20个各式各样的样本

soul20010

FS7.0未解压扫描
Result: 18 malware found
Trojan-Downloader.Win32.Agent.aym (virus)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\test.part1.rar\test\test\11744550432.exe
Trojan-Downloader.Win32.Delf.bgp (virus)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\test.part1.rar\test\test\11744551237.exe
Trojan-Clicker.Win32.VB.qq (virus)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\test.part1.rar\test\test\1532CE82.exe
Backdoor.Win32.Agent.ahj (virus)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\test.part1.rar\test\test\554070D4.EXE
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\test.part1.rar\test\test\554070D4T.EXE
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\test.part1.rar\test\test\8E7663AC.exe
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\test.part3.rar\test\test\554070D4.DLL
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\test.part3.rar\test\test\5A8E28FC.DLL
AdWare.Win32.AdMoke.bx (adware)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\test.part1.rar\test\test\AEJOUZEJOTYDIN.EXE
Backdoor.Win32.Hupigon.cda (virus)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\test.part1.rar\test\test\huigezi.exe
Trojan-PSW.Win32.OnLineGames.cx (virus)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\test.part1.rar\test\test\servicea.exe
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\test.part1.rar\test\test\servicer.exe
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\test.part3.rar\test\test\servicer.exe~
AdWare.Win32.Cinmus.f (adware)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\test.part1.rar\test\test\svohose.exe
AdWare.Win32.Agent.bt (adware)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\test.part3.rar\test\test\USRINIT.DLL
Trojan-Downloader.Win32.Agent.bcd (virus)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\test.part3.rar\test\test\HIDPROC.SYS
AdWare.Win32.Agent.bs (adware)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\test.part3.rar\test\test\REALSHED.DRV
Trojan-PSW.Win32.Delf.qc (virus)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\test.part3.rar\test\test\~tmp.tmp

