AD39DB 351EF9 EEBA88 68FF6D 78E19C 46149B 7331A5

qqq000@qq.com

AD39DB 351EF9 EEBA88 68FF6D 78E19C 46149B 7331A5

jlennon

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-6-6
Start time: 2005-6-6 17:27
Engine(s): KAV engine (AVK 17.5733), BD-Engine (BD 17.5315)
Heuristic: On
Archives: On
System areas: Off

Check selected directories and files...
Object: stream/data0001 data0003
        In archive: C:\Documents and Settings\Administrator\桌面\雷之源[1]\lh02.exe
        Status: Virus detected
        Virus: Trojan.Win32.Qhost.ir (KAV engine)
Object: stream/data0001 data0004
        In archive: C:\Documents and Settings\Administrator\桌面\雷之源[1]\lh02.exe
        Status: Virus detected
        Virus: Trojan.VBS.RotNet.a (KAV engine)
Object: stream/data0001 data0005
        In archive: C:\Documents and Settings\Administrator\桌面\雷之源[1]\lh02.exe
        Status: Virus detected
        Virus: not-a-virus:AdWare.Win32.AdMedia.k (KAV engine)
Object: (NSIS o)=>lzma_solid_nsis0001=>(NSIS o) lzma_nsis0002
        In archive: C:\Documents and Settings\Administrator\桌面\雷之源[1]\lh02.exe
        Status: Virus detected
        Virus: Trojan.QHost.CX (BD-Engine)
Object: (NSIS o)=>lzma_solid_nsis0001=>(NSIS o) lzma_nsis0003
        In archive: C:\Documents and Settings\Administrator\桌面\雷之源[1]\lh02.exe
        Status: Virus detected
        Virus: Trojan.Vbs.Rotnet.A (BD-Engine)
Object: lh02.exe
        Path: C:\Documents and Settings\Administrator\桌面\雷之源[1]
        Status: Move file into quarantine
        Virus: Trojan.Win32.Qhost.ir, Trojan.VBS.RotNet.a, not-a-virus:AdWare.Win32.AdMedia.k (KAV engine), Trojan.QHost.CX, Trojan.Vbs.Rotnet.A (BD-Engine)
Object: lservice.exe
        Path: C:\Documents and Settings\Administrator\桌面\雷之源[1]
        Status: Move file into quarantine
        Virus: Trojan-Downloader.Win32.Agent.arm (KAV engine), Trojan.Downloader.Agent.ARM (BD-Engine)
Object: RRToday.dll
        Path: C:\Documents and Settings\Administrator\桌面\雷之源[1]
        Status: Move file into quarantine
        Virus: not-a-virus:AdWare.Win32.Dm.ab (KAV engine)
Object: data0003
        In archive: C:\Documents and Settings\Administrator\桌面\雷之源[1]\sms.exe
        Status: Virus detected
        Virus: Trojan.Win32.Qhost.ir (KAV engine)
Object: data0004
        In archive: C:\Documents and Settings\Administrator\桌面\雷之源[1]\sms.exe
        Status: Virus detected
        Virus: Trojan.VBS.RotNet.a (KAV engine)
Object: data0005
        In archive: C:\Documents and Settings\Administrator\桌面\雷之源[1]\sms.exe
        Status: Virus detected
        Virus: not-a-virus:AdWare.Win32.AdMedia.k (KAV engine)
Object: (NSIS o) lzma_nsis0002
        In archive: C:\Documents and Settings\Administrator\桌面\雷之源[1]\sms.exe
        Status: Virus detected
        Virus: Trojan.QHost.CX (BD-Engine)
Object: (NSIS o) lzma_nsis0003
        In archive: C:\Documents and Settings\Administrator\桌面\雷之源[1]\sms.exe
        Status: Virus detected
        Virus: Trojan.Vbs.Rotnet.A (BD-Engine)
Object: sms.exe
        Path: C:\Documents and Settings\Administrator\桌面\雷之源[1]
        Status: Move file into quarantine
        Virus: Trojan.Win32.Qhost.ir, Trojan.VBS.RotNet.a, not-a-virus:AdWare.Win32.AdMedia.k (KAV engine), Trojan.QHost.CX, Trojan.Vbs.Rotnet.A (BD-Engine)
Analysis complete: 2005-6-6 17:28
    6 files checked
    4 infected files detected
    0 suspected files detected

