病毒包，68个

solcroft

你的杀软杀几个？

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\68 Live Viruses'
C:\Documents and Settings\Administrator\My Documents\68 Live Viruses\
  001.exe
      [DETECTION] Contains signature of the Stasi virus
      [INFO]      The file was deleted!
  Bagle.AT.exe
      [DETECTION] Contains signature of the worm WORM/Bagle.AT.1
      [INFO]      The file was deleted!
  BugBear.EXE
      [DETECTION] Contains signature of the worm WORM/BugBear.1
      [INFO]      The file was deleted!
  down.com
      [DETECTION] Contains signature of the Windows virus W32/HLLW.Raleka
      [INFO]      The file was deleted!
  DSSSIG.EXE
      [DETECTION] Contains code of the Windows virus W32/Parite
      [INFO]      The file was deleted!
  EDIT.com
      [DETECTION] Contains signature of the Flu virus
      [INFO]      The file was deleted!
  Email-Worm.Win32.Bagle.a.exe
      [DETECTION] Contains signature of the worm WORM/Bagle.A
      [INFO]      The file was deleted!
  Email-Worm.Win32.Bagle.b.exe
      [DETECTION] Contains signature of the worm WORM/Bagle.B
      [INFO]      The file was deleted!
  Email-Worm.Win32.NetSky.f.exe
      [DETECTION] Contains signature of the worm WORM/NetSky.F
      [INFO]      The file was deleted!
  Email-Worm.Win32.NetSky.s.exe
      [DETECTION] Contains signature of the worm WORM/NetSky.S.1
      [INFO]      The file was deleted!
  Email-Worm.Win32.NetSky.y.exe
      [DETECTION] Contains signature of the worm WORM/Netsky.X
      [INFO]      The file was deleted!
  Email-Worm.Win32.Sober.b.exe
      [DETECTION] Contains signature of the worm WORM/Sober.B2
      [INFO]      The file was deleted!
  hppwp2wsupt.exe
  I-Worm.Mydoom.a.scr
      [DETECTION] Contains signature of the worm WORM/Mydoom.A.3
      [INFO]      The file was deleted!
  I-Worm.MydoomF.exe
      [DETECTION] Contains signature of the worm WORM/Mydoom.F
      [INFO]      The file was deleted!
  I-Worm.NetSky.k.exe
      [DETECTION] Contains signature of the worm WORM/Netsky.J
      [INFO]      The file was deleted!
  I-Worm.NetSky.t.exe
      [DETECTION] Contains signature of the worm WORM/NetSky.#1
      [INFO]      The file was deleted!
  I-Worm.NetSky.x.exe
      [DETECTION] Contains signature of the worm WORM/Netsky.W.2
      [INFO]      The file was deleted!
  I-Worm.NetSky.Z.exe
      [DETECTION] Contains signature of the worm WORM/NetSky.Z
      [INFO]      The file was deleted!
  I-Worm.NetSkyC.exe
      [DETECTION] Contains signature of the worm WORM/NetSky.C
      [INFO]      The file was deleted!
  I-Worm.NetSkyQ.pr.exe
      [DETECTION] Contains signature of the worm WORM/NetSky.Q
      [INFO]      The file was deleted!
  I-Worm.Rayman.exe
      [DETECTION] Contains signature of the worm WORM/Rayman
      [INFO]      The file was deleted!
  I-Worm.Sober.d.exe
      [DETECTION] Contains signature of the worm WORM/Sober.D
      [INFO]      The file was deleted!
  I-Worm.Sober.e.exe
      [DETECTION] Contains signature of the worm WORM/Sober.E
      [INFO]      The file was deleted!
  I-Worm.Sober.f.exe
      [DETECTION] Contains signature of the worm WORM/Sober.F
      [INFO]      The file was deleted!
  I-Worm.Sober.g.exe
      [DETECTION] Contains signature of the worm WORM/Sober.G
      [INFO]      The file was deleted!
  I-Worm.Sober.i.exe
      [DETECTION] Contains signature of the worm WORM/Sober.I
      [INFO]      The file was deleted!
  I-Worm.Tanatos.b.scr
      [DETECTION] Contains signature of the worm WORM/Bugbear.B
      [INFO]      The file was deleted!
  inetdl[1].exe
      [DETECTION] Is the Trojan horse TR/Delf.FF
      [INFO]      The file was deleted!
  msblast.exe
      [DETECTION] Contains signature of the worm WORM/Lovsan.A
      [INFO]      The file was deleted!
  mslaugh.exe
      [DETECTION] Contains signature of the worm WORM/Lovsan.E
      [INFO]      The file was deleted!
  Net-Worm.Win32.Sasser.a.exe
      [DETECTION] Contains signature of the worm WORM/Sasser.A.14
      [INFO]      The file was deleted!
  Net-Worm.Win32.Welchia.a.exe
      [DETECTION] Contains signature of the worm WORM/Nachi.A.1
      [INFO]      The file was deleted!
  Net-Worm.Win32.Welchia.e.exe
