转sebo的jasonhe的样本，一共19个

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\绅博GDATA AntiVirenKit（中国）论坛_New Folder.rar'
C:\Documents and Settings\Administrator\My Documents\
  绅博GDATA AntiVirenKit（中国）论坛_New Folder.rar
    [0] Archive type: RAR
    --> New Folder\0[1].exe
        [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> New Folder\url[1].htm
        [DETECTION] Contains signature of the construction kit KIT/MultiHtExp.2
        [WARNING]   Infected files in archives cannot be repaired!
    --> New Folder\theopen.exe
        [DETECTION] Is the Trojan horse TR/Qhost.IB.6
        [WARNING]   Infected files in archives cannot be repaired!
    --> New Folder\cj.exe
        [DETECTION] Contains signature of the dropper DR/Delphi.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> New Folder\boy[1].jpg
        [DETECTION] Contains suspicious code HEUR/Crypted
        [WARNING]   Infected files in archives cannot be repaired!
    --> New Folder\101.exe
        [DETECTION] Is the Trojan horse TR/Drop.BHO.F.3
        [WARNING]   Infected files in archives cannot be repaired!
    --> New Folder\6262561[1].htm
        [DETECTION] Contains signature of the Java script virus JS/Dldr.IstBar.N
        [WARNING]   Infected files in archives cannot be repaired!
    --> New Folder\58hu03[1].htm
        [DETECTION] Contains signature of the Java script virus JS/Dldr.IstBar.N
        [WARNING]   Infected files in archives cannot be repaired!
    --> New Folder\168[1].htm
        [DETECTION] Contains signature of the Java script virus JS/Dldr.IstBar.N
        [WARNING]   Infected files in archives cannot be repaired!
    --> New Folder\0201[1].htm
        [DETECTION] Contains signature of the Java script virus JS/Dldr.Agent.CN.3
        [WARNING]   Infected files in archives cannot be repaired!
    --> New Folder\921[1].htm
        [DETECTION] Contains signature of the Java script virus JS/Dldr.IstBar.N
        [WARNING]   Infected files in archives cannot be repaired!
    --> New Folder\yikuo[1].htm
        [DETECTION] Contains signature of the Java script virus JS/Dldr.IstBar.N
        [WARNING]   Infected files in archives cannot be repaired!
    --> New Folder\fpjyw1[1].htm
        [DETECTION] Contains signature of the Java script virus JS/Dldr.IstBar.N
        [WARNING]   Infected files in archives cannot be repaired!
    --> New Folder\0013exe[1].htm
        [DETECTION] Contains signature of the HTML script virus HTML/Dldr.Psyme.ER
        [WARNING]   Infected files in archives cannot be repaired!
    --> New Folder\downloader.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> New Folder\in[1].htm
        [DETECTION] Is the Trojan horse TR/Dldr.Psyme.SA
        [WARNING]   Infected files in archives cannot be repaired!
    --> New Folder\3dbb7a3c84e5dfc9.exe
        [DETECTION] Is the Trojan horse TR/Popwin.AB
        [WARNING]   Infected files in archives cannot be repaired!
    --> New Folder\svchost.exe
        [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/NSPack). Please verify the origin of the file
        [WARNING]   Infected files in archives cannot be repaired!
    --> New Folder\h1.bmp
        [DETECTION] Contains suspicious code HEUR/Crypted
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!

