virus

显示全部楼层 · 发表于 2008-10-9 09:54:14

SEP两个

显示全部楼层 · 发表于 2008-10-9 09:54:56

扫描系统区域...
扫描所选择的目录和文件...
对象: 1.exe
路径: F:\8
Status: 已发现病毒
病毒: Worm.Win32.AutoRun.qjg (KAV 引擎)
对象: 2.exe
路径: F:\8
Status: 已发现病毒
病毒: Trojan-GameThief.Win32.Magania.gen (KAV 引擎), Trojan.PWS.OnlineGames.ZWL (BD 引擎)
对象: 3.exe
路径: F:\8
Status: 已发现病毒
病毒: Trojan-GameThief.Win32.Magania.gen (KAV 引擎), Trojan.PWS.OnlineGames.ZWL (BD 引擎)
对象: 4.exe
路径: F:\8
Status: 已发现病毒
病毒: Trojan-Spy.Win32.Pophot.cwg (KAV 引擎), Generic.Malware.Sdldg.A0698E7D (BD 引擎)
对象: 5.exe
路径: F:\8
Status: 已发现病毒
病毒: Trojan-GameThief.Win32.OnLineGames.tnfd (KAV 引擎), Trojan.Agent.AHKC (BD 引擎)
对象: 7.exe
路径: F:\8
Status: 已发现病毒
病毒: Trojan-Downloader.Win32.Agent.ajax (KAV 引擎)

显示全部楼层 · 发表于 2008-10-9 10:07:38

Scan Stats:
  Scan Time: 2 seconds
  Scan Options:
  Scan Targets: D:\Users\ekincheng\Desktop\8.rar
  Counts:
Total items scanned: 10
- Files & Directories: 10
- Registry Entries: 0
- Processes & Start-up Items: 0
- Network & Browser Items: 0
- Other: 0
- Trusted Files: 0
- Skipped Files: 0

Total security risks detected: 5
Total items resolved: 0
Total items that require attention: 5

Resolved Threats:

Unresolved Threats:
Risks in compressed file "8.rar"
Type: Compressed
Risk: Medium (Medium Stealth, Medium Removal, Medium Performance, Medium Privacy)
Categories: Heuristic Virus
Status: Not Attempted
-----------
5 Files
d:\users\ekincheng\desktop\8.rar - No action taken

显示全部楼层 · 发表于 2008-10-9 14:03:23

Start of the scan: 2008年10月9日  13:57
Starting the file scan:
Begin scan in 'C:\Documents and Settings\桌面\病毒样本081009\a.rar'
C:\Documents and Settings\桌面\病毒样本081009\a.rar
[0] Archive type: RAR
--> 4.exe
   [DETECTION] Is the TR/Dropper.Gen Trojan
--> 5.exe
   [DETECTION] Is the TR/Thief.OnLineGames.tnfd Trojan
--> 9.exe
   [DETECTION] Is the TR/Agent.97280.7 Trojan
--> 8.exe
   [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
   --> 7.exe
      [DETECTION] Is the TR/Downloader.Gen Trojan
   --> 3.exe
      [1] Archive type: OVL
      --> Object
      [2] Archive type: RSRC
      --> Object
         [DETECTION] Is the TR/PSW.OnlineGames.tnfj Trojan
   --> 2.exe
      [1] Archive type: OVL
      --> Object
      [2] Archive type: RSRC
      --> Object
         [DETECTION] Is the TR/PSW.OnlineGames.tnfj Trojan
   --> 1.exe
      [DETECTION] Is the TR/Dropper.Gen Trojan
[NOTE]    A backup was created as '495f9d76.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

End of the scan: 2008年10月9日  13:57
Used time: 00:05 Minute(s)

显示全部楼层 · 发表于 2008-10-9 15:24:35

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\8\3.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\8566F82E.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\8\7.EXE
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2008-10-9 15:29:32

江民2009发现2个，并阻止下载，清除

显示全部楼层 · 发表于 2008-10-9 16:06:14

F:\8.rar > RAR > 4.exe - Win32/Spy.Pophot 特洛伊木马的变种
F:\8.rar > RAR > 5.exe - Win32/HackTool.Xarp 特洛伊木马的变种
F:\8.rar > RAR > 9.exe - Win32/TrojanDownloader.FakeAlert.LL 特洛伊木马
F:\8.rar > RAR > 7.exe - Win32/TrojanDownloader.Delf.OHJ 特洛伊木马的变种
F:\8.rar > RAR > 3.exe - Win32/PSW.OnLineGames.NRD 特洛伊木马的变种
F:\8.rar > RAR > 2.exe - Win32/PSW.OnLineGames.NRD 特洛伊木马的变种
F:\8.rar > RAR > 1.exe - 可能是 Win32/PSW.Legendmir.NGG 特洛伊木马的变种
已扫描的对象数: 8
发现的威胁数: 7

显示全部楼层 · 发表于 2008-10-9 16:40:39

杀6.上报2
2008/10/9 16:36:48 已清除病毒 Worm.Win32.AutoRun.qjg G:\Temp\Virus\8.rar/1.exe
2008/10/9 16:36:48 已清除木马程序 Trojan-GameThief.Win32.Magania.gen G:\Temp\Virus\8.rar/2.exe//PE_Patch//UPack
2008/10/9 16:36:48 已清除木马程序 Trojan-GameThief.Win32.Magania.gen G:\Temp\Virus\8.rar/3.exe//PE_Patch//UPack
2008/10/9 16:36:48 已清除木马程序 Trojan-Spy.Win32.Pophot.cwg G:\Temp\Virus\8.rar/4.exe//PE_Patch//UPack
2008/10/9 16:36:48 已清除木马程序 Trojan-GameThief.Win32.OnLineGames.tnfd G:\Temp\Virus\8.rar/5.exe
2008/10/9 16:36:48 已清除木马程序 Trojan-Downloader.Win32.Agent.ajax G:\Temp\Virus\8.rar/7.exe//ASPack

显示全部楼层 · 发表于 2008-10-9 16:53:10

红伞十个，DRWEB五个

[病毒样本] virus

本帖子中包含更多资源

本帖子中包含更多资源