      [DETECTION] Contains signature of the worm WORM/Welchia.E
      [INFO]      The file was deleted!
  Net-Worm.Win32.Welchia.g.exe
      [DETECTION] Contains signature of the worm WORM/Nachi.G
      [INFO]      The file was deleted!
  Net-Worm.Win32.Welchia.h.exe
      [DETECTION] Contains signature of the worm WORM/Welchia.H
      [INFO]      The file was deleted!
  Net-Worm.Win32.Welchia.l.exe
      [DETECTION] Contains signature of the worm WORM/Welchia.L
      [INFO]      The file was deleted!
  NetSky.E.exe
      [DETECTION] Contains signature of the worm WORM/Netsky.E
      [INFO]      The file was deleted!
  prompt[1].html
      [DETECTION] Contains signature of the Java script virus JS/Dldr.IstBar.J
      [INFO]      The file was deleted!
  Sober.A.exe
      [DETECTION] Contains signature of the worm WORM/Sober
      [INFO]      The file was deleted!
  Sober.C.exe
      [DETECTION] Contains signature of the worm WORM/Sober.C1
      [INFO]      The file was deleted!
  svchost.exe
  svchost32.exe
      [DETECTION] Contains signature of the worm WORM/Raleka.E.2
      [INFO]      The file was deleted!
  teekids.exe
      [DETECTION] Contains signature of the worm WORM/Lovsan.B
      [INFO]      The file was deleted!
  TFTP1028.exe
      [DETECTION] Contains signature of the worm WORM/SdBot.JT
      [INFO]      The file was deleted!
  TFTP1404.exe
      [DETECTION] Contains signature of the worm WORM/Rbot.DN
      [INFO]      The file was deleted!
  u070104.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Small.XK.2
      [INFO]      The file was deleted!
  VirusPro.exe
      [DETECTION] Contains signature of the worm WORM/Collo.C
      [INFO]      The file was deleted!
  w32-Apology-B.exe
      [DETECTION] Contains code of the Windows virus W95/Mtx.A
      [INFO]      The file was deleted!
  w32-badtrans-A.exe
      [DETECTION] Contains signature of the worm WORM/Badtrans.A.1
      [INFO]      The file was deleted!
  W32-Badtrans-B.exe
      [DETECTION] Contains signature of the worm WORM/BadTrans.B1
      [INFO]      The file was deleted!
  W32-Dumaru-A.exe
      [DETECTION] Contains signature of the worm WORM/Dumaru.A
      [INFO]      The file was deleted!
  w32-hybris-B.exe
      [DETECTION] Contains signature of the Windows virus W95/Hybris.PI.002
      [INFO]      The file was deleted!
  w32-hybris-C.exe
      [DETECTION] Contains signature of the Windows virus W95/Hybris.Gen.3
      [INFO]      The file was deleted!
  w32-Klez-H.exe
      [DETECTION] Contains signature of the worm WORM/Klez.E
      [INFO]      The file was deleted!
  w32-Magistr-A.exe
      [DETECTION] Contains code of the Windows virus W32/Magistr.B
      [INFO]      The file was deleted!
  W32-Mimail-M.exe
      [DETECTION] Contains signature of the worm WORM/MiMail.M1
      [INFO]      The file was deleted!
  w32-Sircam-A.exe
      [DETECTION] Contains signature of the worm WORM/W32.Sircam.C
      [INFO]      The file was deleted!
  W32-Sobig-B.exe
      [DETECTION] Contains signature of the worm WORM/Sobig.B
      [INFO]      The file was deleted!
  w32-Sobig-C.exe
      [DETECTION] Contains signature of the worm WORM/Sobig.C
      [INFO]      The file was deleted!
  w32-Sobig-E.exe
      [DETECTION] Contains signature of the worm WORM/Sobig.E
      [INFO]      The file was deleted!
  w32-Sobig-F.exe
      [DETECTION] Contains signature of the worm WORM/Sobig.F
      [INFO]      The file was deleted!
  w32-Yaha-E.exe
      [DETECTION] Contains signature of the Windows virus W32/Yaha.E
      [INFO]      The file was deleted!
  WinadX.dll
      [DETECTION] Is the Trojan horse TR/Winad.A
      [INFO]      The file was deleted!
  winhlpp32.exe
      [DETECTION] Contains signature of the worm WORM/Agobot.136218
      [INFO]      The file was deleted!
  Worm.NetSkyP.exe
      [DETECTION] Contains signature of the worm WORM/NetSky.AP
      [INFO]      The file was deleted!
  Worm.Win32.SasserB.exe
      [DETECTION] Contains signature of the worm WORM/Sasser.A.14
      [INFO]      The file was deleted!
  Worm.Win32.SasserD.exe
      [DETECTION] Contains signature of the worm WORM/Sasser.D
      [INFO]      The file was deleted!