jlennon

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-3-25
Start time: 2007-3-26 12:59
Engine(s): KAV engine (AVK 17.3527), BD-Engine (BD 17.2421)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: 11744550432.exe
        Path: C:\Documents and Settings\Administrator\桌面\test[1]\test\test
        Status: Move file into quarantine
        Virus: Trojan-Downloader.Win32.Agent.aym (KAV engine), Trojan.Downloader.Small.AGJ (BD-Engine)
Object: 11744551237.exe
        Path: C:\Documents and Settings\Administrator\桌面\test[1]\test\test
        Status: Move file into quarantine
        Virus: Trojan-Downloader.Win32.Delf.bgp (KAV engine), Adware.Baidu.F (BD-Engine)
Object: 1532CE82.exe
        Path: C:\Documents and Settings\Administrator\桌面\test[1]\test\test
        Status: Move file into quarantine
        Virus: Trojan-Clicker.Win32.VB.qq (KAV engine)
Object: 554070D4.DLL
        Path: C:\Documents and Settings\Administrator\桌面\test[1]\test\test
        Status: Move file into quarantine
        Virus: Backdoor.Win32.Agent.ahj (KAV engine)
Object: 554070D4.EXE
        Path: C:\Documents and Settings\Administrator\桌面\test[1]\test\test
        Status: Move file into quarantine
        Virus: Backdoor.Win32.Agent.ahj (KAV engine)
Object: 554070D4T.EXE
        Path: C:\Documents and Settings\Administrator\桌面\test[1]\test\test
        Status: Move file into quarantine
        Virus: Backdoor.Win32.Agent.ahj (KAV engine)
Object: 5A8E28FC.DLL
        Path: C:\Documents and Settings\Administrator\桌面\test[1]\test\test
        Status: Move file into quarantine
        Virus: Backdoor.Win32.Agent.ahj (KAV engine), Trojan.Clicker.VB.JK (BD-Engine)
Object: 8E7663AC.exe
        Path: C:\Documents and Settings\Administrator\桌面\test[1]\test\test
        Status: Move file into quarantine
        Virus: Backdoor.Win32.Agent.ahj (KAV engine), Trojan.Clicker.VB.JK (BD-Engine)
Object: AEJOUZEJOTYDIN.EXE
        Path: C:\Documents and Settings\Administrator\桌面\test[1]\test\test
        Status: Move file into quarantine
        Virus: not-a-virus:AdWare.Win32.AdMoke.bx (KAV engine)
Object: bomb.exe
        Path: C:\Documents and Settings\Administrator\桌面\test[1]\test\test
        Status: Move file into quarantine
        Virus: Trojan.Dloader.YG (BD-Engine)
Object: HIDPROC.SYS
        Path: C:\Documents and Settings\Administrator\桌面\test[1]\test\test
        Status: Move file into quarantine
        Virus: Trojan-Downloader.Win32.Agent.bcd (KAV engine), Trojan.Downloader.Agent.XZF (BD-Engine)
Object: data0000.cab Server_Setup.exe
        In archive: C:\Documents and Settings\Administrator\桌面\test[1]\test\test\huigezi.exe
        Status: Virus detected
        Virus: Backdoor.Win32.Hupigon.cda (KAV engine)
Object: (CAB Sfx r) Server_Setup.exe
        In archive: C:\Documents and Settings\Administrator\桌面\test[1]\test\test\huigezi.exe
        Status: Virus detected
        Virus: Backdoor.Pigeon.KG (BD-Engine)
Object: huigezi.exe
        Path: C:\Documents and Settings\Administrator\桌面\test[1]\test\test
        Status: Move file into quarantine
        Virus: Backdoor.Win32.Hupigon.cda (KAV engine), Backdoor.Pigeon.KG (BD-Engine)
Object: REALSHED.DRV
        Path: C:\Documents and Settings\Administrator\桌面\test[1]\test\test
        Status: Move file into quarantine
        Virus: not-a-virus:AdWare.Win32.Agent.bs (KAV engine)
Object: servicea.exe
        Path: C:\Documents and Settings\Administrator\桌面\test[1]\test\test
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.cx (KAV engine), Trojan.NSAnti.B (BD-Engine)
Object: servicer.exe
        Path: C:\Documents and Settings\Administrator\桌面\test[1]\test\test
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.cx (KAV engine), Trojan.NSAnti.B (BD-Engine)
Object: servicer.exe~
        Path: C:\Documents and Settings\Administrator\桌面\test[1]\test\test
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.cx (KAV engine), Trojan.NSAnti.B (BD-Engine)
Object: data0003 data0003
        In archive: C:\Documents and Settings\Administrator\桌面\test[1]\test\test\svohose.exe
        Status: Virus detected
        Virus: not-a-virus:AdWare.Win32.Cinmus.f (KAV engine)
Object: data0003 data0004
        In archive: C:\Documents and Settings\Administrator\桌面\test[1]\test\test\svohose.exe
        Status: Virus detected
        Virus: not-a-virus:AdWare.Win32.Cinmus.f (KAV engine)
Object: svohose.exe
        Path: C:\Documents and Settings\Administrator\桌面\test[1]\test\test
        Status: Move file into quarantine
        Virus: not-a-virus:AdWare.Win32.Cinmus.f (2x) (KAV engine), Adware.Cinmus.F (BD-Engine)
Object: USRINIT.DLL
        Path: C:\Documents and Settings\Administrator\桌面\test[1]\test\test
        Status: Move file into quarantine
        Virus: not-a-virus:AdWare.Win32.Agent.bt (KAV engine)
Object: ~tmp.tmp
        Path: C:\Documents and Settings\Administrator\桌面\test[1]\test\test
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.Delf.qc (KAV engine), Generic.PWStealer.BCA8DCE6 (BD-Engine)
Object: Stream data0002
        In archive: C:\Documents and Settings\Administrator\桌面\test[1]\test\test\雷之源.exe
        Status: Virus detected
        Virus: Trojan-Downloader.Win32.Agent.arm (KAV engine)
Object: Stream data0012
        In archive: C:\Documents and Settings\Administrator\桌面\test[1]\test\test\雷之源.exe
        Status: Virus detected
        Virus: not-a-virus:AdWare.Win32.Dm.ab (KAV engine)
Object: Stream/data0017/stream/data0001 data0003
        In archive: C:\Documents and Settings\Administrator\桌面\test[1]\test\test\雷之源.exe
        Status: Virus detected
        Virus: Trojan.Win32.Qhost.ir (KAV engine)
Object: Stream/data0017/stream/data0001 data0004
        In archive: C:\Documents and Settings\Administrator\桌面\test[1]\test\test\雷之源.exe
        Status: Virus detected
        Virus: Trojan.VBS.RotNet.a (KAV engine)
Object: Stream/data0017/stream/data0001 data0005
        In archive: C:\Documents and Settings\Administrator\桌面\test[1]\test\test\雷之源.exe
        Status: Virus detected
        Virus: not-a-virus:AdWare.Win32.AdMedia.k (KAV engine)
Object: 雷之源.exe
        Path: C:\Documents and Settings\Administrator\桌面\test[1]\test\test
        Status: Move file into quarantine
        Virus: Trojan-Downloader.Win32.Agent.arm, not-a-virus:AdWare.Win32.Dm.ab, Trojan.Win32.Qhost.ir, Trojan.VBS.RotNet.a, not-a-virus:AdWare.Win32.AdMedia.k (KAV engine)
Analysis complete: 2007-3-26 13:00
    20 files checked
    20 infected files detected
    0 suspected files detected

