大众快餐[MD5: 0846FA 78DE06 F83598 84023F 1B0981]

The EQs

hkt988

deleted: Trojan program Backdoor.IRC.Zapchast        File: D:\下载文件夹\13.rar\script.ini
deleted: Trojan program Backdoor.IRC.Zapchast        File: D:\下载文件夹\13.rar\sup.reg
deleted: Trojan program Backdoor.Win32.mIRC-based        File: D:\下载文件夹\13.rar\svchost.exe
deleted: Trojan program Backdoor.IRC.Zapchast        File: D:\下载文件夹\13.rar\mirc.ini
[:27:]

1688388728

回复

dyw1021

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\13.rar'
C:\Documents and Settings\Administrator\桌面\13.rar
  [0] Archive type: RAR
  --> script.ini
      [DETECTION] Contains signature of the IRC virus IRC/Zapchast.M
  --> mirc.ini
      [DETECTION] Is the Trojan horse TR/IRC.Zapchast
      [INFO]      The file was moved to '46951813.qua'!


End of the scan: 2007年6月6日  11:24
Used time: 00:03 min

jlennon

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-6-6
Start time: 2007-6-7 5:20
Engine(s): KAV engine (AVK 17.5733), BD-Engine (BD 17.5315)
Heuristic: On
Archives: On
System areas: Off

Check selected directories and files...
Object: mirc.ini
        Path: C:\Documents and Settings\Administrator\桌面\13
        Status: Move file into quarantine
        Virus: Backdoor.IRC.Zapchast (KAV engine)
Object: script.ini
        Path: C:\Documents and Settings\Administrator\桌面\13
        Status: Move file into quarantine
        Virus: Backdoor.IRC.Zapchast (KAV engine), Backdoor.IRC.Zapchast.PO (BD-Engine)
Object: sup.bat
        Path: C:\Documents and Settings\Administrator\桌面\13
        Status: Move file into quarantine
        Virus: Trojan.Zapchas.F (BD-Engine)
Object: sup.reg
        Path: C:\Documents and Settings\Administrator\桌面\13
        Status: Virus removed
        Virus: Backdoor.IRC.Zapchast (KAV engine), Trojan.Zapchas.F (BD-Engine)
Object: svchost.exe
        Path: C:\Documents and Settings\Administrator\桌面\13
        Status: Move file into quarantine
        Virus: Backdoor.Win32.mIRC-based (KAV engine)
Analysis complete: 2007-6-7 5:20
    5 files checked
    5 infected files detected
    0 suspected files detected

taihuxian

Virus: Backdoor.IRC.Zapchast (3x), Backdoor.Win32.mIRC-based

Virus found while downloading Web content.

Address: bbs.kafan.cn

tracydk

哇,真是大新闻啊，AVAST的启发??基因启发??

woai_jolin

ess

2007/6/7 10:13:57        Scanning Log
2007/6/7 10:13:57        Version of virus signature database: 2314 (20070606)
2007/6/7 10:13:57        Date: 7.6.2007  Time: 10:13:57
2007/6/7 10:13:57        Scanned disks, folders and files: E:\病毒测试\
2007/6/7 10:14:00        E:\病毒测试\13.rar - multiple threats - deleted
2007/6/7 10:14:00        E:\病毒测试\13.rar » RAR » script.ini - probably a variant of IRC/Zapchast.J trojan
2007/6/7 10:14:00        E:\病毒测试\13.rar » RAR » sup.bat - IRC/Zapchast.H trojan
2007/6/7 10:14:00        E:\病毒测试\13.rar » RAR » sup.reg - IRC/Cloner.AT trojan
2007/6/7 10:14:00        E:\病毒测试\13.rar » RAR » mirc.ini - IRC/Zapchast trojan
2007/6/7 10:14:00        Number of scanned files: 6
2007/6/7 10:14:00        Number of threats found: 4
2007/6/7 10:14:00        Time of completion: 10:14:00  Total scanning time: 3 sec (00:00:03)

傻猪猪米走鸡

扫描开始时间: 2007-6-7 10:46:00
扫描日志
NOD32 版本 2314 (20070606) NT
命令行: D:\firefox下载的文件\13.rar
C:\Program Files\Eset\nod32.exe<病毒 - 正常>
物理磁盘 1 的 MBR 扇区，<病毒 - 正常>
物理磁盘 1 的活动引导扇区，<病毒 - 正常>
物理磁盘 2 的活动引导扇区，<病毒 - 正常>

日期: 2007年6月7日  时间: 10:46:03
反 Rookits 技术已启用。
已扫描磁盘、文件夹和文件: D:\firefox下载的文件\13.rar
D:\firefox下载的文件\13.rar ?RAR ?script.ini<病毒 - 可能是 IRC/Zapchast.J 木马 变种>
D:\firefox下载的文件\13.rar ?RAR ?sup.bat<病毒 - IRC/Zapchast.H 木马>
D:\firefox下载的文件\13.rar ?RAR ?sup.reg<病毒 - IRC/Cloner.AT 木马>
D:\firefox下载的文件\13.rar ?RAR ?svchost.exe<病毒 - 正常>
D:\firefox下载的文件\13.rar ?RAR ?mirc.ini<病毒 - IRC/Zapchast 木马>
D:\firefox下载的文件\13.rar:Zone.Identifier<病毒 - 正常>
已扫描文件数量: 6
已发现病毒数量: 4
完成时间: 10:46:04 总共扫描时间: 1 秒 (00:00:01)

那个svchost.exe有冇问题的啊？

carlcai

杀杀