围巾加木马

小邪邪

什么时候都不要以身试毒（最好在虚拟机里去试）
系统盘如果可以GHOST或许有时候反倒不怕，但其它盘也被感染到的话就麻烦一点
比较惨的是连GHOST都被删掉，以及其它的恶劣情况

蓝色牛仔裤

生成物...

KAV-Longhorn

红伞竟然报了22个

Starting the file scan:

Begin scan in 'C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\Internet Explorer.rar'
C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\Internet Explorer.rar
  [0] Archive type: RAR
  --> Program Files\Internet Explorer\SERVICES.EXE
      [DETECTION] Is the Trojan horse TR/Drop.Delf.aom
      [1] Archive type: RAR SFX (self extracting)
      --> systemt.exe
          [DETECTION] Is the Trojan horse TR/Spy.Agent.QP.1
  --> WINDOWS\uninstall\rundl132.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> WINDOWS\system32\mpppds.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ES.616
  --> WINDOWS\system32\msccrt.dll
      [DETECTION] Is the Trojan horse TR/Agent.9216.18
  --> WINDOWS\system32\scmdbcs.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> WINDOWS\system32\slai.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> WINDOWS\system32\Winhttps.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.NW
  --> WINDOWS\system32\winform.dll
      [DETECTION] Is the Trojan horse TR/Drop.OnLineGames
  --> WINDOWS\mpppds.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ES.608
  --> WINDOWS\msccrt.exe
      [DETECTION] Is the Trojan horse TR/Agent.15872.31
  --> WINDOWS\scmdbcs.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ARI.127
  --> WINDOWS\Logo1_.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> WINDOWS\RichDll.dll
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> WINDOWS\winform.exe
      [DETECTION] Is the Trojan horse TR/Drop.OnLineGames
  --> Recycled\Dc11.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> Recycled\Dc8.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> Recycled\Dc6.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.NW
  --> Recycled\Dc9.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.NW
  --> Documents and Settings\Administrator\Local Settings\Temp\upxdnd.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ES.1625
  --> Documents and Settings\Administrator\Local Settings\Temp\upxdnd.exe
      [DETECTION] Is the Trojan horse TR/Agent.17920.25
  --> Documents and Settings\Administrator\×ÀÃæ\rundl132.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [INFO]      The file was moved to '4692ba8e.qua'!


End of the scan: 2007年4月13日  11:00
Used time: 00:07 min

The scan has been done completely.

      0 Scanning directories
     30 Files were scanned
     22 viruses and/or unwanted programs were found
      0 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      8 Files not concerned
      2 Archives were scanned
      0 Warnings
      0 Notes

taihuxian

Starting the file scan:

Begin scan in 'C:\Documents and Settings\user\桌面\Internet Explorer.rar'
C:\Documents and Settings\user\桌面\Internet Explorer.rar
  [0] Archive type: RAR
  --> Program Files\Internet Explorer\SERVICES.EXE
      [DETECTION] Is the Trojan horse TR/Drop.Delf.aom
      [1] Archive type: RAR SFX (self extracting)
      --> systemt.exe
          [DETECTION] Is the Trojan horse TR/Spy.Agent.QP.1
  --> WINDOWS\uninstall\rundl132.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> WINDOWS\system32\mpppds.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ES.616
  --> WINDOWS\system32\msccrt.dll
      [DETECTION] Is the Trojan horse TR/Agent.9216.18
  --> WINDOWS\system32\scmdbcs.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> WINDOWS\system32\slai.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> WINDOWS\system32\Winhttps.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.NW
  --> WINDOWS\system32\winform.dll
      [DETECTION] Is the Trojan horse TR/Drop.OnLineGames
  --> WINDOWS\mpppds.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ES.608
  --> WINDOWS\msccrt.exe
      [DETECTION] Is the Trojan horse TR/Agent.15872.31
  --> WINDOWS\scmdbcs.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ARI.127
  --> WINDOWS\Logo1_.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> WINDOWS\RichDll.dll
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> WINDOWS\winform.exe
      [DETECTION] Is the Trojan horse TR/Drop.OnLineGames
  --> Recycled\Dc11.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> Recycled\Dc8.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> Recycled\Dc6.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.NW
  --> Recycled\Dc9.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.NW
  --> Documents and Settings\Administrator\Local Settings\Temp\upxdnd.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ES.1625
  --> Documents and Settings\Administrator\Local Settings\Temp\upxdnd.exe
      [DETECTION] Is the Trojan horse TR/Agent.17920.25
  --> Documents and Settings\Administrator\×ÀÃæ\rundl132.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [INFO]      A backup was created as '4692d40e.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!


