Three

qigang

[update]
ver=2008040422
url=http://yaoip.fuckunion.com/386/soft/yaoip.exe
timer=1
timerbegin=0
[popwin]
popwin=0
count=0
[file]
file=1
file1=http://google.netcdn.com/cao/cao.exe
filename1=skkj1.exe
ftime1=0
file2=http://ad.laoqn.com/ad.exe
filename2=skkj2.exe
ftime2=0
count=2
[count]
count=1
mecount=1
url=http://yaoip.fuckunion.com/386/count/count.asp

下载地址：

http://yaoip.fuckunion.com/386/soft/yaoip.exe

http://google.netcdn.com/cao/cao.exe

http://ad.laoqn.com/ad.exe

瑞星病毒查杀结果报告（5/2）

清除病毒种类列表：

病毒： Worm.Win32.Agent.zoe     
病毒： Trojan.Win32.Mnless.zrb  

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.47.42

Kitman

Begin scan in 'C:\Documents and Settings\Administrator\桌面\virus(2).rar'
C:\Documents and Settings\Administrator\桌面\virus(2).rar
  [0] Archive type: RAR
  --> yaoip.exe
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
    --> cao.exe
          [DETECTION] Is the Trojan horse TR/Agent.94720.H
  --> ad.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Popwin.blg Backdoor server programs
      [NOTE]      A backup was created as '48bb5d0a.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!


End of the scan: 2008年6月6日  23:49
Used time: 00:02 min

The scan has been done completely.

      0 Scanning directories
      4 Files were scanned
      3 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      0 Warnings
      1 Notes

sbbdms

卡巴杀完

已删除：病毒 Worm.Win32.AutoRun.dgw        文件　: D:\软件\其它\v\k\virus.rar/yaoip.exe//PE_Patch//UPack
已删除：木马程序 Trojan.Win32.Delf.aoo        文件　: D:\软件\其它\v\k\virus.rar/cao.exe//PE_Patch//UPack
已删除：木马程序 Backdoor.Win32.Popwin.blg        文件　: D:\软件\其它\v\k\virus.rar/ad.exe//PE_Patch//UPack

hj5abc

ALL..

2008-6-7 0:07:54    solo    1352    Sign of "Win32:Trojan-gen {Other}" has been found in "F:\virus.rar\yaoip.exe" file.  
2008-6-7 0:07:57    solo    1352    Sign of "Win32:Trojan-gen {Other}" has been found in "F:\virus.rar\cao.exe" file.  
2008-6-7 0:07:59    solo    1352    Sign of "Win32:Popwin-E [Trj]" has been found in "F:\virus.rar\ad.exe\[Upack]\[Embedded#0c010]" file.  

su-tt

2008-6-7 0:14:15        已删除: Worm.Win32.AutoRun.dgw        C:\Documents and Settings\Administrator\桌面\virus.rar/yaoip.exe               
2008-6-7 0:14:14        已被检测到: Worm.Win32.AutoRun.dgw        C:\Documents and Settings\Administrator\桌面\virus.rar/yaoip.exe/PE_Patch/UPack               
2008-6-7 0:14:14        已删除: Trojan.Win32.Delf.aoo        C:\Documents and Settings\Administrator\桌面\virus.rar/cao.exe               
2008-6-7 0:14:13        已被检测到: Trojan.Win32.Delf.aoo        C:\Documents and Settings\Administrator\桌面\virus.rar/cao.exe/PE_Patch/UPack               
2008-6-7 0:14:13        已删除: Backdoor.Win32.Popwin.blg        C:\Documents and Settings\Administrator\桌面\virus.rar/ad.exe               
2008-6-7 0:14:10        已被检测到: Backdoor.Win32.Popwin.blg        C:\Documents and Settings\Administrator\桌面\virus.rar/ad.exe/PE_Patch/UPack

woai_jolin

2008-6-7 6:57:53        HTTP 过滤器        文件        http://ad.laoqn.com/ad.exe        Win32/TrojanDownloader.Flux 特洛伊木马 的变种        连接中断 - 已隔离        10C3F72C72244B2\Administrator        通过应用程序访问 web 时检测到威胁: C:\Program Files\Internet Explorer\iexplore.exe.
2008-6-7 6:57:50        HTTP 过滤器        文件        http://google.netcdn.com/cao/cao.exe        Win32/Spy.Delf.NIL 特洛伊木马        连接中断 - 已隔离        10C3F72C72244B2\Administrator        通过应用程序访问 web 时检测到威胁: C:\Program Files\Internet Explorer\iexplore.exe.
2008-6-7 6:57:42        HTTP 过滤器        文件        http://yaoip.fuckunion.com/386/soft/yaoip.exe        Win32/TrojanDownloader.Flux 特洛伊木马 的变种        连接中断 - 已隔离        10C3F72C72244B2\Administrator        通过应用程序访问 web 时检测到威胁: C:\Program Files\Internet Explorer\iexplore.exe.

zwl2828

JM 来的吧
The requested object is INFECTED with the following viruses: Worm.Win32.AutoRun.dgw

残缺的唯美

2008-6-7        7:43:23        未采取操作         Administrator        C:\Documents and Settings\Administrator\桌面\virus.rar\CAO.EXE        Generic.dx(特洛伊)
2008-6-7        7:43:26        未采取操作         Administrator        C:\Documents and Settings\Administrator\桌面\virus.rar\AD.EXE        Generic BackDoor(特洛伊)

雨宫优子

Begin scan in 'C:\Documents and Settings\***.18F12FE200FB45E\桌面\Anti-Virus lab\Safe lab\virus'
C:\Documents and Settings\***.18F12FE200FB45E\桌面\Anti-Virus lab\Safe lab\virus\ad.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Popwin.blg Backdoor server programs
      [NOTE]      A backup was created as '4877dab1.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!
C:\Documents and Settings\***.18F12FE200FB45E\桌面\Anti-Virus lab\Safe lab\virus\cao.exe
      [DETECTION] Is the Trojan horse TR/Agent.94720.H
      [NOTE]      A backup was created as '48b8daaf.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!
C:\Documents and Settings\***.18F12FE200FB45E\桌面\Anti-Virus lab\Safe lab\virus\yaoip.exe
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [NOTE]      A backup was created as '491c6150.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!

电影结束了

对象: yaoip.exe
        在压缩档案里: F:\virus.rar
        Status: 已发现病毒
        病毒: Worm.Win32.AutoRun.dgw (KAV 引擎), Win32.Worm.Winko.I (BD 引擎)
对象: cao.exe
        在压缩档案里: F:\virus.rar
        Status: 已发现病毒
        病毒: Trojan.Win32.Delf.aoo (KAV 引擎), Generic.Malware.SFEVdldg.EEBB8726 (BD 引擎)
对象: ad.exe
        在压缩档案里: F:\virus.rar
        Status: 已发现病毒
        病毒: Backdoor.Win32.Popwin.blg (KAV 引擎), Win32.Worm.Winko.I (BD 引擎)