32x

solcroft

avast! x13

* avast! Report
* This file is generated automatically
*
* Task 'Simple user interface' used
* Started on Monday, June 02, 2008
* VPS: 080531-1, 05/31/2008
*
C:\Documents and Settings\Limited User\Desktop\qandr\2097380240.exe\[FSG] [L] Win32:Agent-BSU [Trj] (0)
C:\Documents and Settings\Limited User\Desktop\qandr\5.dllb [L] Win32:Tibser (0)
C:\Documents and Settings\Limited User\Desktop\qandr\6.dllb [L] Win32:Tibser (0)
C:\Documents and Settings\Limited User\Desktop\qandr\7.dllb [L] Win32:Tibser (0)
C:\Documents and Settings\Limited User\Desktop\qandr\dllgh8jkd1q5.exe [L] Win32:Tibser (0)
C:\Documents and Settings\Limited User\Desktop\qandr\dllgh8jkd1q6.exe [L] Win32:Tibser (0)
C:\Documents and Settings\Limited User\Desktop\qandr\dllgh8jkd1q7.exe [L] Win32:Tibser (0)
C:\Documents and Settings\Limited User\Desktop\qandr\jfiehayd.dll\[UPX] [L] Win32:Agent-UMN [Trj] (0)
C:\Documents and Settings\Limited User\Desktop\qandr\ksnhtr.sys [L] Win32:Rootkit-gen [Rtk] (0)
C:\Documents and Settings\Limited User\Desktop\qandr\maxpaynowti1.exe [L] Win32:Tibser (0)
C:\Documents and Settings\Limited User\Desktop\qandr\ntldr.exe [L] Win32:AuCrypt [Cryp] (0)
C:\Documents and Settings\Limited User\Desktop\qandr\qandr.sys [L] Win32:Rootkit-gen [Rtk] (0)
C:\Documents and Settings\Limited User\Desktop\qandr\winlogan.exe [L] Win32:Agent-UWT [Trj] (0)
Infected files: 13
Total files: 35
Total folders: 1
Total size: 1.0 MB
*
* Task stopped: Monday, June 02, 2008
* Run-time was 2 second(s)

wangjay1980

TO KL

wangjay1980

删除重复的和无毒的

上报可疑的9个

Palkia

C:\Documents and Settings\Administrator\桌面\qandr.zip>>fapejmqp.exe        TrojanDropper.Gen.ofpu        木马        还未处理
C:\Documents and Settings\Administrator\桌面\qandr.zip>>d.exe        Worm.AutoRun.dxw.rydc        病毒        还未处理
C:\Documents and Settings\Administrator\桌面\qandr.zip>>svchost.exe        TrojanPSW.LdPinch.umv.figm        木马        还未处理
C:\Documents and Settings\Administrator\桌面\qandr.zip>>2097380240.exe        TrojanDownloader.Suurch.ef.iepm        木马        还未处理


信息        2008-06-01  22:59:34        您此次查毒共查出4个病毒以及危险代码                       
信息        2008-06-01  22:59:34        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件40个                       
信息        2008-06-01  22:59:34        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
病毒        2008-06-01  22:59:34        C:\Documents and Settings\Administrator\桌面\qandr.zip\winlogan.exe        Win32.TrojDownloader.Small.32768        跳过，未处理       
病毒        2008-06-01  22:59:34        C:\Documents and Settings\Administrator\桌面\qandr.zip\ntldr.exe        Win32.Hack.NSAnti.ge        跳过，未处理       
病毒        2008-06-01  22:59:34        C:\Documents and Settings\Administrator\桌面\qandr.zip\jfiehayd.dll        Win32.TrojDownloader.Small.40960        跳过，未处理       
病毒        2008-06-01  22:59:34        C:\Documents and Settings\Administrator\桌面\qandr.zip\qandr.sys        Win32.Hack.Rootkit.ax.130048        跳过，未处理

