar->531\531\svchos.com3

---------------------------------------------------------------------
Scan ended: 2008-5-30, 19:50:13
Duration: 0:00:13

Scan result:

Scanned files:    11
Infected objects:    11
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

显示全部楼层 · 发表于 2008-5-30 20:08:13

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.DL.Win32.Undef.ot
病毒： Trojan.DL.Win32.Undef.ov
病毒： Trojan.DL.Win32.Mnless.ahb
病毒： Trojan.PSW.Win32.GameOL.ntn
病毒： RootKit.Win32.Undef.if
病毒： Dropper.Win32.Agent.gcx
病毒： Trojan.PSW.Win32.GameOL.ntp
病毒： Trojan.PSW.Win32.GameOL.nto

MAC 地址：00:17:31:40:A3:57

用户来源：局域网

软件版本：20.46.42

[病毒样本] 58

本帖子中包含更多资源

ArcaVir2008

F-Prot 4.4.4

11