End of the scan: 2007年2月18日  11:58
Used time: 00:29 min

The scan has been done completely.

      1 Scanning directories
     68 Files were scanned
     66 viruses and/or unwanted programs were found
     66 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      0 Archives were scanned
      0 Warnings
      0 Notes

mofunzone

hppwp2wsupt.exe和svchost.exe运行了都没什么问题
svchost甚至还有ms的版本信息
hppwp2wsupt怀疑是hp的东西
Thank you for your submission. Below you can see the current status of the uploaded files.



We received the following archive files:File ID         Filename         Size (Byte)        Result
207761         Viruses.rar        24.503        OK


A listing of files contained inside archives alongside their results can be found below:File ID         Filename         Size (Byte)        Result
63451         svchost.exe         7.952         KNOWN CLEAN
207762         hppwp2wsupt.exe         45.056         UNDER ANALYSIS



Please find a detailed report concerning each individual sample below: Filename        Result
svchost.exe         KNOWN CLEAN


The file 'svchost.exe' has been determined to be 'KNOWN CLEAN'. In particular this means that we could not find any malicious content. Please note that the file is part of 'Windows 2000 (SP0)'.
Filename        Result
hppwp2wsupt.exe         UNDER ANALYSIS


The file 'hppwp2wsupt.exe' has been determined to be 'UNDER ANALYSIS'.

Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.

mofunzone

svchost直接给出win2000的正常文件
hppwp2wsupt看了一下好像是HP LaserJet 1220的什么东西

solcroft

嗯，的确有几个正常文件。
卡巴杀63个，经过Sunbelt沙盘鉴定后漏杀两个Sdbot变种（已上报），其余的好像没毒...

kp2006

金山61
v3 59

jlennon

芬杀客58

yinxuchina

费尔63个 支持

663219623

驱逐舰报毒

马力

驱逐舰63个