[凝逸.扫描记录]MD5[DF0B41 6FA937 9C81AF 90F994 FFC678 DD6781 6D1211 ...]

qqq000@qq.com

[凝逸.扫描记录]
MD5[DF0B41 6FA937 9C81AF 90F994 FFC678 DD6781 6D1211 3F5DBF 2C91FF 7F5FA3 FAAB70 46654D 2C91FF F1184A 597610 446C5F 94F0EB CCEC0D 2C91FF 479A76 3F5AE9 88C849 9144CF 727C22 43D9C9 0A1D2E 60503B 7351F1 F83F4A 835748 E80274 df0b41 6fa937 90f994 ffc678 dd6781 6d1211 3f5dbf 2c91ff 7f5fa3 46654d 2c91ff f1184a 597610 446c5f 94f0eb ccec0d 2c91ff 479a76 3f5ae9 88c849 9144cf 727c22 43d9c9 0a1d2e 60503b 7351f1 f83f4a e80274 ]
f:\未知\01\1\DF0B41_0(1).exe,木马
f:\未知\01\1\6FA937_simple~1.exe,木马
f:\未知\01\1\9C81AF_3.exe,木马
f:\未知\01\1\90F994_ad2072.exe,木马
f:\未知\01\1\FFC678_123(1).exe,木马
f:\未知\01\1\DD6781_d(1).exe,木马
f:\未知\01\1\6D1211_winlogin.exe,木马
f:\未知\01\1\3F5DBF_intranet.exe,木马
f:\未知\01\1\2C91FF_xxxx.exe,木马
f:\未知\01\1\7F5FA3_shang.exe,木马
f:\未知\01\1\FAAB70_0.exe,木马
f:\未知\01\1\46654D_tx2cs.exe,木马
f:\未知\01\1\2C91FF_xx.exe,木马
f:\未知\01\1\F1184A_down(3).exe,木马
f:\未知\01\1\597610_zbox2.exe,木马
f:\未知\01\1\446C5F_ad1939.exe,木马
f:\未知\01\1\94F0EB_xuik.exe,木马
f:\未知\01\1\CCEC0D_a.exe,木马
f:\未知\01\1\2C91FF_1(10).exe,木马
f:\未知\01\1\479A76_1(2).exe,木马
f:\未知\01\1\3F5AE9_14.exe,木马
f:\未知\01\1\88C849_ztjh.exe,木马
f:\未知\01\1\9144CF_ad967.exe,木马
f:\未知\01\1\727C22_12.exe,木马
f:\未知\01\1\43D9C9_svchost2.exe,木马
f:\未知\01\1\0A1D2E_3(1).exe,木马
f:\未知\01\1\60503B_mac.exe,木马
f:\未知\01\1\7351F1_ad1697.exe,木马
f:\未知\01\1\F83F4A_mm.exe,木马
f:\未知\01\1\835748_bind_50077.exe,木马
f:\未知\01\1\E80274_taskmor.exe,木马
f:\未知\01\1\df0b41_0(1).exe,木马
f:\未知\01\1\6fa937_simple~1.exe,木马
f:\未知\01\1\90f994_ad2072.exe,木马
f:\未知\01\1\ffc678_123(1).exe,木马
f:\未知\01\1\dd6781_d(1).exe,木马
f:\未知\01\1\6d1211_winlogin.exe,木马
f:\未知\01\1\3f5dbf_intranet.exe,木马
f:\未知\01\1\2c91ff_xxxx.exe,木马
f:\未知\01\1\7f5fa3_shang.exe,木马
f:\未知\01\1\46654d_tx2cs.exe,木马
f:\未知\01\1\2c91ff_xx.exe,木马
f:\未知\01\1\f1184a_down(3).exe,木马
f:\未知\01\1\597610_zbox2.exe,木马
f:\未知\01\1\446c5f_ad1939.exe,木马
f:\未知\01\1\94f0eb_xuik.exe,木马
f:\未知\01\1\ccec0d_a.exe,木马
f:\未知\01\1\2c91ff_1(10).exe,木马
f:\未知\01\1\479a76_1(2).exe,木马
f:\未知\01\1\3f5ae9_14.exe,木马
f:\未知\01\1\88c849_ztjh.exe,木马
f:\未知\01\1\9144cf_ad967.exe,木马
f:\未知\01\1\727c22_12.exe,木马
f:\未知\01\1\43d9c9_svchost2.exe,木马
f:\未知\01\1\0a1d2e_3(1).exe,木马
f:\未知\01\1\60503b_mac.exe,木马
f:\未知\01\1\7351f1_ad1697.exe,木马
f:\未知\01\1\f83f4a_mm.exe,木马
f:\未知\01\1\e80274_taskmor.exe,木马
感染:59/文件:59
扫描完成|文件:59|耗时:2974