gggh

KIS 杀72个....

bridgewr

解压缩后剩了9个，其中2个dll，其他几个有的运行就退出，其他微点杀

bridgewr

微点报已知的图就不帖了

zxw_8589

高人好多啊

huanxu

以后mofunzone的帖子EQ2不准回，EQ2的帖子mofunzone不准回，

看你们的帖子累啊，越来越看不懂了，NND

aoyang

楼上的,他们无非就是为了证明NOD比红伞强,或者红伞比NOD强
不管他们谁赢了,NOD和红伞我都米有兴趣,也绝对木有兴趣

huanxu

他们不过争论红伞是否报壳的问题

金剑

风暴胜者V2 测试版本(http://www.v0day.com)
_________您的安全是我们的责任_______________
载入病毒库…进行整理…分配内存…可以使用



===============================================
   ___________病毒查杀结果__________________


===============================================

2007年3月26日16时51分42秒 开始查杀C:\Documents and Settings\Administrator\桌面\新建文件夹\test[1]
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\test[1]\test\test\11744550432.exe
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\test[1]\test\test\11744551237.exe
C:\Documents and Settings\Administrator\桌面\新建文件夹\test[1]\test\test\11744551237.exe 发现未知可疑文件:Win32.NkHack.Preloc.A 操作:阻止运行
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\test[1]\test\test\1532CE82.exe
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\test[1]\test\test\554070D4.EXE
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\test[1]\test\test\554070D4T.EXE
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\test[1]\test\test\8E7663AC.exe
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\test[1]\test\test\AEJOUZEJOTYDIN.EXE
C:\Documents and Settings\Administrator\桌面\新建文件夹\test[1]\test\test\AEJOUZEJOTYDIN.EXE 发现未知可疑文件:Win32.NkHack.Preloc.A 操作:阻止运行
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\test[1]\test\test\bomb.exe
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\test[1]\test\test\huigezi.exe
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\test[1]\test\test\servicea.exe
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\test[1]\test\test\servicer.exe
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\test[1]\test\test\svohose.exe
C:\Documents and Settings\Administrator\桌面\新建文件夹\test[1]\test\test\雷之源.exe 发现未知可疑文件:Win32.NkHack.Preloc.A 操作:阻止运行
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\test[1]\test\test\servicer.exe~
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\test[1]\test\test\554070D4.DLL
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\test[1]\test\test\5A8E28FC.DLL
=========================================

_________文件性质分析结果________________
"带壳"仅指文件性质,仅供专业人员分析使用。


C:\Documents and Settings\Administrator\桌面\新建文件夹\test[1]\test\test\bomb.exe 带壳文件:Aspack加壳
-----------------------------------------

2007年3月26日16时51分52秒收起线程…100% 查杀完毕！
扫描文件：25查杀病毒：18