End of the scan: 2007年4月13日  08:49
Used time: 00:06 min

The scan has been done completely.

      0 Scanning directories
     31 Files were scanned
     22 viruses and/or unwanted programs were found
      1 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      9 Files not concerned
      2 Archives were scanned
      0 Warnings
      0 Notes

zweil2005

日期: 2007年4月13日  时间: 11:21:59
反 Rookits 技术已启用。
已扫描磁盘、文件夹和文件: F:\样本\Internet_Explorer.rar
F:\样本\Internet_Explorer.rar ?RAR ?Program Files\Internet Explorer\SERVICES.EXE<病毒 - > - 操作错误 <错误 ()> [4]
F:\样本\Internet_Explorer.rar ?RAR ?WINDOWS\uninstall\rundl132.exe<病毒 - Win32/Viking.CH 病毒>
F:\样本\Internet_Explorer.rar ?RAR ?WINDOWS\system32\mpppds.dll<病毒 - Win32/PSW.Agent.NCC 木马 变种>
F:\样本\Internet_Explorer.rar ?RAR ?WINDOWS\system32\msccrt.dll<病毒 - > - 操作错误 <错误 ()> [4]
F:\样本\Internet_Explorer.rar ?RAR ?WINDOWS\system32\scmdbcs.dll<病毒 - 可能是 Win32/PSW.Agent.NCC 木马 变种>
F:\样本\Internet_Explorer.rar ?RAR ?WINDOWS\system32\slai.dll<病毒 - Win32/Agent.NHN 木马>
F:\样本\Internet_Explorer.rar ?RAR ?WINDOWS\system32\Winhttps.dll<病毒 - > - 操作错误 <错误 ()> [4]
F:\样本\Internet_Explorer.rar ?RAR ?WINDOWS\system32\winform.dll<病毒 - Win32/PSW.Agent.NCC 木马 变种>
F:\样本\Internet_Explorer.rar ?RAR ?WINDOWS\mpppds.exe<病毒 - 可能是 Win32/PSW.Agent.NCC 木马 变种>
F:\样本\Internet_Explorer.rar ?RAR ?WINDOWS\msccrt.exe<病毒 - Win32/PSW.Agent.NCC 木马 变种>
F:\样本\Internet_Explorer.rar ?RAR ?WINDOWS\scmdbcs.exe<病毒 - Win32/PSW.Agent.NCC 木马 变种>
F:\样本\Internet_Explorer.rar ?RAR ?WINDOWS\Logo1_.exe<病毒 - Win32/Viking.CH 病毒>
F:\样本\Internet_Explorer.rar ?RAR ?WINDOWS\RichDll.dll<病毒 - Win32/Viking.CC 病毒>
F:\样本\Internet_Explorer.rar ?RAR ?WINDOWS\winform.exe<病毒 - 可能是 Win32/PSW.Agent.NCC 木马 变种>
F:\样本\Internet_Explorer.rar ?RAR ?Recycled\Dc11.exe<病毒 - Win32/Agent.NHN 木马>
F:\样本\Internet_Explorer.rar ?RAR ?Recycled\Dc8.exe<病毒 - Win32/Agent.NHN 木马>
F:\样本\Internet_Explorer.rar ?RAR ?Documents and Settings\Administrator\Local Settings\Temp\upxdnd.dll<病毒 - Win32/PSW.Agent.NDF 木马 变种>
F:\样本\Internet_Explorer.rar ?RAR ?Documents and Settings\Administrator\Local Settings\Temp\upxdnd.exe<病毒 - Win32/PSW.Agent.NDF 木马 变种>
F:\样本\Internet_Explorer.rar ?RAR ?Documents and Settings\Administrator\桌面\rundl132.exe<病毒 - Win32/Viking.CH 病毒>
已扫描文件数量: 24
已发现病毒数量: 16
活动的病毒数量: 1
完成时间: 11:23:47 总共扫描时间: 108 秒 (00:01:48)

promised

原帖由 taihuxian 于 2007-4-13 08:49 发表
Starting the file scan:

Begin scan in 'C:\Documents and Settings\user\桌面\Internet Explorer.rar'
C:\Documents and Settings\user\桌面\Internet Explorer.rar
  [0] Archive type: RAR
   ...

鞭尸都给报了