DOS之家的GHOST8.3被AVG报木马？

Whitlack

今天用ＡＶＧ全盘扫描时发现C:\Documents and Settings\用户名\Local Settings\Temp下有两个木马

分别是：dropper.ag.d（这种恶意软件将有害的软件如后门程序与无害的程序捆绑在一起，被捆绑的有害的部分，如后门程序，将被安装并在用户不知道的情况下运行）

logger.agent.vs（记录程序是非常危险的，会记录用户击键或偷取如银行数据，许可号码或密码等个人数据）


请问大家有没有遇到过这种情况？

我是昨天从DOS之家下载的这个ghost8.3的版本的，按理说应该不会是故意放入的恶意软件吧？但是还是查出来了，有点怕怕

到底有没有危险呢？附上样本，还请大家指教

Whitlack

Complete scanning result of "eAPI.fne", received in VirusTotal at 01.11.2007, 13:41:39 (CET). Antivirus Version Update Result AntiVir 7.3.0.21 01.09.2007 TR/Spy.Agent.VS Authentium 4.93.8 01.10.2007 [td]no virus found Avast 4.7.892.0 12.30.2006 [td]no virus found AVG 386 01.10.2007 [td]no virus found BitDefender 7.2 01.11.2007 [td]no virus found CAT-QuickHeal 9.00 01.10.2007 [td]no virus found ClamAV devel-20060426 01.11.2007 [td]no virus found DrWeb 4.33 01.11.2007 [td]no virus found eSafe 7.0.14.0 01.10.2007 suspicious Trojan/Worm eTrust-InoculateIT 23.73.111 01.10.2007 [td]no virus found eTrust-Vet 30.3.3319 01.11.2007 [td]no virus found Ewido 4.0 01.10.2007 Logger.Agent.vs Fortinet 2.82.0.0 01.10.2007 [td]no virus found F-Prot 3.16f 01.10.2007 [td]no virus found F-Prot4 4.2.1.29 01.10.2007 [td]no virus found Ikarus T3.1.0.27 01.09.2007 [td]no virus found Kaspersky 4.0.2.24 01.11.2007 [td]no virus found McAfee 4936 01.10.2007 [td]no virus found Microsoft 1.1904 01.11.2007 [td]no virus found NOD32v2 1971 01.11.2007 [td]no virus found Norman 5.80.02 01.10.2007 [td]no virus found Panda 9.0.0.4 01.10.2007 Trj/Lineage.ALO Prevx1 V2 01.11.2007 [td]no virus found Sophos 4.13.0 01.11.2007 Mal/Behav-027 Sunbelt 2.2.907.0 01.05.2007 [td]no virus found TheHacker 6.0.3.147 01.11.2007 [td]no virus found UNA 1.83 01.10.2007 [td]no virus found VBA32 3.11.2 01.10.2007 [td]no virus found VirusBuster 4.3.19:9 01.10.2007 [td]no virus found Aditional Information File size: 159232 bytes MD5: b50431868e7f138b5c7ec330ac5bc34f SHA1: 0c98317cf8a8826d0e8a68f2bf4376ed8c7cff5e packers: ASPACK, UPX packers: Aspack VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.

> Go to: Home Contactar En Español www.virustotal.com :: ©Hispasec Sistemas 2004-06:: e-mail info@virustotal.com

Whitlack

Complete scanning result of "com.run", received in VirusTotal at 01.11.2007, 13:51:56 (CET). Antivirus Version Update Result AntiVir 7.3.0.21 01.09.2007 TR/Drop.Ag.943694.D Authentium 4.93.8 01.10.2007 [td]no virus found Avast 4.7.892.0 12.30.2006 [td]no virus found AVG 386 01.10.2007 [td]no virus found BitDefender 7.2 01.11.2007 [td]no virus found CAT-QuickHeal 9.00 01.10.2007 [td]no virus found ClamAV devel-20060426 01.11.2007 [td]no virus found DrWeb 4.33 01.11.2007 [td]no virus found eSafe 7.0.14.0 01.10.2007 suspicious Trojan/Worm eTrust-InoculateIT 23.73.111 01.10.2007 [td]no virus found eTrust-Vet 30.3.3319 01.11.2007 [td]no virus found Ewido 4.0 01.10.2007 Dropper.Ag.d Fortinet 2.82.0.0 01.10.2007 [td]no virus found F-Prot 3.16f 01.10.2007 [td]no virus found F-Prot4 4.2.1.29 01.10.2007 [td]no virus found Ikarus T3.1.0.27 01.09.2007 [td]no virus found Kaspersky 4.0.2.24 01.11.2007 [td]no virus found McAfee 4936 01.10.2007 [td]no virus found Microsoft 1.1904 01.11.2007 [td]no virus found NOD32v2 1971 01.11.2007 [td]no virus found Norman 5.80.02 01.10.2007 [td]no virus found Panda 9.0.0.4 01.10.2007 [td]no virus found Prevx1 V2 01.11.2007 [td]no virus found Sophos 4.13.0 01.11.2007 [td]no virus found Sunbelt 2.2.907.0 01.05.2007 [td]no virus found TheHacker 6.0.3.147 01.11.2007 [td]no virus found UNA 1.83 01.10.2007 [td]no virus found VBA32 3.11.2 01.10.2007 [td]no virus found VirusBuster 4.3.19:9 01.10.2007 [td]no virus found Aditional Information File size: 155136 bytes MD5: 62b3c0b49d2e076ef798d9600094116c SHA1: 15dfaf115d0a3fd77f196bbbf78a2a8bf4064cd6 packers: ASPACK, UPX packers: Aspack VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.

> Go to: Home Contactar En Español www.virustotal.com :: ©Hispasec Sistemas 2004-06:: e-mail info@virustotal.com