hello带来的好东西（巨多！超出你的想象！）

ashe_vaan

怎么回事？

mofunzone

发的样本中有一个重复
剩下antivir全搞定，那个ini不能算
Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\ycnt9'
C:\Documents and Settings\morgan\My Documents\ycnt9\
  AutoRun.inf
  hello.exe
      [DETECTION] Is the Trojan horse TR/PSW.Nilage.bcw.16
      [INFO]      The file was deleted!
  ycnt1.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.QY.137
      [INFO]      The file was deleted!
  ycnt2.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.NN.93
      [INFO]      The file was deleted!
  ycnt3.exe
      [DETECTION] Is the Trojan horse TR/Proxy.Small.DU.99
      [INFO]      The file was deleted!
  ycnt4.exe
      [DETECTION] Is the Trojan horse TR/Hijack.Smal.5452
      [INFO]      The file was deleted!
  ycnt5.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ES.2773
      [INFO]      The file was deleted!
  ycnt6.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.QH.64
      [INFO]      The file was deleted!
  ycnt7.exe
      [DETECTION] Is the Trojan horse TR/Agent.abf.771
      [INFO]      The file was deleted!
  ycnt8.exe
      [DETECTION] Is the Trojan horse TR/PSW.Nilage.bju.5
      [INFO]      The file was deleted!
  ycnt9.exe
      [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.1
      [INFO]      The file was deleted!


End of the scan: 2007年6月1日  11:58
Used time: 00:10 min

The scan has been done completely.

      1 Scanning directories
     11 Files were scanned
     10 viruses and/or unwanted programs were found
      0 classified as suspicious:
     10 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      0 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

aoyang

下载回来的样本都是大众快餐
你试一下运行主帖中的样本

jlennon

光辉超级灌水，一帖多样本会死人啊？[:27:]

aoyang

我失误了，原来N多都是重复的
不知道它下那么多重复的回来干什么 这个不能怪我 你也看见我的那扫描日志了。

The EQs

Scan performed at: 2007-6-2 3:44:37
Scanning Log
NOD32 version 2305 (20070601) NT
Command line: C:\Documents and Settings\EQ2\桌面\桌面
Operating memory - is OK

Date: 2.6.2007  Time: 03:44:41
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\桌面\
C:\Documents and Settings\EQ2\桌面\桌面\ycnt1.exe - a variant of Win32/PSW.Agent.NCC trojan
C:\Documents and Settings\EQ2\桌面\桌面\ycnt2.exe - probably a variant of Win32/PSW.Agent.NEC trojan
C:\Documents and Settings\EQ2\桌面\桌面\ycnt3.exe - a variant of Win32/Agent.NIK trojan
C:\Documents and Settings\EQ2\桌面\桌面\ycnt4.exe - a variant of Win32/PSW.Agent.NCC trojan
C:\Documents and Settings\EQ2\桌面\桌面\ycnt5.exe - a variant of Win32/PSW.Agent.NCC trojan
C:\Documents and Settings\EQ2\桌面\桌面\ycnt6.exe - Win32/PSW.Agent.NDF trojan - quarantined - unable to clean - deleted
C:\Documents and Settings\EQ2\桌面\桌面\ycnt7.exe - Win32/Agent.NIK trojan - quarantined - unable to clean - deleted
C:\Documents and Settings\EQ2\桌面\桌面\ycnt8.exe - a variant of Win32/PSW.Agent.NEW trojan
Number of scanned files: 11
Number of threats found: 8
Number of files cleaned: 8
Time of completion: 03:44:46 Total scanning time: 5 sec (00:00:05)

taihuxian

Virus: Trojan-PSW.Win32.Nilage.bcw

Virus found while downloading Web content.

Address: bbs.kafan.cn

红心王子

虽然多了一点，还是想测测斧头的实力
开始作业
砍12个
第一个包和剩余后面的几个

wangjay1980

12ge

remind_me

楼主到安全模式下 用SRE修复一下，然后手动锁定注册表，返回正常模式，还看不到隐藏文件么？

如果是还看不到的话，可能还有自动锁注册表的程序在。。。 仅仅是猜测。。。偶是新手。