可疑文件，自己电脑上面的，BD没报警

Kakura

BD提示欲修改注册表，还有修改日期超级蹊跷

The EQs

Scan performed at: 2007-5-16 16:49:17
Scanning Log
NOD32 version 2269 (20070516) NT
Command line: C:\Documents and Settings\EQ2\桌面\kndncso.zip C:\Documents and Settings\EQ2\桌面\jvxnypf.zip C:\Documents and Settings\EQ2\桌面\meex.zip
Operating memory - is OK

Date: 16.5.2007  Time: 16:49:26
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\kndncso.zip; C:\Documents and Settings\EQ2\桌面\jvxnypf.zip; C:\Documents and Settings\EQ2\桌面\meex.zip
C:\Documents and Settings\EQ2\桌面\kndncso.zip ?ZIP ?kndncso.exe - Win32/Delf.NCX worm - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\jvxnypf.zip ?ZIP ?jvxnypf.exe - Win32/Delf.NCX worm - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\meex.zip ?ZIP ?meex.com - Win32/Delf.NCX worm - was a part of the deleted object
Number of scanned files: 6
Number of threats found: 3
Number of files cleaned: 3
Time of completion: 16:49:26 Total scanning time: 0 sec (00:00:00)

wangjay1980

detected: Trojan program Trojan-Downloader.Win32.Small.eor        File: C:\Documents and Settings\Owner\×ÀÃæ\jvxnypf.zip/jvxnypf.exe
detected: Trojan program Trojan-Downloader.Win32.Small.eor        File: C:\Documents and Settings\Owner\×ÀÃæ\kndncso.zip/kndncso.exe
detected: Trojan program Trojan-Downloader.Win32.Small.eor        File: C:\Documents and Settings\Owner\×ÀÃæ\meex.zip/meex.com
detected: Trojan program Trojan-Downloader.Win32.Small.eor        File: C:\Documents and Settings\Owner\×ÀÃæ\kndncso.zip

金剑

风暴胜者V2 测试版本(http://www.v0day.com)
_________您的安全是我们的责任_______________
载入病毒库…进行整理…分配内存…可以使用
蜜罐检测:正常 OK!

===============================================
   ___________病毒查杀结果__________________


===============================================

2007年5月16日16时52分36秒 开始查杀C:\Documents and Settings\root\桌面\新建文件夹\新建文件夹\jvxnypf
  未知的可疑率80%的文件(启发)C:\Documents and Settings\root\桌面\新建文件夹\新建文件夹\jvxnypf\jvxnypf.exe 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\root\桌面\新建文件夹\新建文件夹\jvxnypf\jvxnypf.exe 操作:阻止运行
  未知的可疑率60%的文件(启发)C:\Documents and Settings\root\桌面\新建文件夹\新建文件夹\jvxnypf\kndncso.exe 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\root\桌面\新建文件夹\新建文件夹\jvxnypf\kndncso.exe 操作:阻止运行
  未知的可疑率60%的文件(启发)C:\Documents and Settings\root\桌面\新建文件夹\新建文件夹\jvxnypf\meex.com 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\root\桌面\新建文件夹\新建文件夹\jvxnypf\meex.com 操作:阻止运行
=========================================

_________文件性质分析结果________________
"带壳"仅指文件性质,仅供专业人员分析使用。


-----------------------------------------

2007年5月16日16时52分37秒收起线程…100% 查杀完毕！
扫描文件：3查杀病毒：3

solcroft

重发第三次了，两个互相重生的进程

allenhippo

说明这个毒正在流行

siman.yu

AVAST!全杀!

uhthn2002

vba32
C:\Documents and Settings\tomcheung\Desktop\jvxnypf.zip:<ZIP>\jvxnypf.exe : infected Trojan-Downloader.Win32.Small.enf
C:\Documents and Settings\tomcheung\Desktop\kndncso.zip:<ZIP>\kndncso.exe : infected Trojan-Downloader.Win32.Small.enf
C:\Documents and Settings\tomcheung\Desktop\meex.zip:<ZIP>\meex.com : infected Trojan-Downloader.Win32.Small.enf

剑指七星

已检测到: 木马程序 Trojan-Downloader.Win32.Small.eor        URL: http:/bbs.kafan.cn/attachment.php?aid=70986\kndncso.exe
已检测到: 木马程序 Trojan-Downloader.Win32.Small.eor        URL: http:/bbs.kafan.cn/attachment.php?aid=70987\meex.com
已检测到: 木马程序 Trojan-Downloader.Win32.Small.eor        URL: http:/bbs.kafan.cn/attachment.php?aid=70985\jvxnypf.exe

卡6全报

harry_chang2003

PCC全報啟發式