Handydriver蠕虫一只，也挺腻味的

l784588

avast报 Win32:VB-DVC [Wrm].

蓝色牛仔裤

[Scan path] C:\Documents and Settings\Administrator\桌面\handydriver.rar
>C:\Documents and Settings\Administrator\桌面\handydriver.rar\handydriver.exe infected with Win32.HLLW.Chil
C:\Documents and Settings\Administrator\桌面\handydriver.rar - archive contains infected objects

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 3
Infected objects found: 1
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 93 Kb/s
Scan time: 00:00:00

woai_jolin

扫描开始时间: 2007/6/15 21:33:58
扫描日志
NOD32 版本 2332 (20070615) NT
命令行: D:\病毒测试\2007-06-14.rar
C:\Program Files\Eset\nod32.exe<病毒 - 正常>
物理磁盘 1 的 MBR 扇区，<病毒 - 正常>
物理磁盘 1 的活动引导扇区，<病毒 - 正常>

日期: 2007年6月15日  时间: 21:33:59
反 Rookits 技术已启用。
已扫描磁盘、文件夹和文件: D:\病毒测试\2007-06-14.rar
D:\病毒测试\2007-06-14.rar ?RAR ?handydriver.exe<病毒 - Win32/VB.FW 蠕虫> - 是删除目标的一部分
已扫描文件数量: 2
已发现病毒数量: 1
已清除病毒的文件数量: 1
完成时间: 21:33:59 总共扫描时间: 0 秒 (00:00:00)

taihuxian

Virus: Worm.Win32.VB.fw

Virus found while downloading Web content.

Address: bbs.kafan.cn

duandxxi

金山查到了

scottxzt

还是砍了。

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\handydriver.rar'
C:\Documents and Settings\Administrator\My Documents\
  handydriver.rar
    [0] Archive type: RAR
    --> handydriver.exe
        [DETECTION] Contains signature of the Windows virus W32/Dzan.a
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!

onesand

C:\Documents and Settings\huaxun\桌面\handydriver.rar
  [0] Archive type: RAR
  --> handydriver.exe
      [DETECTION] Contains signature of the Windows virus W32/Dzan.a
      [INFO]      The file was moved to '46e0adc2.qua'!