*26

电影结束了

昨天的东西...

ssy275

kkgh

费尔11个

        瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.DL.Win32.Mnless.ane
病毒： Trojan.DL.Win32.QQHelper.bdp
病毒： Trojan.DL.Win32.Zlob.gbo
病毒： Trojan.Win32.Undef.iuy   
病毒： Trojan.Win32.Undef.int   
病毒： AdWare.Win32.Agent.bvn   
病毒： Trojan.Win32.Vapsup.eml  
病毒： AdWare.Win32.Agent.byv   
病毒： Trojan.Win32.Vapsup.elr  

用户来源：互联网

软件版本：20.51.32

14个

Kitman

Begin scan in 'C:\Documents and Settings\Administrator\桌面\26'
C:\Documents and Settings\Administrator\桌面\26\931928.dll
      [DETECTION] Is the Trojan horse TR/BHO.Gen
      [NOTE]      A backup was created as '489ebaa5.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\26\axrfgvek.dll
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/AdSpy.Gen
      [NOTE]      A backup was created as '48dfbaeb.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\26\edgp.exe
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/AdSpy.Gen
      [NOTE]      A backup was created as '48d4bad7.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\26\freebsd.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      A backup was created as '48d2bae5.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\26\install1.exe
      [DETECTION] Is the Trojan horse TR/BHO.Gen
      [NOTE]      A backup was created as '48e0bae1.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\26\iSecurity.cpl
      [DETECTION] Is the Trojan horse TR/Emgr.AQ.6
      [NOTE]      A backup was created as '48d2bac6.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\26\iSecurity1.cpl
      [DETECTION] Is the Trojan horse TR/Emgr.AL.14
      [NOTE]      A backup was created as '49554217.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\26\jkkIAPJD.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [NOTE]      A backup was created as '48d8bade.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\26\kgqfwelttko.dll
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/AdSpy.Gen
      [NOTE]      A backup was created as '48debada.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\26\mrvtdpqe.exe
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/AdSpy.Gen
      [NOTE]      A backup was created as '48e3bae5.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\26\notepad.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      A backup was created as '48e1bae2.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\26\nqgpedlr.dll
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/AdSpy.Gen
      [NOTE]      A backup was created as '48d4bae4.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\26\null.sys
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [NOTE]      A backup was created as '48d9bae8.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\26\okmdepgb.dll
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Agent.PB
      [NOTE]      A backup was created as '48dabade.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\26\psonyx.dll
      [DETECTION] Is the Trojan horse TR/BHO.Fake.26624.B
      [NOTE]      A backup was created as '48dcbae6.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\26\qknlgp.dll
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Backdoor.Gen Backdoor server programs
      [NOTE]      A backup was created as '48dbbade.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\26\SiZhu.exe
      [DETECTION] Is the Trojan horse TR/Drop.Cattivo.A
      [NOTE]      A backup was created as '48c7badc.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\26\sprof.exe
      [DETECTION] Is the Trojan horse TR/Mitglieder.6148
      [NOTE]      A backup was created as '48dfbae3.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\26\winpsa32.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      A backup was created as '48dbbadc.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!


End of the scan: 2008年7月4日  13:51
Used time: 00:03 min

The scan has been done completely.

      1 Scanning directories
     26 Files were scanned
     19 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
     19 files were deleted
      0 files were repaired
     19 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      7 Files not concerned
      0 Archives were scanned
      0 Warnings
     19 Notes

1263422	beep.sys	36 KB	MALWARE
25065960	calc.exe	50 KB	UNDER ANALYSIS
25065961	install.exe	15 KB	UNDER ANALYSIS
25065355	media.php	293.41 KB	UNDER ANALYSIS
25065962	tmp19.tmp	19.7 KB	UNDER ANALYSIS
25065963	tmp1A.tmp	659 KB	UNDER ANALYSIS
74325	21.tmp	2.88 KB	KNOWN CLEAN

[ 本帖最后由 Kitman 于 2008-7-4 13:55 编辑 ]

啊弥陀佛

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\26[1]\NOTEPAD.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\26[1]\SIZHU.EXE
是否删除病毒程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\26[1]\SPROF.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\SPROF\SPROF.EXE
是否删除木马程序及其衍生物?

