红伞似乎真的报的壳

龙井茶

RT,而微点报得不一样
Begin scan in 'C:\Documents and Settings\Administrator\桌面\[病毒]_新的威金变种.rar'
C:\Documents and Settings\Administrator\桌面\[病毒]_新的威金变种.rar
  [0] Archive type: RAR
  --> mhs3.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> mss3.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> mys3.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> jts3.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> Logo1_.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [INFO]      A backup was created as 'b1cb7c20.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!

微点的
木马名称:Trojan-PSW.Win32.OnLineGames.ajf
程序:
C:\DOCUMENTS AND SETTINGS\LAIDAQUN\桌面\[病毒]_新的威金变种\MYS3.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?


木马名称:Trojan-PSW.Win32.OnLineGames.aka
程序:
C:\DOCUMENTS AND SETTINGS\LAIDAQUN\桌面\[病毒]_新的威金变种\MSS3.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.OnLineGames.aja
程序:
C:\DOCUMENTS AND SETTINGS\LAIDAQUN\桌面\[病毒]_新的威金变种\MHS3.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

蠕虫名称:Worm.Win32.Viking.ozu
程序:
C:\DOCUMENTS AND SETTINGS\LAIDAQUN\桌面\[病毒]_新的威金变种\LOGO1_.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.OnLineGames.adw
程序:
C:\DOCUMENTS AND SETTINGS\LAIDAQUN\桌面\[病毒]_新的威金变种\JTS3.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

The EQs

正在等virusbuster的邮件。。。。

qq890

卡巴报。。

The EQs

Scan performed at: 2007-3-15 16:48:15
Scanning Log
NOD32 version 2116 (20070314) NT
Command line: C:\Documents and Settings\EQ2\桌面\病毒变种.rar
Operating memory - is OK

Date: 15.3.2007  Time: 16:48:24
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\病毒变种.rar
C:\Documents and Settings\EQ2\桌面\病毒变种.rar ?RAR ?mhs3.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\病毒变种.rar ?RAR ?mss3.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\病毒变种.rar ?RAR ?mys3.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\病毒变种.rar ?RAR ?jts3.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\病毒变种.rar ?RAR ?Logo1_.exe - Win32/Viking.CH virus - was a part of the deleted object
Number of scanned files: 6
Number of threats found: 5
Number of files cleaned: 1
Time of completion: 16:48:24 Total scanning time: 0 sec (00:00:00)

Notes:
[7] File is probably infected with an unknown virus.

The EQs

virusbuster也是经常报Pack/NSPM。。。。很明显NSPM是报壳的意思。。。。刚刚发邮件给了vb。。看看他们怎么说。。

jlennon

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-3-14
Start time: 2007-3-15 16:53
Engine(s): KAV engine (AVK 17.3277), BD-Engine (BD 17.2421)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: mhs3.exe
        In archive: C:\Documents and Settings\Administrator\桌面\病毒变种.rar
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.jc (KAV engine), GenPack:Trojan.PWS.QQPass.UL (BD-Engine)
Object: mss3.exe
        In archive: C:\Documents and Settings\Administrator\桌面\病毒变种.rar
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.jc (KAV engine), GenPack:Trojan.PWS.QQPass.UL (BD-Engine)
Object: mys3.exe
        In archive: C:\Documents and Settings\Administrator\桌面\病毒变种.rar
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.jc (KAV engine), GenPack:Trojan.PWS.QQPass.UL (BD-Engine)
Object: jts3.exe
        In archive: C:\Documents and Settings\Administrator\桌面\病毒变种.rar
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.ij (KAV engine), GenPack:Trojan.PWS.QQPass.UL (BD-Engine)
Object: Logo1_.exe
        In archive: C:\Documents and Settings\Administrator\桌面\病毒变种.rar
        Status: Virus detected
        Virus: Worm.Win32.Viking.ha (KAV engine), Win32.Worm.Viking.JT (BD-Engine)
Object: 病毒变种.rar
        Path: C:\Documents and Settings\Administrator\桌面
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.jc (3x), Trojan-PSW.Win32.OnLineGames.ij, Worm.Win32.Viking.ha (KAV engine), GenPack:Trojan.PWS.QQPass.UL (4x), Win32.Worm.Viking.JT (BD-Engine)
Analysis complete: 2007-3-15 16:53
    1 files checked
    1 infected files detected
    0 suspected files detected

龙井茶

红伞似乎没杀到威金那个新变种.

allenhippo

yitp

只是壳吗？

kp2006

看来红伞不行 准确率太低了

不一样的东西报一样

金山报

信息        2007-03-15 17:13:20        您此次查毒清除了5个病毒                        
信息        2007-03-15 17:13:20        您此次查毒共查出5个病毒以及危险代码                        
信息        2007-03-15 17:13:20        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件6个                        
信息        2007-03-15 17:13:20        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                        
病毒        2007-03-15 17:13:20        D:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.A776BFE9E46E454\桌面\病毒变种.RAR\Logo1_.exe        Worm.Viking.gm.62702        清除成功        
病毒        2007-03-15 17:13:20        D:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.A776BFE9E46E454\桌面\病毒变种.RAR\jts3.exe        Win32.Hack.NsAnti.ca.43611        清除成功        
病毒        2007-03-15 17:13:19        D:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.A776BFE9E46E454\桌面\病毒变种.RAR\mys3.exe        Win32.Hack.NsAnti.ca.43611        清除成功        
病毒        2007-03-15 17:13:19        D:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.A776BFE9E46E454\桌面\病毒变种.RAR\mss3.exe        Win32.Hack.NsAnti.ca.43611        清除成功        
病毒        2007-03-15 17:13:19        D:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.A776BFE9E46E454\桌面\病毒变种.RAR\mhs3.exe        Win32.Hack.NsAnti.ca.43611        清除成功        
信息        2007-03-15 17:12:51        金山毒霸主程序启动查毒过程，查毒方式：命令行查毒                        
信息        2007-03-15 17:12:50        金山毒霸主程序 启动

[ 本帖最后由 kp2006 于 2007-3-15 17:18 编辑 ]