yinxuchina

费尔

jlennon

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-3-3
Start time: 2007-3-5 5:36
Engine(s): KAV engine (AVK 17.3071), BD-Engine (BD 17.2253)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: New Folder theopen.exe
        In archive: C:\Documents and Settings\Administrator\桌面\New Folder[1].part3.rar
        Status: Virus detected
        Virus: Trojan.Win32.Qhost.ib (KAV engine)
Object: New Folder yikuo[1].htm
        In archive: C:\Documents and Settings\Administrator\桌面\New Folder[1].part3.rar
        Status: Virus detected
        Virus: Trojan-Downloader.JS.IstBar.ai (KAV engine)
Object: New Folder[1].part3.rar
        Path: C:\Documents and Settings\Administrator\桌面
        Status: Move file into quarantine
        Virus: Trojan.Win32.Qhost.ib, Trojan-Downloader.JS.IstBar.ai (KAV engine)
Object: New Folder 0013exe[1].htm
        In archive: C:\Documents and Settings\Administrator\桌面\New Folder[1].part1.rar
        Status: Virus detected
        Virus: Trojan-Downloader.VBS.Psyme.er (KAV engine)
Object: New Folder 0[1].exe
        In archive: C:\Documents and Settings\Administrator\桌面\New Folder[1].part1.rar
        Status: Virus detected
        Virus: Worm.Win32.Viking.ie (KAV engine)
Object: New Folder 168[1].htm
        In archive: C:\Documents and Settings\Administrator\桌面\New Folder[1].part1.rar
        Status: Virus detected
        Virus: Trojan-Downloader.JS.IstBar.ai (KAV engine)
Object: New Folder 58hu03[1].htm
        In archive: C:\Documents and Settings\Administrator\桌面\New Folder[1].part1.rar
        Status: Virus detected
        Virus: Trojan-Downloader.JS.IstBar.ai (KAV engine)
Object: New Folder 6262561[1].htm
        In archive: C:\Documents and Settings\Administrator\桌面\New Folder[1].part1.rar
        Status: Virus detected
        Virus: Trojan-Downloader.JS.IstBar.ai (KAV engine)
Object: New Folder 921[1].htm
        In archive: C:\Documents and Settings\Administrator\桌面\New Folder[1].part1.rar
        Status: Virus detected
        Virus: Trojan-Downloader.JS.IstBar.ai (KAV engine)
Object: New Folder fpjyw1[1].htm
        In archive: C:\Documents and Settings\Administrator\桌面\New Folder[1].part1.rar
        Status: Virus detected
        Virus: Trojan-Downloader.JS.IstBar.ai (KAV engine)
Object: New Folder\0013exe[1].htm
        In archive: C:\Documents and Settings\Administrator\桌面\New Folder[1].part1.rar
        Status: Virus detected
        Virus: Generic.XPL.ADODB.5E127193 (BD-Engine)
Object: New Folder\0201[1].htm (VBSCRIPT   1)
        In archive: C:\Documents and Settings\Administrator\桌面\New Folder[1].part1.rar
        Status: Virus detected
        Virus: Exploit.ADODB.Stream.DB (BD-Engine)
Object: New Folder\101.exe
        In archive: C:\Documents and Settings\Administrator\桌面\New Folder[1].part1.rar
        Status: Virus detected
        Virus: Trojan.Clicker.BHO.F (BD-Engine)
Object: New Folder\168[1].htm
        In archive: C:\Documents and Settings\Administrator\桌面\New Folder[1].part1.rar
        Status: Virus detected
        Virus: Trojan.Downloader.JS.Istbar.B (BD-Engine)
Object: New Folder\3dbb7a3c84e5dfc9.exe
        In archive: C:\Documents and Settings\Administrator\桌面\New Folder[1].part1.rar
        Status: Virus detected
        Virus: MemScan:Trojan.Popwin.AB (BD-Engine)
Object: New Folder\58hu03[1].htm
        In archive: C:\Documents and Settings\Administrator\桌面\New Folder[1].part1.rar
        Status: Virus detected
        Virus: Trojan.Downloader.JS.Istbar.B (BD-Engine)
Object: New Folder\6262561[1].htm
        In archive: C:\Documents and Settings\Administrator\桌面\New Folder[1].part1.rar
        Status: Virus detected
        Virus: Trojan.Downloader.JS.Istbar.B (BD-Engine)
Object: New Folder\921[1].htm
        In archive: C:\Documents and Settings\Administrator\桌面\New Folder[1].part1.rar
        Status: Virus detected
        Virus: Trojan.Downloader.JS.Istbar.B (BD-Engine)
Object: New Folder\boy[1].jpg
        In archive: C:\Documents and Settings\Administrator\桌面\New Folder[1].part1.rar
        Status: Virus detected
        Virus: Trojan.Downloader.Agent.ABZ (BD-Engine)
Object: New Folder\cj.exe
        In archive: C:\Documents and Settings\Administrator\桌面\New Folder[1].part1.rar
        Status: Virus detected
        Virus: Generic.PWStealer.CAADF28E (BD-Engine)
Object: New Folder\downloader.exe
        In archive: C:\Documents and Settings\Administrator\桌面\New Folder[1].part1.rar
        Status: Virus detected
        Virus: GenPack:Trojan.Downloader.ACP (BD-Engine)
Object: New Folder\fpjyw1[1].htm
        In archive: C:\Documents and Settings\Administrator\桌面\New Folder[1].part1.rar
        Status: Virus detected
        Virus: Trojan.Downloader.JS.Istbar.B (BD-Engine)
Object: New Folder\h1.bmp
        In archive: C:\Documents and Settings\Administrator\桌面\New Folder[1].part1.rar
        Status: Virus detected
        Virus: Trojan.Downloader.Agent.ABZ (BD-Engine)
Object: New Folder[1].part1.rar
        Path: C:\Documents and Settings\Administrator\桌面
        Status: Move file into quarantine
        Virus: Trojan-Downloader.VBS.Psyme.er, Worm.Win32.Viking.ie, Trojan-Downloader.JS.IstBar.ai (5x) (KAV engine), Generic.XPL.ADODB.5E127193, Exploit.ADODB.Stream.DB, Trojan.Clicker.BHO.F, Trojan.Downloader.JS.Istbar.B (5x), MemScan:Trojan.Popwin.AB, Trojan.Downloader.Agent.ABZ (2x), Generic.PWStealer.CAADF28E, GenPack:Trojan.Downloader.ACP (BD-Engine)
Analysis complete: 2007-3-5 5:36
    3 files checked
    2 infected files detected
    0 suspected files detected

kp2006

kv报7个

gggh

kis307---10个，18个，
红伞 19个
费尔 13个
DR。WEB 5个
AVAST  6个

bridgewr

除了一个不能在win32下运行的exe，以及htm文件，其他的可执行程序都没跑掉

鼻耳盖子

bridgewr