solcroft

嗯
垃圾有点多
不好意思

小邪邪

AVK查22

wangfuxin

Sophos

20080601 150320        在 'C:\Documents and Settings\Administrator\桌面\qandr.zip\qandr.sys' 中检测到 病毒/间谍软件 'Mal/RootKit-C' 。
20080601 150320        在 'C:\Documents and Settings\Administrator\桌面\qandr.zip\fapejmqp.exe' 中检测到 病毒/间谍软件 'Mal/TibsPak' 。
20080601 150320        在 'C:\Documents and Settings\Administrator\桌面\qandr.zip\smss.exe' 中检测到 病毒/间谍软件 'Mal/EncPk-CK' 。
20080601 150320        已确认文件 "C:\Documents and Settings\Administrator\桌面\qandr.zip\dllgh8jkd1q1.exe" 为可疑文件（类型 'Sus/UnkPacker'）。
                请向 Sophos 寄送一份样本。
20080601 150320        在 'C:\Documents and Settings\Administrator\桌面\qandr.zip\jfiehayd.dll' 中检测到 病毒/间谍软件 'Mal/BenDl-A' 。
20080601 150320        在 'C:\Documents and Settings\Administrator\桌面\qandr.zip\ntldr.exe' 中检测到 病毒/间谍软件 'Mal/Behav-204' 。
20080601 150320        在 'C:\Documents and Settings\Administrator\桌面\qandr.zip\svchost.exe' 中检测到 病毒/间谍软件 'Mal/Generic-A' 。
20080601 150320        在 'C:\Documents and Settings\Administrator\桌面\qandr.zip\ksnhtr.sys' 中检测到 病毒/间谍软件 'Mal/Generic-A' 。
20080601 150320        已确认文件 "C:\Documents and Settings\Administrator\桌面\qandr.zip\1.dllb" 为可疑文件（类型 'Sus/UnkPacker'）。
                请向 Sophos 寄送一份样本。
20080601 150320        在 'C:\Documents and Settings\Administrator\桌面\qandr.zip\2097380240.exe' 中检测到 病毒/间谍软件 'Mal/Behav-116' 。
20080601 150320        在 'C:\Documents and Settings\Administrator\桌面\qandr.zip\winlogan.exe' 中检测到 病毒/间谍软件 'Mal/Heuri-E' 。
20080601 150320        扫描 '单击右键扫描' 已完成。
20080601 150320        扫描'单击右键扫描'摘要：
                已扫描项目：6
                错误：0
                已隔离项目：1
                已处置项目：0
11只可疑2个。。。

无尽藏海

"Scan ""Shell extension scan"" was finished."
"Infections found:";"20"
"Infected objects removed or healed";"0"
"Not removed or healed.";"20"
"Spyware found:";"0"
"Spyware removed:";"0"
"Not removed:";"0"
"Warnings count:";"0"
"Information count:";"0"
"Scan started:";"2008年6月1日, 23:22:48"
"Total object scanned:";"33"
"Time needed:";"1 second(s) "
"Errors encountered:";"0"

