新的來了，NOD有啟發出來

lanvin

開始試驗geswall

欠妳緈諨

什么东东？奇怪的名字

tracydk

---------------------------------------------------------
AVG Anti-Spyware - 扫描报告
---------------------------------------------------------

+ 创建时间:        14:50:53 2007-5-7

+ 扫描结果:       



F:\样本\porno.part1.rar/porno.exe/fullname.txt -> Backdoor.Cloner.bg : 已清除.


::报告结束

moonsilver

C:\Documents and Settings\moonsilver\桌面\porno.r
ar>>porno.exe>>svchost.exe

Backdoor.MIRC-Based.o

rising

欠妳緈諨

tart of the scan: 2007年5月7日  14:51

Starting the file scan:

Begin scan in 'D:\anti-malware测试\未解压\porno\porno.exe'
D:\anti-malware测试\未解压\porno\porno.exe
      [DETECTION] Is the Trojan horse TR/Drop.Zapchas.F.2
      [INFO]      The file was deleted!

wangjay1980

deleted: Trojan program Backdoor.IRC.Zapchast        File: C:\Documents and Settings\Owner\×ÀÃæ\porno.exe/mirc.ini
deleted: Trojan program Backdoor.IRC.Zapchast        File: C:\Documents and Settings\Owner\×ÀÃæ\porno.exe/script.ini
deleted: Trojan program Backdoor.Win32.mIRC-based        File: C:\Documents and Settings\Owner\×ÀÃæ\porno.exe/svchost.exe
deleted: Trojan program Backdoor.IRC.Zapchast        File: C:\Documents and Settings\Owner\×ÀÃæ\porno.exe/sup.reg

The EQs

Scan performed at: 2007-5-7 15:44:44
Scanning Log
NOD32 version 2245 (20070506) NT
Command line: C:\Documents and Settings\EQ2\桌面\porno
Operating memory - is OK

Date: 7.5.2007  Time: 15:44:48
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\porno\
C:\Documents and Settings\EQ2\桌面\porno\porno.exe ?RAR ?fullname.txt - IRC/Cloner.BG trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\porno\porno.exe ?RAR ?ident.txt - IRC/Cloner.BG trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\porno\porno.exe ?RAR ?mirc.ini - IRC/Zapchast trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\porno\porno.exe ?RAR ?script.ini - probably a variant of IRC/Cloner.AT trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\porno\porno.exe ?RAR ?sup.bat - IRC/Zapchast.H trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\porno\porno.exe ?RAR ?sup.reg - IRC/Cloner.AT trojan - was a part of the deleted object
Number of scanned files: 16
Number of threats found: 6
Number of files cleaned: 1
Time of completion: 15:44:49 Total scanning time: 1 sec (00:00:01)

马力

驱逐舰

金剑

风暴胜者V2 测试版本(http://www.v0day.com)
_________您的安全是我们的责任_______________
载入病毒库…进行整理…分配内存…可以使用
蜜罐检测:正常 OK!

===============================================
   ___________病毒查杀结果__________________


===============================================

2007年5月7日16时58分17秒 开始查杀C:\Documents and Settings\Administrator\桌面\porno
威胁性文件：C:\Documents and Settings\Administrator\桌面\porno\porno.exe
=========================================

_________文件性质分析结果________________
"带壳"仅指文件性质,仅供专业人员分析使用。


C:\Documents and Settings\Administrator\桌面\porno\porno.exe 带壳文件:UPX加壳
-----------------------------------------

2007年5月7日16时58分18秒收起线程…100% 查杀完毕！
扫描文件：1查杀病毒：1

wao1201

2007-5-7 17:20:13        Safe'n'Sec Scan report

2007-5-7 17:20:13        Scan start time:        2007-5-7 17:20:13

2007-5-7 17:20:13        Action applied to detected malware:       
2007-5-7 17:20:13        Scan level:        Full

2007-5-7 17:20:35        C:\Documents and Settings\Wao\桌面\porno.exe                                            Infected        Trojan.Zapchas.F        Moved to quarantine
2007-5-7 17:20:35        Scan area:

2007-5-7 17:20:35        C:\Documents and Settings\Wao\桌面\porno.exe
2007-5-7 17:20:35       
2007-5-7 17:20:35        Objects scanned:        1
2007-5-7 17:20:35        Malicious objects detected:        1
2007-5-7 17:20:35        Malicious objects deleted / removed:        1

2007-5-7 17:20:35        Scan completion time:        2007-5-7 17:20:35