RAVWM(瑞星只扫出一个,共13个)

显示全部楼层 · 发表于 2007-4-12 16:34:14

已经删除: 木马程序 Trojan-PSW.Win32.OnLineGames.es 文件: C:\Documents and Settings\heming1.HEMING\桌面\RAVWM.rar/update3.exe
已经删除: 木马程序 Trojan-Spy.Win32.Delf.uu 文件: C:\Documents and Settings\heming1.HEMING\桌面\RAVWM.rar/RAVWL.EXE//PE_Patch.UPX//UPX
已经删除: 木马程序 Backdoor.Win32.Agent.ahj 文件: C:\Documents and Settings\heming1.HEMING\桌面\RAVWM.rar/8FFFEB65.EXE//NSPack
已经删除: 木马程序 Trojan-Spy.Win32.Delf.uu 文件: C:\Documents and Settings\heming1.HEMING\桌面\RAVWM.rar/RAVWM.EXE//PE_Patch.UPX//UPX
已经删除: 木马程序 Trojan-PSW.Win32.OnLineGames.mq 文件: C:\Documents and Settings\heming1.HEMING\桌面\RAVWM.rar/winform.exe//PE_Patch//UPack
已经删除: 木马程序 Trojan-PSW.Win32.OnLineGames.es 文件: C:\Documents and Settings\heming1.HEMING\桌面\RAVWM.rar/mppds.exe
已经删除: 木马程序 Trojan-PSW.Win32.Delf.qc 文件: C:\Documents and Settings\heming1.HEMING\桌面\RAVWM.rar/rising619.exe//UPX
已经删除: 木马程序 Trojan-PSW.Win32.OnLineGames.nb 文件: C:\Documents and Settings\heming1.HEMING\桌面\RAVWM.rar/msccrt.exe
已经删除: 木马程序 Trojan-PSW.Win32.OnLineGames.ms 文件: C:\Documents and Settings\heming1.HEMING\桌面\RAVWM.rar/wsdttrs.exe
已经删除: 木马程序 Trojan-PSW.Win32.OnLineGames.es 文件: C:\Documents and Settings\heming1.HEMING\桌面\RAVWM.rar/dcoh.exe
已经删除: 木马程序 Trojan-PSW.Win32.OnLineGames.mx 文件: C:\Documents and Settings\heming1.HEMING\桌面\RAVWM.rar/c0nime.exe//UPX

显示全部楼层 · 发表于 2007-4-12 16:51:32

风暴胜者V2 测试版本(http://www.v0day.com)
_________您的安全是我们的责任_______________
载入病毒库…进行整理…分配内存…可以使用

===============================================
___________病毒查杀结果__________________

===============================================

2007年4月12日16时51分15秒开始查杀C:\Documents and Settings\Administrator\桌面\新建文件夹\RAVWM
C:\Documents and Settings\Administrator\桌面\新建文件夹\RAVWM\c0nime.exe 为可疑文件
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\RAVWM\update3.exe
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\RAVWM\RAVWL.EXE
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\RAVWM\8FFFEB65.EXE
C:\Documents and Settings\Administrator\桌面\新建文件夹\RAVWM\8FFFEB65.EXE 发现未知可疑文件:Win32.Nop ?蕐操作:阻止运行
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\RAVWM\RAVWM.EXE
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\RAVWM\rising619.exe
C:\Documents and Settings\Administrator\桌面\新建文件夹\RAVWM\rising619.exe 发现未知可疑文件:Win32.NkHack.Preloc.A 操作:阻止运行
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\RAVWM\wsdttrs.exe
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\RAVWM\dcoh.exe
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\RAVWM\bar.exe
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\RAVWM\cmdbc.exe
=========================================

_________文件性质分析结果________________
"带壳"仅指文件性质,仅供专业人员分析使用。

C:\Documents and Settings\Administrator\桌面\新建文件夹\RAVWM\RAVWL.EXE 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\新建文件夹\RAVWM\RAVWM.EXE 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\新建文件夹\RAVWM\rising619.exe 带壳文件:UPX加壳
-----------------------------------------

2007年4月12日16时51分25秒收起线程…100% 查杀完毕！
扫描文件：13查杀病毒：12

显示全部楼层 · 发表于 2007-4-12 17:18:01

费尔搞定13个

显示全部楼层 · 发表于 2007-4-12 17:59:53

KIS 已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.mx 文件: D:\Downloads\RAVWM.rar/c0nime.exe//UPX
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.es 文件: D:\Downloads\RAVWM.rar/update3.exe
已删除: 木马程序 Trojan-Spy.Win32.Delf.uu 文件: D:\Downloads\RAVWM.rar/RAVWL.EXE//PE_Patch.UPX//UPX
已删除: 木马程序 Backdoor.Win32.Agent.ahj 文件: D:\Downloads\RAVWM.rar/8FFFEB65.EXE//NSPack
已删除: 木马程序 Trojan-Spy.Win32.Delf.uu 文件: D:\Downloads\RAVWM.rar/RAVWM.EXE//PE_Patch.UPX//UPX
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.mq 文件: D:\Downloads\RAVWM.rar/winform.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.es 文件: D:\Downloads\RAVWM.rar/mppds.exe
已删除: 木马程序 Trojan-PSW.Win32.Delf.qc 文件: D:\Downloads\RAVWM.rar/rising619.exe//UPX
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.nb 文件: D:\Downloads\RAVWM.rar/msccrt.exe
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.ms 文件: D:\Downloads\RAVWM.rar/wsdttrs.exe
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.es 文件: D:\Downloads\RAVWM.rar/dcoh.exe
已删除: 木马程序 Trojan-Clicker.Win32.Agent.io 文件: D:\Downloads\RAVWM.rar/bar.exe//data0002
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.es 文件: D:\Downloads\RAVWM.rar/cmdbc.exe

显示全部楼层 · 发表于 2007-4-12 18:15:31

红伞现在能全杀了

Starting the file scan:

Begin scan in 'C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\RAVWM.rar'
C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\RAVWM.rar
  [0] Archive type: RAR
  --> c0nime.exe
   [DETECTION] Is the Trojan horse TR/Drop.Agent.14336
  --> update3.exe
   [DETECTION] Is the Trojan horse TR/Drop.OnLineGa.GS
  --> RAVWL.EXE
   [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> 8FFFEB65.EXE
   [DETECTION] Is the Trojan horse TR/Dldr.Small.ejw.1
  --> RAVWM.EXE
   [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> winform.exe
   [DETECTION] Is the Trojan horse TR/Drop.OnLineGames
  --> mppds.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ARO.8
  --> rising619.exe
   [DETECTION] Is the Trojan horse TR/PSW.Steal.27568
  --> msccrt.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ARI.104
  --> wsdttrs.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.MS.1
  --> dcoh.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ES.1430
  --> bar.exe
   [DETECTION] Is the Trojan horse TR/Drop.SuperUtilBa
  --> cmdbc.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ES.1429
   [INFO]    The file was moved to '467406f2.qua'!

End of the scan: 2007年4月12日  22:15
Used time: 00:05 min

The scan has been done completely.

   0 Scanning directories
   14 Files were scanned
   13 viruses and/or unwanted programs were found
   0 files were deleted
   0 files were repaired
   1 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-4-20 04:14:14

红伞也搞定13个```

[病毒样本] RAVWM(瑞星只扫出一个,共13个)