[病毒样本] 11x

显示全部楼层 · 发表于 2008-9-21 12:26:04

Begin scan in 'C:\Users\TOSHIBA\Downloads\virus'
C:\Users\TOSHIBA\Downloads\virus\virus\Explorer.exe
[DETECTION] Is the TR/Spy.Banker.Gen Trojan
[NOTE]    A backup was created as '4945cd2d.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Downloads\virus\virus\k.exe
[DETECTION] Is the TR/Spy.Banker.1654515 Trojan
[NOTE]    A backup was created as '493acce4.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Downloads\virus\virus\msn.exe
[DETECTION] Is the TR/Crypt.CFI.Gen Trojan
[NOTE]    A backup was created as '4943cd29.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Downloads\virus\virus\or.exe
[DETECTION] Is the TR/Spy.Gen Trojan
[NOTE]    A backup was created as '4903cd28.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Downloads\virus\virus\p.exe
   [DETECTION] Is the TR/Dldr.Delphi.Gen Trojan
[NOTE]    A backup was created as '48a426fd.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Downloads\virus\virus\proceed.exe
[DETECTION] Is the TR/Spy.Banker.Gen Trojan
[NOTE]    A backup was created as '4944cd28.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Downloads\virus\virus\svchosts.exe
[DETECTION] Is the TR/Spy.Banker.Gen Trojan
[NOTE]    A backup was created as '4938cd2c.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

End of the scan: 2008年9月21日  12:25
Used time: 00:03 Minute(s)

The scan has been done completely.

   2 Scanning directories
   11 Files were scanned
   7 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   7 files were deleted
   0 files were repaired
   7 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   4 Files not concerned
   0 Archives were scanned
   0 Warnings
   7 Notes

显示全部楼层 · 发表于 2008-9-21 12:28:04

使用 G DATA AntiVirus 进行病毒病毒
版本 19.0.0.49 (22.08.2008)
病毒特征库日期 21.09.2008
开始时间: 21.09.2008 12:27
引擎: 引擎 A - BitDefender (AVA 19.467), 引擎 B - Avast! (AVB 19.34)
启发式: 开启
文件: 开启
系统区域: 关闭
RootKits 检测: 开启

检测选中目录和文件:
M:\virus\

项目: proceed.exe
路径: M:\virus
状态: 病毒,文件已删除
病毒: Trojan.Generic.282637 (Engine A)
项目: msn.exe
路径: M:\virus
状态: 病毒,文件已删除
病毒: GenPack:Trojan.Banker.Delf.YHJ (Engine A)
项目: sb.sys
路径: M:\virus
状态: 病毒,文件已删除
病毒: Trojan.Spy.Banker.AAZM (Engine A)
项目: or.exe
路径: M:\virus
状态: 病毒,文件已删除
病毒: Trojan.Crypt.Delf.B (Engine A)
项目: k.exe
路径: M:\virus
状态: 病毒,文件已删除
病毒: Generic.Banker.Delf.13A48BE1 (Engine A)
项目: p.exe
路径: M:\virus
状态: 病毒,文件已删除
病毒: Trojan.Banker.Delf.YJY (Engine A)
项目: Explorer.exe
路径: M:\virus
状态: 病毒,文件已删除
病毒: Trojan.Banker.Delf.YKH (Engine A)
项目: svchosts.exe
路径: M:\virus
状态: 病毒,文件已删除
病毒: DeepScan:Generic.Banker.OT.85F0AFB4 (Engine A)

检测执行时间: 21.09.2008 12:27
11 个文件被检查
8 个感染文件被发现
0 个可疑文件被发现

显示全部楼层 · 发表于 2008-9-21 12:30:10

2008/9/21 12:28:15 已被删除: Packed.Win32.Black.a C:\Downloads\virus\virus\Explorer.exe
2008/9/21 12:28:16 已被删除: Trojan-Banker.Win32.Banker.sdu C:\Downloads\virus\virus\k.exe
2008/9/21 12:28:17 已检测到: Heur.Trojan.Generic C:\Downloads\virus\virus\msn.exe/PE_Patch.PECompact/PecBundle/PECompact
2008/9/21 12:28:17 已被删除: Trojan-Banker.Win32.Banker.vfc C:\Downloads\virus\virus\or.exe
2008/9/21 12:28:17 已被删除: Trojan-Downloader.Win32.Banload.vur C:\Downloads\virus\virus\p.exe
2008/9/21 12:28:17 已被删除: Trojan-Downloader.Win32.Banload.nih C:\Downloads\virus\virus\proceed.exe
2008/9/21 12:28:17 已被删除: Trojan-Banker.Win32.Banker.xpc C:\Downloads\virus\virus\svchosts.exe

显示全部楼层 · 发表于 2008-9-21 12:33:13

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.DL.Win32.Banload.efm
病毒： Trojan.PSW.Win32.Undef.afo
病毒： Trojan.PSW.Win32.Undef.agi
病毒： Trojan.DL.Win32.Agent.a

MAC 地址：00:11:2F:5A:58:BC

用户来源：互联网

软件版本：20.62.60

显示全部楼层 · 发表于 2008-9-21 12:37:49

drweb 4

显示全部楼层 · 发表于 2008-9-21 13:50:55

ess3.0报5个

显示全部楼层 · 发表于 2008-9-21 20:01:09

显示全部楼层 · 发表于 2008-9-21 20:03:43

[Scanning : C:\Download Files]

C:\Download Files\virus\virus\bottle.exe <- Trojan.Spy.Banker.Jqi : No action

Scanned objects : 12

Infected objects : 1

显示全部楼层 · 发表于 2008-9-21 20:04:29

[发现可能为病毒：] <W32/Infostealer.A!Maximus> C:\Download Files\virus\virus\bottle.exe->(PKLite32)
[发现可能为病毒：] <W32/Infostealer.B!Maximus> C:\Download Files\virus\virus\Explorer.exe->(Themida)
[发现可能为病毒：] <W32/Trojan-Gypikon-based.MU!Maximus> C:\Download Files\virus\virus\msn.exe->(PecBundle)->(PECompact)
[发现自动下载软件：] <W32/Downloader.H.gen!Eldorado (not disinfectable, 普通)> C:\Download Files\virus\virus\or.exe->(PKLite32)
[发现可能为病毒：] <W32/SecRisk-ProcessPatcher-based!Maximus> C:\Download Files\virus\virus\proceed.exe->(TeLock)
[发现自动下载软件：] <W32/Downloader.X.gen!Eldorado (not disinfectable, 普通)> C:\Download Files\virus\virus\svchosts.exe

---------------------------------------------------------------------
扫描已结束: 2008-9-21, 20:04:13
用时: 0:00:25

扫描结果:

已扫描的文件:    16
已感染的对象:    6
已清除的对象:    0
已隔离的文件:    0
---------------------------------------------------------------------

[病毒样本] 11x

本帖子中包含更多资源

本帖子中包含更多资源

ArcaVir2008

F-Prot 4.4.4