9

sam.to

Start of the scan: Sunday,29 June 2008  12:46

Starting the file scan:

Begin scan in 'C:\Documents and Settings\kato9096\桌面\11\ha_80074.exe3'
C:\Documents and Settings\kato9096\桌面\11\ha_80074.exe3
      [DETECTION] Is the Trojan horse TR/Downloader.Gen
      [NOTE]      The file was deleted!
Begin scan in 'C:\Documents and Settings\kato9096\桌面\11\player.exe2'
Begin scan in 'C:\Documents and Settings\kato9096\桌面\11\wangm.exe3'
C:\Documents and Settings\kato9096\桌面\11\wangm.exe3
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
      [NOTE]      The file was deleted!
Begin scan in 'C:\Documents and Settings\kato9096\桌面\11\Mouse.exe2'
C:\Documents and Settings\kato9096\桌面\11\Mouse.exe2
      [DETECTION] Is the Trojan horse TR/Dldr.Murlo.GD.46
      [NOTE]      The file was deleted!
Begin scan in 'C:\Documents and Settings\kato9096\桌面\11\server.exe3'
C:\Documents and Settings\kato9096\桌面\11\server.exe3
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
Begin scan in 'C:\Documents and Settings\kato9096\桌面\11\小耗子.exe2'
C:\Documents and Settings\kato9096\桌面\11\小耗子.exe2
      [DETECTION] Is the Trojan horse TR/Agent.499200.1
      [NOTE]      The file was deleted!
Begin scan in 'C:\Documents and Settings\kato9096\桌面\11\0'
Begin scan in 'C:\Documents and Settings\kato9096\桌面\11\00'
Begin scan in 'C:\Documents and Settings\kato9096\桌面\11\44.exe2'
C:\Documents and Settings\kato9096\桌面\11\44.exe2
      [DETECTION] Is the Trojan horse TR/Drop.Agent.53248
      [NOTE]      The file was deleted!


End of the scan: Sunday,29 June 2008  12:46
Used time: 00:06 min

The scan has been done completely.

      0 Scanning directories
      9 Files were scanned
      6 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      6 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      0 Archives were scanned
      0 Warnings
      6 Notes


File ID          Filename          Size (Byte)         Result
25037416          player.exe2          72 KB          CLEAN
4220375          0          407.5 KB          KNOWN CLEAN
4220375          00          407.5 KB          KNOWN CLEAN



已刪除: 特洛伊木馬程式 Trojan-Dropper.Win32.Agent.tkn        檔案: C:\Documents and Settings\kato9096\桌面\11\44.exe2
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Losabel.wh        檔案: C:\Documents and Settings\kato9096\桌面\11\Mouse.exe2//FSG
已刪除: 惡意軟體 Constructor.Win32.Agent.fq        檔案: C:\Documents and Settings\kato9096\桌面\11\小耗子.exe2

因紅傘說clean,所以不上报卡巴

[ 本帖最后由 kato9096 于 2008-6-29 12:50 编辑 ]

醉一生爱妍

MicroVita AntiSpyware  
_____________________________________________
                                          
             风暴微塔反间谍 T2
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]                  
                   http://221.10.254.214/
----------------------------------------------
开始扫描……


正在检查启动……
[C:\Documents and Settings\Administrator\桌面\11\wangm.exe3]
                    …………发现Spy！报告:[1] Win32.Unknow
文件信息:  大小:115208  MD5:5a7f00c5e970f2569561ed3fb5ebd721


[C:\Documents and Settings\Administrator\桌面\11\Mouse.exe2]
                    …………发现Spy！报告:[2] [1] Win32.NkHack.FSG.A
文件信息:  大小:37857  MD5:776b2c1c705dd3a3866ea720f91186d2


[C:\Documents and Settings\Administrator\桌面\11\server.exe3]
                    …………发现Spy！报告:[1] Win32.NkHack.Themida
文件信息:  大小:784525  MD5:75dbbb6f1bbb63983fa2b38796673b62


[C:\Documents and Settings\Administrator\桌面\11\小耗子.exe2]
                    …………发现Spy！报告:[1] Win32.Packer3
文件信息:  大小:499200  MD5:1e2c94ebb8811f87dcfee3ca9d3b7b81


