一包4个 [MD5: 203A2B 1970D2 D2EFD3 52AC71]

wkwx

微点：

hj5abc

NOD32 杀了3个 ..
最后一个运行报 ..

不过.. 不报的那个

注册表增加键:63
主要是Winsock劫持..惨不忍睹的修改

文件增加:7
----------------------------------
C:\WINDOWS\system32\sporder.dll
C:\Documents and Settings\Administrator\Recent\1.lnk
C:\Documents and Settings\Administrator\桌面\1.PNG
C:\Program Files\ESET\cache\FND3.NFI
C:\Program Files\ESET\cache\FND4.NFI
C:\Program Files\ESET\infected\IV2I2MCA.NQF
C:\Program Files\ESET\infected\IV2I2MCA.NQI
----------------------------------
文件修改:7
----------------------------------
C:\WINDOWS\system32\config\system.LOG
C:\WINDOWS\system32\config\software.LOG
C:\WINDOWS\system32\config\SYSTEM
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012007060520070606\index.dat
C:\Documents and Settings\Administrator\ntuser.dat.LOG
C:\Program Files\ESET\logs\virlog.dat
C:\Program Files\ESET\cache\CACHE.NDB

NOD32只杀了个DLL..

蓝色牛仔裤

4个。。


[Scan path] C:\Documents and Settings\Administrator\桌面\样本.rar
>>C:\Documents and Settings\Administrator\桌面\样本.rar\45555_sn.exe infected with Trojan.PWS.GoldSpy
>>C:\Documents and Settings\Administrator\桌面\样本.rar\svchost.exe infected with BackDoor.IRC.Sdbot.1356
>C:\Documents and Settings\Administrator\桌面\样本.rar\zupastik.exe infected with Trojan.PWS.Lineage
>C:\Documents and Settings\Administrator\桌面\样本.rar\zzz.exe infected with Trojan.PWS.Lineage
C:\Documents and Settings\Administrator\桌面\样本.rar - archive contains infected objects

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 6
Infected objects found: 4
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 263 Kb/s
Scan time: 00:00:01

woai_jolin

ESS

2007/6/5 23:57:02        Scanning Log
2007/6/5 23:57:02        Version of virus signature database: 2309 (20070605)
2007/6/5 23:57:02        Date: 5.6.2007  Time: 23:57:02
2007/6/5 23:57:02        Scanned disks, folders and files: E:\病毒测试\
2007/6/5 23:57:06        E:\病毒测试\样本.rar - multiple threats - deleted
2007/6/5 23:57:06        E:\病毒测试\样本.rar » RAR » 45555_sn.exe - Win32/Spy.Goldun.NBC trojan
2007/6/5 23:57:06        E:\病毒测试\样本.rar » RAR » svchost.exe - a variant of Win32/PSW.Ceda trojan
2007/6/5 23:57:06        E:\病毒测试\样本.rar » RAR » zupastik.exe - Win32/Spy.BZub.NEG trojan
2007/6/5 23:57:06        Number of scanned files: 5
2007/6/5 23:57:06        Number of threats found: 3
2007/6/5 23:57:06        Time of completion: 23:57:06  Total scanning time: 4 sec (00:00:04)

1688388728

[MD5: 203A2B 1970D2 D2EFD3 52AC71]

onesand

tart of the scan: 2007年6月9日  11:40

Starting the file scan:

Begin scan in 'C:\Documents and Settings\huaxun\桌面\样本.rar'
C:\Documents and Settings\huaxun\桌面\
  样本.rar
    [0] Archive type: RAR
    --> 45555_sn.exe
        [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> svchost.exe
        [DETECTION] Contains signature of the worm WORM/IRCBot.32068
        [WARNING]   Infected files in archives cannot be repaired!
    --> zupastik.exe
        [DETECTION] Is the Trojan horse TR/Spy.Goldun.EZ.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> zzz.exe
        [DETECTION] Is the Trojan horse TR/Spy.BZub.IZ
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was moved to '46988874.qua'!


End of the scan: 2007年6月9日  11:40
Used time: 00:08 min