IllusionWing

beep.sys应该不是吧

sam.to

已刪除: 廣告軟體 not-a-virus:AdWare.Win32.E404.dt        檔案: C:\Documents and Settings\kato9096\桌面\26\931928.dll//PE_Patch.UPX//UPX
已刪除: 特洛伊木馬程式 Trojan.Win32.Vapsup.hoy        檔案: C:\Documents and Settings\kato9096\桌面\26\axrfgvek.dll
已刪除: 特洛伊木馬程式 Trojan.Win32.Vapsup.hqu        檔案: C:\Documents and Settings\kato9096\桌面\26\edgp.exe
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.BHO.lm        檔案: C:\Documents and Settings\kato9096\桌面\26\install1.exe
已刪除: 特洛伊木馬程式 Trojan.Win32.Emgr.aq        檔案: C:\Documents and Settings\kato9096\桌面\26\iSecurity.cpl//PE_Patch.PECompact//PecBundle//PECompact
已刪除: 特洛伊木馬程式 Trojan.Win32.Emgr.al        檔案: C:\Documents and Settings\kato9096\桌面\26\iSecurity1.cpl//PE_Patch.PECompact//PecBundle//PECompact
已刪除: 特洛伊木馬程式 Trojan.Win32.Monderc.gen        檔案: C:\Documents and Settings\kato9096\桌面\26\jkkIAPJD.dll
已刪除: 特洛伊木馬程式 Trojan.Win32.Vapsup.hqt        檔案: C:\Documents and Settings\kato9096\桌面\26\kgqfwelttko.dll
已刪除: 特洛伊木馬程式 Trojan.Win32.Vapsup.hoy        檔案: C:\Documents and Settings\kato9096\桌面\26\media.php//stream//data0002
已刪除: 特洛伊木馬程式 Trojan.Win32.Vapsup.hqs        檔案: C:\Documents and Settings\kato9096\桌面\26\media.php//stream//data0003
已刪除: 特洛伊木馬程式 Trojan.Win32.Vapsup.hqt        檔案: C:\Documents and Settings\kato9096\桌面\26\media.php//stream//data0005
已刪除: 特洛伊木馬程式 Trojan.Win32.Vapsup.hoz        檔案: C:\Documents and Settings\kato9096\桌面\26\media.php//stream//data0006
已刪除: 特洛伊木馬程式 Trojan.Win32.Vapsup.hqu        檔案: C:\Documents and Settings\kato9096\桌面\26\media.php//stream//data0007
已刪除: 特洛伊木馬程式 Trojan.Win32.Vapsup.hqv        檔案: C:\Documents and Settings\kato9096\桌面\26\media.php//stream//data0008
已刪除: 特洛伊木馬程式 Trojan.Win32.Vapsup.hqs        檔案: C:\Documents and Settings\kato9096\桌面\26\mrvtdpqe.exe
已刪除: 特洛伊木馬程式 Trojan.Win32.Vapsup.hqv        檔案: C:\Documents and Settings\kato9096\桌面\26\nqgpedlr.dll
已刪除: 特洛伊木馬程式 Rootkit.Win32.KernelBot.au        檔案: C:\Documents and Settings\kato9096\桌面\26\null.sys
已刪除: 特洛伊木馬程式 Trojan.Win32.Vapsup.hoz        檔案: C:\Documents and Settings\kato9096\桌面\26\okmdepgb.dll
已刪除: 特洛伊木馬程式 Trojan.Win32.BHO.eow        檔案: C:\Documents and Settings\kato9096\桌面\26\psonyx.dll//PE_Patch.UPX//UPX
已刪除: 特洛伊木馬程式 Trojan.Win32.Delf.dal        檔案: C:\Documents and Settings\kato9096\桌面\26\SiZhu.exe//FSG
已刪除: 特洛伊木馬程式 Trojan.Win32.Obfuscated.emz        檔案: C:\Documents and Settings\kato9096\桌面\26\winpsa32.dll


21,有10个不报,已上报到卡巴.

barbara

avg 8.0 pro:
22 found(21virus & 1spyware, 3 heur)

[ 本帖最后由 barbara 于 2008-7-4 15:37 编辑 ]

Palkia

金山 miss 21

Kitman

beep.sys 應該不是 機械分析有問題