文件数:9   病毒数:4  比重:0.4444444444444
OK  扫描完毕！

  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎   
[2] 文件特征码引擎
[1] 文件启发式引擎

欠妳緈諨

:\病毒测试\临时解压\0
D:\病毒测试\临时解压\00
D:\病毒测试\临时解压\44.exe2 - 特征码 'Trojan-Dropper.Agent.zaf' 被发现
D:\病毒测试\临时解压\ha_80074.exe3
D:\病毒测试\临时解压\Mouse.exe2 - 特征码 'Virus.Win32.Delf.CKB' 被发现
D:\病毒测试\临时解压\player.exe2
D:\病毒测试\临时解压\server.exe3 - 特征码 'not-a-virus-Riskware.Ardamax.K' 被发现
D:\病毒测试\临时解压\wangm.exe3 - 特征码 'Win32.Worm.VB.AR' 被发现
D:\病毒测试\临时解压\小耗子.exe2 - 特征码 'Virus.Win32.Agent.SIM' 被发现

        9 文件被扫描
          (0 压缩档 0 文件)
        5 特征码被侦测
        0 可疑代码段被发现
        耗时: 0:03.565

欠妳緈諨

*
* avast! 报告
* 这个文件自动被产生
*
* 任务 '扫描临时解压文件夹' 被使用
* 开始于 2008年6月29日 13:26:26
* VPS: 080627-0, 2008-06-27
*

D:\病毒测试\临时解压\ha_80074.exe3 [L] Win32:Agent-QTO [Trj] (0)
文件被成功删除...
D:\病毒测试\临时解压\Mouse.exe2\[FSG] [L] Win32:Agent-SIM [Trj] (0)
文件被成功删除...
D:\病毒测试\临时解压\wangm.exe3\[Upack]\[Embedded#DLL] [L] Win32:Pophot-AM [Trj] (0)
文件被成功删除...
D:\病毒测试\临时解压\小耗子.exe2\[PECompact] [L] Win32:Agent-SIM [Trj] (0)
文件被成功删除...
已感染文件: 4
总共文件: 15
总共文件夹: 1
总共大小: 4.4 MB

*
* 任务被停止: 2008年6月29日 13:26:30
* 运作时间是 4 秒
*

Palkia

病毒        2008-06-29  15:27:35        C:\Documents and Settings\Administrator\桌面\11\wangm.exe3        Win32.Troj.SpyDelf.ak.561152        清除成功       
病毒        2008-06-29  15:27:35        C:\Documents and Settings\Administrator\桌面\11\Mouse.exe2        Win32.Troj.OnlineGames.aw.131072        清除成功

沙加

赛门铁克2个

promised

小耗子.exe
乃生成器
还有几个系统文件参杂在里面

[ 本帖最后由 promised 于 2008-6-29 16:15 编辑 ]

woai_jolin

2008-6-29 16:17:28        Real-time file system protection        file        G:\v\c\小耗子.exe2        probably a variant of Win32/TrojanDownloader.Delf.OBZ trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-6-29 16:17:23        Real-time file system protection        file        G:\v\c\server.exe3        a variant of Win32/Packed.Themida application        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-6-29 16:17:15        Real-time file system protection        file        G:\v\c\Mouse.exe2        probably a variant of Win32/Genetik trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.

woai_jolin

ha_80074.exe
2008-6-29 16:18:08        Real-time file system protection        file        C:\Sandbox\Administrator\DefaultBox\drive\C\WINDOWS\system32\4fon58udz.dll        a variant of Win32/BHO.NDW trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\drive\C\WINDOWS\tempaq.
2008-6-29 16:18:05        Real-time file system protection        file        C:\Sandbox\Administrator\DefaultBox\drive\C\WINDOWS\system32\drivers\opteacvj41.sys        a variant of Win32/Rootkit.Agent.NBQ trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\drive\C\WINDOWS\tempaq.

电影结束了

F:\11\ha_80074.exe3           TrojanDownloader.Gen... 木马
F:\11\Mouse.exe2              Heuri.Suspicious.ERNM   启发式扫描
F:\11\server.exe3             Heuri.Possible/Packed   启发式扫描
F:\11\wangm.exe3              Heuri.Suspicious.ERNM   启发式扫描