刚提取的生成物

scottxzt

LOOK

qq890

已删除: 木马程序 Backdoor.Win32.Haxdoor.gm        文件: C:\Documents and Settings\admin\桌面\新建文件夹.rar/新建文件夹\avpe64.sys
已删除: 木马程序 Backdoor.Win32.Haxdoor.gm        文件: C:\Documents and Settings\admin\桌面\新建文件夹.rar/新建文件夹\qz.sys
卡吧

promised

通杀
License expired
License #000000119 Valid till 2006-12-31
Demo mode
Command line options:
/r=susp.rpt /ha=3 /collect_suspects /nc /af+ /ar+ /bt- /mr- /ml+ /rw+ /as-
Ctrl-C will terminate program execution

*:
C:\
C:\ABC\...\新建文件夹\avpe64.sys : is suspected of Trojan-Downloader.Agent.82
C:\ABC\...\新建文件夹\qz.sys : is suspected of Trojan-Downloader.Agent.82
C:\ABC\新建文件夹.rar:<RAR>\...\avpe32.dll : is suspected of Downloader.Small.6
Program execution terminated by user


Directories       : 4       Files in archives:      Files on disks:
Archives:                   - total       : 7       - total       : 30
- scanned         : 4       -  scanned    : 7       - scanned     : 30
- contain viruses : 0       -  infected   : 0       - infected    : 0
- deleted         : 0       -  suspicious : 3       - suspicious  : 1

Startup    : 16:42:46 03-06-2007
End        : 16:42:53 03-06-2007
Total time : 00:00:07
终止批处理操作吗(Y/N)?

tracydk

拦截了

harrystopet

瑞星两个都杀,报backdoor.haxdoor!

The EQs

Scan performed at: 2007-6-3 16:46:34
Scanning Log
NOD32 version 2305 (20070601) NT
Command line: C:\Documents and Settings\EQ2\桌面\新建文件夹.rar
Operating memory - is OK

Date: 3.6.2007  Time: 16:46:38
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\新建文件夹.rar
C:\Documents and Settings\EQ2\桌面\新建文件夹.rar ?RAR ?新建文件夹\avpe64.sys - a variant of Win32/Haxdoor trojan
C:\Documents and Settings\EQ2\桌面\新建文件夹.rar ?RAR ?新建文件夹\qz.sys - a variant of Win32/Haxdoor trojan
C:\Documents and Settings\EQ2\桌面\新建文件夹.rar ?RAR ?新建文件夹\avpe32.dll - a variant of Win32/Haxdoor trojan
Number of scanned files: 4
Number of threats found: 3
Number of files cleaned: 1
Time of completion: 16:46:39 Total scanning time: 1 sec (00:00:01)

欠妳緈諨

哈克斯

taihuxian

Virus: Backdoor.Win32.Haxdoor.gm (2x), Backdoor.Win32.Haxdoor.hn

Virus found while downloading Web content.

Address: bbs.kafan.cn

dikex

http://bbs.kafan.cn/viewthread.php?tid=92661&extra=page%3D1


里面那个下载者下载的东西生成的，那驱动级的东西被它运行后要手工清理有点麻烦（panda的那个反rootkit工具可以）

zengmingwh

红伞全歼啦。