wangjay1980

detected: Trojan program Trojan-Downloader.Win32.Agent.arm        File: E:\Ñù±¾\bingdu\lservice.exe
detected: Trojan program Trojan.Win32.Qhost.ir        File: E:\Ñù±¾\bingdu\lh02.exe//stream//data0001//data0003
detected: Trojan program Trojan.VBS.RotNet.a        File: E:\Ñù±¾\bingdu\lh02.exe//stream//data0001//data0004
detected: adware not-a-virus:AdWare.Win32.AdMedia.k        File: E:\Ñù±¾\bingdu\lh02.exe//stream//data0001//data0005
detected: adware not-a-virus:AdWare.Win32.Dm.ab        File: E:\Ñù±¾\bingdu\RRToday.dll
detected: Trojan program not-a-virus:AdWare.Win32.AdMedia.k        File: E:\Ñù±¾\bingdu\sms.exe

scottxzt

Begin scan in 'D:\Documents and Settings\dell\桌面\新建文件夹 (2)'
D:\Documents and Settings\dell\桌面\新建文件夹 (2)\
D:\Documents and Settings\dell\桌面\新建文件夹 (2)\sms.exe
      [DETECTION] Contains signature of the dropper DR/Qhost.IR.6
      [INFO]      The file was successfully wiped!
      [INFO]      The file was deleted!
D:\Documents and Settings\dell\桌面\新建文件夹 (2)\lservice.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.arm
      [INFO]      The file was successfully wiped!
      [INFO]      The file was deleted!


End of the scan: 2005年6月6日  17:40
Used time: 00:11 min

The scan has been done completely.

      1 Scanning directories
      6 Files were scanned
      2 viruses and/or unwanted programs were found

woai_jolin

ESS

2007/6/6 17:43:57        Scanning Log
2007/6/6 17:43:57        Version of virus signature database: 2312 (20070606)
2007/6/6 17:43:57        Date: 6.6.2007  Time: 17:43:56
2007/6/6 17:43:57        Scanned disks, folders and files: E:\
2007/6/6 17:44:01        E:\病毒测试\雷之源.part1.rar - multiple threats - deleted
2007/6/6 17:44:01        E:\病毒测试\雷之源.part1.rar » RAR » lservice.exe - Win32/TrojanDownloader.Agent.ARM trojan
2007/6/6 17:44:01        E:\病毒测试\雷之源.part1.rar » RAR » lh02.exe - Win32/Qhost.IR trojan
2007/6/6 17:44:01        E:\病毒测试\雷之源.part1.rar » RAR » lh02.exe » NSIS:SFX=32768 » sms.exe - Win32/Qhost.IR trojan
2007/6/6 17:44:01        E:\病毒测试\雷之源.part1.rar » RAR » lh02.exe » NSIS:SFX=32768 » sms.exe » NSIS:SFX=59904 » hosts - Win32/Qhost.IR trojan
2007/6/6 17:44:01        E:\病毒测试\雷之源.part1.rar » RAR » RRToday.dll - next archive volume not found
2007/6/6 17:44:02        Number of scanned files: 10
2007/6/6 17:44:02        Number of threats found: 2
2007/6/6 17:44:02        Time of completion: 17:44:02  Total scanning time: 6 sec (00:00:06)

蓝色牛仔裤

蜘蛛全过了！好家伙。。上报喽

moonsilver

RS 4个

taihuxian

Virus: Trojan-Downloader.Win32.Agent.arm
File: opr000GX.rar
Directory: C:\Documents and Settings\Administrator\Application Data\Opera\Opera\profile\cache4
Process: Opera.exe

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\雷之源'
C:\Documents and Settings\Administrator\My Documents\雷之源\
  lh02.exe
      [DETECTION] Contains signature of the dropper DR/Qhost.IR.7
      [INFO]      The file was deleted!
  lservice.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.arm
      [INFO]      The file was deleted!
  Rar.exe
  RRToday.dll
      [DETECTION] Contains signature of the Ad- or Spyware ADSPY/Dm.AB
      [INFO]      The file was deleted!
  sms.exe
      [DETECTION] Contains signature of the dropper DR/Qhost.IR.6
      [INFO]      The file was deleted!
  雷之源.exe