包

tonger2003

11

The EQs

Scan performed at: 2007-5-4 14:23:12
Scanning Log
NOD32 version 2238 (20070503) NT
Command line: C:\Documents and Settings\EQ2\桌面\桌面.rar
Operating memory - is OK

Date: 4.5.2007  Time: 14:23:16
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\桌面.rar
C:\Documents and Settings\EQ2\桌面\桌面.rar ?RAR ?LYLOADER.EXE - a variant of Win32/PSW.Agent.NEC trojan
C:\Documents and Settings\EQ2\桌面\桌面.rar ?RAR ?up.exe - a variant of Win32/PSW.Agent.NDF trojan
C:\Documents and Settings\EQ2\桌面\桌面.rar ?RAR ?K.exe - a variant of Win32/PSW.Agent.NCC trojan
C:\Documents and Settings\EQ2\桌面\桌面.rar ?RAR ?rekkblp.dll - Win32/Pacex.Gen virus
C:\Documents and Settings\EQ2\桌面\桌面.rar ?RAR ?RAVQJ.EXE - a variant of Win32/PSW.Delf.NGU trojan
C:\Documents and Settings\EQ2\桌面\桌面.rar ?RAR ?ai.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\桌面.rar ?RAR ?TIMP.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\桌面.rar ?RAR ?RAVWM.EXE - probably a variant of Win32/PSW.Delf.NGU trojan
C:\Documents and Settings\EQ2\桌面\桌面.rar ?RAR ?mds.exe - a variant of Win32/PSW.Agent.NCC trojan
C:\Documents and Settings\EQ2\桌面\桌面.rar ?RAR ?22253393.exe - probably a variant of Win32/PSW.QQPass.VD trojan
C:\Documents and Settings\EQ2\桌面\桌面.rar ?RAR ?cs.exe - a variant of Win32/PSW.Agent.NCC trojan
Number of scanned files: 13
Number of threats found: 11
Number of files cleaned: 1
Time of completion: 14:23:17 Total scanning time: 1 sec (00:00:01)

Notes:
[7] File is probably infected with an unknown virus.

The EQs

11个全部用启发式报的。。。。

1p1

扫描进行于：2007-5-4 14:25:29
扫描日志
NOD32版本 2238 (20070503) NT
命令行： C:\Documents and Settings\user\桌面\桌面.rar

日期： 4.5.2007  时间：14:25:31
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\user\桌面\桌面.rar
C:\Documents and Settings\user\桌面\桌面.rar >>RAR >>LYLOADER.EXE - Win32/PSW.Agent.NEC 木马的变种
C:\Documents and Settings\user\桌面\桌面.rar >>RAR >>up.exe - Win32/PSW.Agent.NDF 木马的变种
C:\Documents and Settings\user\桌面\桌面.rar >>RAR >>K.exe - Win32/PSW.Agent.NCC 木马的变种
C:\Documents and Settings\user\桌面\桌面.rar >>RAR >>rekkblp.dll - Win32/Pacex.Gen 病毒
C:\Documents and Settings\user\桌面\桌面.rar >>RAR >>RAVQJ.EXE - Win32/PSW.Delf.NGU 木马的变种
C:\Documents and Settings\user\桌面\桌面.rar >>RAR >>ai.exe - 未查明的 NewHeur_PE 病毒 [7]
C:\Documents and Settings\user\桌面\桌面.rar >>RAR >>TIMP.exe - 未查明的 NewHeur_PE 病毒 [7]
C:\Documents and Settings\user\桌面\桌面.rar >>RAR >>RAVWM.EXE - 可能是 Win32/PSW.Delf.NGU 木马 的一个变种
C:\Documents and Settings\user\桌面\桌面.rar >>RAR >>mds.exe - Win32/PSW.Agent.NCC 木马的变种
C:\Documents and Settings\user\桌面\桌面.rar >>RAR >>22253393.exe - 可能是 Win32/PSW.QQPass.VD 木马 的一个变种
C:\Documents and Settings\user\桌面\桌面.rar >>RAR >>cs.exe - Win32/PSW.Agent.NCC 木马的变种
已扫描的文件数目：12
已发现的病毒数目：11
完成时间： 14:25:31 总扫描时间：0 秒 (00:00:00)

注意：
[7] 该文件可能感染上未知病毒。

shenrenrenren

已隔离: 病毒 Invader (修改) 文件: C:\TDDOWNLOAD\桌面.rar/LYLOADER.EXE//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.qh 文件: C:\TDDOWNLOAD\桌面.rar/up.exe\UPXDND.DLL
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.es 文件: C:\TDDOWNLOAD\桌面.rar/K.exe
已删除: 木马程序 Trojan-PSW.Win32.Nilage.bht 文件: C:\TDDOWNLOAD\桌面.rar/rekkblp.dll
已隔离: 病毒 Trojan.Generic (修改) 文件: C:\TDDOWNLOAD\桌面.rar/RAVQJ.EXE//FSG
已隔离: 病毒 Invader (修改) 文件: C:\TDDOWNLOAD\桌面.rar/n.exe
已隔离: 病毒 Trojan.Generic (修改) 文件: C:\TDDOWNLOAD\桌面.rar/ai.exe
已删除: 木马程序 Trojan-Downloader.Win32.Delf.awi 文件: C:\TDDOWNLOAD\桌面.rar/TIMP.exe//FSG
已隔离: 病毒 Trojan.Generic (修改) 文件: C:\TDDOWNLOAD\桌面.rar/RAVWM.EXE//FSG
已隔离: 病毒 Invader (修改) 文件: C:\TDDOWNLOAD\桌面.rar/mds.exe
已删除: 木马程序 Trojan-PSW.Win32.QQPass.wm 文件: C:\TDDOWNLOAD\桌面.rar/22253393.exe//UPX
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.rj 文件: C:\TDDOWNLOAD\桌面.rar/cs.exe
12个。喜欢扫包。

[ 本帖最后由 shenrenrenren 于 2007-5-4 14:27 编辑 ]

1p1

原帖由 EQ2 于 2007-5-4 14:24 发表
11个全部用启发式报的。。。。

你又比我快

tracydk

红伞12个


Starting the file scan:

Begin scan in 'F:\样本\桌面.rar'
F:\样本\桌面.rar
  [0] Archive type: RAR
  --> LYLOADER.EXE
      [DETECTION] Is the Trojan horse TR/Drop.Agent.12800
  --> up.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> K.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ES.2185
  --> rekkblp.dll
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> RAVQJ.EXE
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> n.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> ai.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> TIMP.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> RAVWM.EXE
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> mds.exe
      [DETECTION] Is the Trojan horse TR/Agent.19968.122
  --> 22253393.exe
      [DETECTION] Is the Trojan horse TR/PSW.QQPass.WM
  --> cs.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ARI.203
      [INFO]      The file was deleted!

KAV-Longhorn

DRWEB才5个

soul20010

Result: 5 malware found
Trojan-PSW.Win32.OnLineGames.es (virus)

    * C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\×ÀÃæ.rar\K.exe

Trojan-PSW.Win32.Nilage.bht (virus)

    * C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\×ÀÃæ.rar\rekkblp.dll

Trojan-Downloader.Win32.Delf.awi (virus)

    * C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\×ÀÃæ.rar\TIMP.exe

Trojan-PSW.Win32.QQPass.wm (virus)

    * C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\×ÀÃæ.rar\22253393.exe

Trojan-PSW.Win32.OnLineGames.rj (virus)

    * C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\×ÀÃæ.rar\cs.exe

mofunzone

一共12个，雨伞全了