被下毒小红报了4漏6

zxjsjd

刚刚关掉防火墙小红就报毒，打开comodo之后发现阻挡了4个ftp.exe的访问互联网。发现用户的目录（C:\Documents and Settings\用户名\）下面多了个文件，见附件。包含十个exe小红报了4个6个没报，大家帮我看看剩下那6个是不是病毒。感觉太不安全了，打算重装系统。。。。。发完贴就重装。第一次被黑，兴奋中。。。


=============
小红的日志


2009-5-13 19:16 [Guard] Malware found
      Virus or unwanted program 'TR/Hijacker.Gen [trojan]'
      detected in file 'C:\Documents and Settings\th\Local 
      Settings\Temp\RarSFX0\baobi88.exe.
      Action performed: Delete file

2009-5-13 19:15 [Guard] Malware found
      Virus or unwanted program 'DR/Delphi.Gen [dropper]'
      detected in file 'C:\Documents and Settings\th\Local 
      Settings\Temp\RarSFX0\88IE.exe.
      Action performed: Delete file

2009-5-13 19:15 [Guard] Malware found
      Virus or unwanted program 'TR/Hijacker.Gen [trojan]'
      detected in file 'C:\Documents and Settings\th\Local 
      Settings\Temp\RarSFX0\288IE.exe.
      Action performed: Delete file

2009-5-13 19:15 [Guard] Malware found
      Virus or unwanted program 'ADSPY/Agent.XA [adware]'
      detected in file 'C:\Documents and Settings\th\Local 
      Settings\Temp\RarSFX0\5685.exe.
      Action performed: Delete file

[ 本帖最后由 zxjsjd 于 2009-5-13 20:00 编辑 ]

norman6810

对对附件微点杀毒高启发报了4个！

Love=卡巴+费尔

onlyboy

EAV报了4个！
有毒的是这个包：

liangxy

看这个样子就知道是sophos了

sam.to

13/5/2009 20:50:43        Detected: Trojan-Downloader.Win32.Agent.bwgl        C:\Documents and Settings\kato\桌面\2830891\2830891.exe/5.exe/data0003               
13/5/2009 20:51:01        Detected: not-a-virus:AdWare.Win32.AdMedia.ed        C:\Documents and Settings\kato\桌面\2830891\2830891.exe/msn036.exe               
13/5/2009 20:51:01        Detected: Trojan-Downloader.Win32.Small.akoq        C:\Documents and Settings\kato\桌面\2830891\2830891.exe/45.exe               
13/5/2009 20:51:01        Detected: Trojan-PSW.Win32.QQPass.hsw        C:\Documents and Settings\kato\桌面\2830891\2830891.exe/288IE.exe               
13/5/2009 20:51:02        Detected: Trojan-PSW.Win32.QQPass.hsu        C:\Documents and Settings\kato\桌面\2830891\2830891.exe/baobi88.exe/PE_Patch/UPack               


清空