"Infections"
"File";"Infection";"Result"
"E:\VIRUS\qandr\5.dllb";"Virus identified I-Worm/Nuwar.N";"Infected"
"E:\VIRUS\qandr\6.dllb";"Virus identified I-Worm/Nuwar.N";"Infected"
"E:\VIRUS\qandr\7.dllb";"Virus identified I-Worm/Nuwar.N";"Infected"
"E:\VIRUS\qandr\d.exe";"Trojan horse Generic10.AFGM";"Infected"
"E:\VIRUS\qandr\2097380240.exe";"Trojan horse Clicker.NHN";"Infected"
"E:\VIRUS\qandr\d1.exe";"Virus found Win32/PolyCrypt";"Infected"
"E:\VIRUS\qandr\dllgh8jkd1q5.exe";"Virus identified I-Worm/Nuwar.N";"Infected"
"E:\VIRUS\qandr\dllgh8jkd1q6.exe";"Virus identified I-Worm/Nuwar.N";"Infected"
"E:\VIRUS\qandr\dllgh8jkd1q7.exe";"Virus identified I-Worm/Nuwar.N";"Infected"
"E:\VIRUS\qandr\fapejmqp.exe";"Trojan horse Generic10.ADLZ";"Infected"
"E:\VIRUS\qandr\ksnhtr.sys";"Trojan horse Downloader.Scagent.P";"Infected"
"E:\VIRUS\qandr\jfiehayd.dll";"Trojan horse Downloader.Agent.AGHX";"Infected"
"E:\VIRUS\qandr\lsass.exe";"Virus identified I-Worm/Nuwar.N";"Infected"
"E:\VIRUS\qandr\maxpaynowti1.exe";"Virus identified I-Worm/Nuwar.N";"Infected"
"E:\VIRUS\qandr\ntldr.exe";"Trojan horse PSW.OnlineGames.BP";"Infected"
"E:\VIRUS\qandr\qandr.sys";"Trojan horse Scagent.J";"Infected"
"E:\VIRUS\qandr\smss.exe";"Trojan horse SHeur.BLLS";"Infected"
"E:\VIRUS\qandr\svchost.exe";"Virus found Win32/PolyCrypt";"Infected"
"E:\VIRUS\qandr\wind32.exe";"Virus identified I-Worm/Nuwar.N";"Infected"
"E:\VIRUS\qandr\winlogan.exe";"Trojan horse Downloader.Generic7.CJF";"Infected"

无尽藏海

Begin scan in 'E:\VIRUS\qandr.zip'
E:\VIRUS\qandr.zip
  [0] Archive type: ZIP
  --> qandr.sys
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> fapejmqp.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> smss.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> xpupdate.exe
      [DETECTION] Contains detection pattern of the worm WORM/Zhelatin.Gen
  --> dllgh8jkd1q1.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> dllgh8jkd1q5.exe
      [DETECTION] Contains detection pattern of the worm WORM/Zhelatin.Gen
  --> wind32.exe
      [DETECTION] Contains detection pattern of the worm WORM/Zhelatin.Gen
  --> maxpaynowti1.exe
      [DETECTION] Contains detection pattern of the worm WORM/Zhelatin.Gen
    --> jfiehayd.dll
          [DETECTION] Is the Trojan horse TR/Downloader.Gen
  --> dllgh8jkd1q7.exe
      [DETECTION] Contains detection pattern of the worm WORM/Zhelatin.Gen
  --> d.exe
      [DETECTION] Contains detection pattern of the worm WORM/Autorun.dxw
  --> ntldr.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> lsass.exe
      [DETECTION] Contains detection pattern of the worm WORM/Zhelatin.Gen
  --> svchost.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> dllgh8jkd1q2.exe
      [DETECTION] Contains detection pattern of the worm WORM/Zhelatin.Gen
  --> dllgh8jkd1q6.exe
      [DETECTION] Contains detection pattern of the worm WORM/Zhelatin.Gen
  --> ksnhtr.sys
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 1.dllb
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 5.dllb
      [DETECTION] Contains detection pattern of the worm WORM/Zhelatin.Gen
    --> 2097380240.exe
          [DETECTION] Is the Trojan horse TR/Downloader.Gen
  --> 7.dllb
      [DETECTION] Contains detection pattern of the worm WORM/Zhelatin.Gen
  --> 2.dllb
      [DETECTION] Contains detection pattern of the worm WORM/Zhelatin.Gen
  --> 6.dllb
      [DETECTION] Contains detection pattern of the worm WORM/Zhelatin.Gen
    --> winlogan.exe
          [DETECTION] Is the Trojan horse TR/Downloader.Gen
      [WARNING]   The file was ignored!


End of the scan: 2008年6月1日  23:25
Used time: 00:06 min

The scan has been done completely.

      0 Scanning directories
     33 Files were scanned
     24 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      9 Files not concerned
      1 Archives were scanned
      1 Warnings
      0 Notes

尽在不言中