包包

tonger2003

11

[ 本帖最后由 tonger2003 于 2007-4-17 22:03 编辑 ]

zxy900906

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD'
C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD\TDDOWNLOAD\0.exe
      [DETECTION] Is the Trojan horse TR/Dldr.VB.asn.2
      [INFO]      A backup was created as '4689d608.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD\TDDOWNLOAD\01.exe
      [DETECTION] Is the Trojan horse TR/Agent.17408.27
      [INFO]      A backup was created as '4652d60b.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD\TDDOWNLOAD\02.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ES.1662
      [INFO]      A backup was created as '4652d60d.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD\TDDOWNLOAD\03.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '4652d60e.qua'!
C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD\TDDOWNLOAD\04.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.KW.56
      [INFO]      A backup was created as '4652d60f.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD\TDDOWNLOAD\05.exe
      [DETECTION] Is the Trojan horse TR/Proxy.Delf.CA
      [INFO]      A backup was created as '4652d610.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD\TDDOWNLOAD\06.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '4652d612.qua'!
C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD\TDDOWNLOAD\07.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [INFO]      The file was moved to '4652d613.qua'!
C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD\TDDOWNLOAD\08.exe
      [DETECTION] Is the Trojan horse TR/Agent.17920.29
      [INFO]      A backup was created as '4652d614.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD\TDDOWNLOAD\09.exe
      [DETECTION] Contains signature of the dropper DR/Boran.Z.99
      [INFO]      A backup was created as '4652d615.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD\TDDOWNLOAD\10.exe
      [DETECTION] Contains signature of the dropper DR/Dldr.Agent.bcd.19
      [INFO]      A backup was created as '47faad92.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD\TDDOWNLOAD\Ghook.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.JJ.60
      [INFO]      A backup was created as '4693d645.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD\TDDOWNLOAD\svchost.exe
      [DETECTION] Is the Trojan horse TR/PSW.Onlinegames.EB.3
      [INFO]      A backup was created as '4687d653.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!

The EQs

Scan performed at: 2007-4-17 22:08:55
Scanning Log
NOD32 version 2198 (20070417) NT
Command line: C:\Documents and Settings\EQ2\桌面\TDDOWNLOAD
Operating memory - is OK

Date: 17.4.2007  Time: 22:08:59
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\TDDOWNLOAD\
C:\Documents and Settings\EQ2\桌面\TDDOWNLOAD\TDDOWNLOAD\01.exe - probably a variant of Win32/PSW.Agent.NCC trojan
C:\Documents and Settings\EQ2\桌面\TDDOWNLOAD\TDDOWNLOAD\02.exe - a variant of Win32/PSW.Agent.NCC trojan
C:\Documents and Settings\EQ2\桌面\TDDOWNLOAD\TDDOWNLOAD\03.exe - a variant of Win32/PSW.Agent.NCC trojan
C:\Documents and Settings\EQ2\桌面\TDDOWNLOAD\TDDOWNLOAD\04.exe - Win32/PSW.Agent.NDP trojan - quarantined - unable to clean - deleted
C:\Documents and Settings\EQ2\桌面\TDDOWNLOAD\TDDOWNLOAD\05.exe ?FSG v2.0 - Win32/PSW.Delf.NGW trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\TDDOWNLOAD\TDDOWNLOAD\06.exe - Win32/Agent.NHN trojan - quarantined - unable to clean - deleted
C:\Documents and Settings\EQ2\桌面\TDDOWNLOAD\TDDOWNLOAD\08.exe - Win32/PSW.Agent.NDF trojan - quarantined - unable to clean - deleted
C:\Documents and Settings\EQ2\桌面\TDDOWNLOAD\TDDOWNLOAD\svchost.exe - Win32/PSW.Delf.NGV trojan - quarantined - unable to clean - deleted
Number of scanned files: 16
Number of threats found: 8
Number of files cleaned: 8
Time of completion: 22:09:01 Total scanning time: 2 sec (00:00:02)

aoyang

费尔扫描杀了9个

The EQs

发现看nod32扫描也是一种乐趣。。。能发现nod32脱哪些壳。。。。

欠妳緈諨

蜘蛛扫了8个

jlennon

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of
Start time: 2007-4-17 22:43
Engine(s): BD-Engine (BD 17.3326)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: 0.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD[1]\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: DeepScan:Generic.Malware.dld!!.EC9890A9 (BD-Engine)
Object: 01.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD[1]\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: Generic.Malware.SgPWS.C2D7668E (BD-Engine)
Object: 02.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD[1]\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: Generic.Malware.SdldgPWS.78704969 (BD-Engine)
Object: 03.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD[1]\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: Trojan.PWS.OnLineGames.ARI (BD-Engine)
Object: 04.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD[1]\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: Trojan.PWS.OnLineGames.ARM (BD-Engine)
Object: 05.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD[1]\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: DeepScan:Generic.Malware.SFBdld.E3F7C6FE (BD-Engine)
Object: 06.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD[1]\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: Generic.Malware.SdldPWS.4D2FF865 (BD-Engine)
Object: 08.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD[1]\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: Generic.Malware.SdldPWS.833D63E1 (BD-Engine)
Object: (NSIS o) lzma_solid_nsis0001
        In archive: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD[1]\TDDOWNLOAD\09.exe
        Status: Virus detected
        Virus: Adware.Boran.AT (BD-Engine)
Object: 09.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD[1]\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: Adware.Boran.AT (BD-Engine)
Object: svchost.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD[1]\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: Trojan.PWS.Onlinegames.EB (BD-Engine)
Analysis complete: 2007-4-17 22:43
    13 files checked
    10 infected files detected
    0 suspected files detected

jlennon

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-4-17
Start time: 2007-4-17 22:46
Engine(s): KAV engine (AVK 17.3590)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: 0.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD[1]\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: Trojan-Downloader.Win32.VB.asn (KAV engine)
Object: 01.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD[1]\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.es (KAV engine)
Object: 03.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD[1]\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.oe (KAV engine)
Object: 04.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD[1]\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.kw (KAV engine)
Object: 05.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD[1]\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.np (KAV engine)
Object: 06.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD[1]\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.oe (KAV engine)
Object: 08.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD[1]\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.es (KAV engine)
Object: stream data0001
        In archive: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD[1]\TDDOWNLOAD\09.exe
        Status: Virus detected
        Virus: not-a-virus:AdWare.Win32.Boran.z (KAV engine)
Object: 09.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD[1]\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: not-a-virus:AdWare.Win32.Boran.z (KAV engine)
Object: stream data0003
        In archive: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD[1]\TDDOWNLOAD\10.exe
        Status: Virus detected
        Virus: Trojan-Downloader.Win32.Agent.bcd (KAV engine)
Object: 10.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD[1]\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: Trojan-Downloader.Win32.Agent.bcd (KAV engine)
Object: Ghook.dll
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD[1]\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.jj (KAV engine)
Object: svchost.exe
        Path: C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD[1]\TDDOWNLOAD
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.gm (KAV engine)
Analysis complete: 2007-4-17 22:46
    13 files checked
    11 infected files detected
    0 suspected files detected

bridgewr

微点5个已知，其他等会上情况

bridgewr

9和10是流氓，Ghook.dll微点没报，本身对系统是无害滴，其他微点杀光