banker*22

电影结束了

昨天和今天的。。
地址：http://www.fs2you.com/files/6edac18a-5e37-11dd-8d24-0014221b798a/
PW：virus

allinwonderi

沙发。banker做的都这么肥。                18.9MB

[ 本帖最后由 allinwonderi 于 2008-7-30 21:13 编辑 ]

aerbeisi

很慢，这两天看NOD32更新了一些banker定义，待会看看效果如何。

allinwonderi

[Scanning : C:\Download Files]


C:\Download Files\list vir\IMG_Hipercard.jpg<UPX>:IMG_Hipercard.jpg <- Trojan.Banker.Banker.Pul : No action



Scanned objects : 27

Infected objects : 1

allinwonderi

[发现可能为病毒：]        <W32/Trojan-Gypikon-based.DE!Maximus>        C:\Download Files\list vir\Ibama.jpg
[发现可能为病毒：]        <W32/Trojan-Gypikon-based.DE!Maximus>        C:\Download Files\list vir\IMGBrad.jpg
[发现自动下载软件：]        <W32/Downloader.H.gen!Eldorado (not disinfectable, 普通)>        C:\Download Files\list vir\imglog.jpg->(PKLite32)
[发现可能为病毒：]        <W32/Trojan-Gypikon-based.DE!Maximus>        C:\Download Files\list vir\IMGNOSSACX.jpg
[发现可能为病毒：]        <W32/Trojan-Gypikon-based.DE!Maximus>        C:\Download Files\list vir\IMG_brasil.jpg
[发现可能为特洛伊木马：]        <W32/Heuristic-VFM!Eldorado (not disinfectable)>        C:\Download Files\list vir\IMG_Hipercard.jpg
[发现自动下载软件：]        <W32/Downloader.H.gen!Eldorado (not disinfectable, 普通)>        C:\Download Files\list vir\orkutkut.jpg->(PKLite32)
[发现自动下载软件：]        <W32/Downloader.X.gen!Eldorado (not disinfectable, 普通)>        C:\Download Files\list vir\reboot87x587.jpg
[发现可能为病毒：]        <W32/Trojan-juke-based!Maximus>        C:\Download Files\list vir\rjuju.jpg->(UPX_LZMA)
[发现自动下载软件：]        <W32/Banload.E.gen!Eldorado (not disinfectable, 普通)>        C:\Download Files\list vir\systen.jpg
[发现自动下载软件：]        <W32/Downloader.H.gen!Eldorado (not disinfectable, 普通)>        C:\Download Files\list vir\vertpre_2003_6.xml->(PKLite32)
[发现自动下载软件：]        <W32/Downloader.H.gen!Eldorado (not disinfectable, 普通)>        C:\Download Files\list vir\vertpre_2003_9.xml->(PKLite32)

---------------------------------------------------------------------
扫描已结束:        2008-7-30, 21:14:31
用时:        0:00:18

扫描结果:

已扫描的文件:                 27
已感染的对象:         12
已清除的对象:         0
已隔离的文件:         0
---------------------------------------------------------------------

报的名字不是很准

zwl2828

C:\Users\Wesley\Desktop\list vir\imglog.jpg - Win32/Spy.Banker.OZM trojan
C:\Users\Wesley\Desktop\list vir\orkutkut.jpg - Win32/Spy.Banker.QLZ trojan
C:\Users\Wesley\Desktop\list vir\reenvio.jpg - a variant of Win32/VB.IF worm

wangjay1980

最烦FS

[ 本帖最后由 wangjay1980 于 2008-7-30 21:38 编辑 ]

allinwonderi

[ 本帖最后由 allinwonderi 于 2008-7-30 21:18 编辑 ]

Kitman

Begin scan in 'C:\Users\TOSHIBA\Downloads\list vir'
C:\Users\TOSHIBA\Downloads\list vir\Ibama.jpg
    [DETECTION] Is the TR/Crypt.CFI.Gen Trojan
    [NOTE]      A backup was created as '48f169df.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\TOSHIBA\Downloads\list vir\IMGBrad.jpg
    [DETECTION] Is the TR/Crypt.CFI.Gen Trojan
    [NOTE]      A backup was created as '48d769ca.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\TOSHIBA\Downloads\list vir\imglog.jpg
    [DETECTION] Contains HEUR/Crypted.E suspicious code
    [NOTE]      The detection was classified as suspicious.
    [NOTE]      A backup was created as '48f769ea.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\TOSHIBA\Downloads\list vir\IMGNOSSACX.jpg
    [DETECTION] Is the TR/Crypt.CFI.Gen Trojan
    [NOTE]      A backup was created as '4aac91e3.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\TOSHIBA\Downloads\list vir\IMG_brasil.jpg
      [DETECTION] Contains HEUR/Crypted.E suspicious code
    [NOTE]      A backup was created as '48d769cc.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\TOSHIBA\Downloads\list vir\IMG_Hipercard.jpg
    [DETECTION] Is the TR/Crypt.FKM.Gen Trojan
    [NOTE]      A backup was created as '4aac91e5.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\TOSHIBA\Downloads\list vir\msne.jpg
    [DETECTION] Is the TR/Spy.Banker.Gen Trojan
    [NOTE]      A backup was created as '48fe69f2.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\TOSHIBA\Downloads\list vir\orkutkut.jpg
    [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '48fb69f1.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\TOSHIBA\Downloads\list vir\ponto.DLL
    [DETECTION] Is the TR/Agent.GYK Trojan
    [NOTE]      A backup was created as '48fe69ee.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\TOSHIBA\Downloads\list vir\process.jpg
    [DETECTION] Is the TR/Spy.Banker.Gen Trojan
    [NOTE]      A backup was created as '48ff69f2.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\TOSHIBA\Downloads\list vir\reboot87x587.jpg
    [DETECTION] Contains HEUR/Crypted.E suspicious code
    [NOTE]      The detection was classified as suspicious.
    [NOTE]      A backup was created as '48f269e5.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\TOSHIBA\Downloads\list vir\reenvio.jpg
      [DETECTION] Contains HEUR/Malware suspicious code
    [NOTE]      A backup was created as '48f569e5.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\TOSHIBA\Downloads\list vir\rjuju.jpg
    [DETECTION] Contains HEUR/Crypted.E suspicious code
    [NOTE]      The detection was classified as suspicious.
    [NOTE]      A backup was created as '490569ea.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\TOSHIBA\Downloads\list vir\systen.jpg
    [DETECTION] Contains HEUR/Malware suspicious code
    [NOTE]      The detection was classified as suspicious.
    [NOTE]      A backup was created as '490369fa.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\TOSHIBA\Downloads\list vir\vertpre_2003_6.xml
    [DETECTION] Is the TR/Crypt.CFI.Gen Trojan
    [NOTE]      A backup was created as '490269e6.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\TOSHIBA\Downloads\list vir\w87.jpg
    [DETECTION] Contains HEUR/Crypted.E suspicious code
    [NOTE]      The detection was classified as suspicious.
    [NOTE]      A backup was created as '48c769ba.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!


End of the scan: 2008年7月30日  21:15
Used time: 00:07 Minute(s)

The scan has been done completely.

      1 Scanning directories
     22 Files were scanned
      9 viruses and/or unwanted programs were found
      7 Files were classified as suspicious:
     16 files were deleted
      0 files were repaired
     16 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      6 Files not concerned
      0 Archives were scanned
      0 Warnings
     16 Notes

allinwonderi

FS