RAVWM(瑞星只扫出一个,共13个)

显示全部楼层 · 发表于 2007-4-5 06:09:16

启发的已上报红伞.

显示全部楼层 · 发表于 2007-4-5 06:27:11

漏掉一个，上报antivir
运行后搞定
Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\RAVWM.rar'
C:\Documents and Settings\morgan\My Documents\
  RAVWM.rar
[0] Archive type: RAR
--> c0nime.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
--> update3.exe
      [DETECTION] Is the Trojan horse TR/Drop.OnLineGa.GS
      [WARNING] Infected files in archives cannot be repaired!
--> RAVWL.EXE
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 8FFFEB65.EXE
      [DETECTION] Is the Trojan horse TR/Dldr.Small.ejw.1
      [WARNING] Infected files in archives cannot be repaired!
--> RAVWM.EXE
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> winform.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
--> mppds.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
--> rising619.exe
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> msccrt.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ARI.104
      [WARNING] Infected files in archives cannot be repaired!
--> wsdttrs.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.MS.1
      [WARNING] Infected files in archives cannot be repaired!
--> dcoh.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
--> bar.exe
--> cmdbc.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

End of the scan: 2007年4月4日  15:27
Used time: 00:10 min

The scan has been done completely.

   0 Scanning directories
   14 Files were scanned
   12 viruses and/or unwanted programs were found
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   1 Archives were scanned
   13 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-4-5 06:31:04

File: bar.exe
Status: INFECTED/MALWARE
MD5 aa8691b70f303e1cc86f85c293b71c71
Packers detected: -

Scanner results
Scan taken on 04 Apr 2007 22:28:16 (GMT)
AntiVir Found nothing
ArcaVir Found nothing
Avast Found Win32:Adware-gen.
AVG Antivirus Found nothing
BitDefender Found Adware.Baidubar.P, Adware.Baidubar.J
ClamAV Found nothing
Dr.Web Found Adware.Baidu
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found a variant of Win32/Adware.Toolbar.Baidu application
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Rising Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing

显示全部楼层 · 发表于 2007-4-5 08:34:43

卡巴报6个
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.es 文件: F:\RAVWM.rar\update3.exe
已删除: 木马程序 Backdoor.Win32.Agent.ahj 文件: F:\RAVWM.rar\8FFFEB65.EXE/NSPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.mq 文件: F:\RAVWM.rar\winform.exe/PE_Patch/UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.ms 文件: F:\RAVWM.rar\wsdttrs.exe
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.es 文件: F:\RAVWM.rar\dcoh.exe
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.es 文件: F:\RAVWM.rar\cmdbc.exe

显示全部楼层 · 发表于 2007-4-5 09:52:46

BD11只

显示全部楼层 · 发表于 2007-4-5 09:59:06

咖啡报6个

显示全部楼层 · 发表于 2007-4-5 10:38:35

beta蜘蛛11个, .....

RAVWM.rar\update3.exe;       C:\Documents and Settings\Administrator\桌面\RAVWM.rar;          Trojan.PWS.Wsgame;;
RAVWM.rar\RAVWL.EXE;       C:\Documents and Settings\Administrator\桌面\RAVWM.rar;             UPX;;
RAVWM.rar\RAVWM.EXE;       C:\Documents and Settings\Administrator\桌面\RAVWM.rar;             Probably UPX;;
RAVWM.rar\winform.exe;       C:\Documents and Settings\Administrator\桌面\RAVWM.rar;          Trojan.PWS.Wsgame;;
RAVWM.rar\mppds.exe;          C:\Documents and Settings\Administrator\桌面\RAVWM.rar;             BINARYRES;;
RAVWM.rar\rising619.exe;       C:\Documents and Settings\Administrator\桌面\RAVWM.rar;             Trojan.PWS.Gamania.origin;;
RAVWM.rar\msccrt.exe;          C:\Documents and Settings\Administrator\桌面\RAVWM.rar;             BINARYRES;;
RAVWM.rar\wsdttrs.exe;       C:\Documents and Settings\Administrator\桌面\RAVWM.rar;             Trojan.PWS.Wsgame;;
RAVWM.rar\dcoh.exe;             C:\Documents and Settings\Administrator\桌面\RAVWM.rar;             Trojan.PWS.Gamania;;
bar.exe\data001;                   C:\Documents and Settings\Administrator\桌面\RAVWM.rar\bar.exe;    Adware.Baidu;;
bar.exe;                               C:\Documents and Settings\Administrator\桌面\RAVWM.rar;                Archive contains infected objects;;
RAVWM.rar\cmdbc.exe;          C:\Documents and Settings\Administrator\桌面\RAVWM.rar;                Trojan.PWS.Gamania;;
RAVWM.rar;                         C:\Documents and Settings\Administrator\桌面;                                  Archive contains infected objects;;

显示全部楼层 · 发表于 2007-4-5 10:45:12

杀了..

显示全部楼层 · 发表于 2007-4-5 10:46:38

NOD 32右键扫描11个：

C:\Documents and Settings\Administrator\桌面\RAVWM.rar »RAR »c0nime.exe - a variant of Win32/PSW.Agent.NDP trojan

C:\Documents and Settings\Administrator\桌面\RAVWM.rar »RAR »update3.exe - Win32/PSW.Agent.NDF trojan

C:\Documents and Settings\Administrator\桌面\RAVWM.rar »RAR »RAVWL.EXE - probably unknown NewHeur_PE virus [7]

C:\Documents and Settings\Administrator\桌面\RAVWM.rar »RAR »8FFFEB65.EXE - probably a variant of Win32/Agent.NEO trojan

C:\Documents and Settings\Administrator\桌面\RAVWM.rar »RAR »RAVWM.EXE - probably unknown NewHeur_PE virus [7]

C:\Documents and Settings\Administrator\桌面\RAVWM.rar »RAR »winform.exe - probably a variant of Win32/PSW.Agent.NCC trojan

C:\Documents and Settings\Administrator\桌面\RAVWM.rar »RAR »mppds.exe - a variant of Win32/PSW.Agent.NCC trojan

C:\Documents and Settings\Administrator\桌面\RAVWM.rar »RAR »msccrt.exe - a variant of Win32/PSW.Agent.NCC trojan

C:\Documents and Settings\Administrator\桌面\RAVWM.rar »RAR »dcoh.exe - a variant of Win32/PSW.Agent.NCC trojan

C:\Documents and Settings\Administrator\桌面\RAVWM.rar »RAR »bar.exe »NSIS »superutilbar.dll - a variant of Win32/Adware.Toolbar.Baidu application

C:\Documents and Settings\Administrator\桌面\RAVWM.rar »RAR »cmdbc.exe - a variant of Win32/PSW.Agent.NCC trojan

[病毒样本] RAVWM(瑞星只扫出一个,共13个)

本帖子中包含更多资源

评分

浏览过的版块