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\01\1'
C:\Documents and Settings\Administrator\My Documents\01\1\
  0(1).exe
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
      [WARNING]   The file was ignored!
  0.exe
      [DETECTION] Is the Trojan horse TR/PSW.Delf.QC.48
      [WARNING]   The file was ignored!
  1(10).exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [WARNING]   The file was ignored!
  1(2).exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLine.WY.11
      [WARNING]   The file was ignored!
  12.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [WARNING]   The file was ignored!
  123(1).exe
  14.exe
  3(1).exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLine.WY.11
      [WARNING]   The file was ignored!
  3.exe
      [DETECTION] Is the Trojan horse TR/PSW.Delf.QC.39
      [WARNING]   The file was ignored!
  a.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!
  ad1697.exe
  ad1939.exe
  ad2072.exe
  ad967.exe
  bind_50077.exe
      [DETECTION] Is the Trojan horse TR/Agent.24576.122
      [WARNING]   The file was ignored!
  d(1).exe
  down(3).exe
  intranet.exe
  mac.exe
      [DETECTION] Is the Trojan horse TR/Delf.NEG.5
      [WARNING]   The file was ignored!
  mm.exe
      [DETECTION] Is the Trojan horse TR/PSW.Steal.26481.1
      [WARNING]   The file was ignored!
  shang.exe
      [DETECTION] Contains signature of the dropper DR/PcClient.Gen
      [WARNING]   The file was ignored!
  SIMPLE~1.EXE
      [DETECTION] Is the Trojan horse TR/Drop.Small.ASE.21
      [WARNING]   The file was ignored!
  svchost2.exe
  taskmor.exe
  tx2cs.exe
      [DETECTION] Is the Trojan horse TR/Agent.34708.B
      [WARNING]   The file was ignored!
  winlogin.exe
  xuik.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [WARNING]   The file was ignored!
  xx.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [WARNING]   The file was ignored!
  xxxx.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [WARNING]   The file was ignored!
  zbox2.exe
  ztjh.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [WARNING]   The file was ignored!


End of the scan: 2007年6月17日  16:38
Used time: 00:14 min

The scan has been done completely.

      1 Scanning directories
     31 Files were scanned
     18 viruses and/or unwanted programs were found
      1 classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     12 Files not concerned
      0 Archives were scanned
     18 Warnings
      0 Notes
      0 Hidden objects were found

扫描日志
NOD32版本 2335 (20070616) NT
命令行： C:\Documents and Settings\Administrator\My  ?
?Documents\01\1
正在检查NOD32.EXE文件的CRC：状态正常
D:\Eset\nod32.exe - 是正常的
扫描系统内存中：没有进行 (选项已关闭)
扫描MBR及引导区中：没有进行 (选项已关闭)
日期： 17.6.2007  时间：16:38:54
已关闭反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\ ?
?Administrator\My Documents\01\1\
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?0(1).exe - Win32/PSW.Delf.NHI 木马
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?0.exe - Win32/PSW.Delf.NHI 木马的变种
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?1(10).exe - Win32/PSW.Delf.NHI 木马的变种
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?1(2).exe - 是正常的
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?12.exe - Win32/Pacex.Gen 病毒
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?123(1).exe - 是正常的
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?14.exe - 是正常的
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?3(1).exe - 是正常的
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?3.exe - Win32/PSW.Delf.NHI 木马的变种
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?a.exe - 可能是 Win32/PSW.QQPass.VD 木马 的一个变种
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?ad1697.exe >>NSIS >>cpush.dll - Win32/Adware.BHO.AV  ?
?应用程序
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?ad1939.exe >>NSIS >>cpush.dll - Win32/Adware.BHO.AV  ?
?应用程序
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?ad2072.exe >>NSIS >>cpush.dll - Win32/Adware.BHO.AV  ?
?应用程序
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?ad967.exe >>NSIS >>cpush.dll - Win32/Adware.BHO.AV  ?
?应用程序
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?bind_50077.exe - 是正常的
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?d(1).exe - 是正常的
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?down(3).exe - 是正常的
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?intranet.exe >>ASPack v2.12 - 是正常的
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?mac.exe - 可能是 Win32/Genetik 木马 的一个变种
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?mm.exe - Win32/PSW.Delf.NHI 木马的变种
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?shang.exe - 是正常的
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?SIMPLE~1.EXE - 是正常的
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?svchost2.exe >>NSIS >>System.dll - 是正常的
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?svchost2.exe >>NSIS >>1115.exe >>NSIS >>System.dll -  ?
?是正常的
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?svchost2.exe >>NSIS >>1115.exe >>NSIS >>DoSSSetup.dll -  ?
?是正常的
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?svchost2.exe >>NSIS >>1115.exe >>NSIS >>acpidisk.sys -  ?
?Win32/Adware.Cinmus 应用程序的变种
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?taskmor.exe >>ASPack v2.12 - 是正常的
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?tx2cs.exe - Win32/PSW.Agent.NDP 木马的变种
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?winlogin.exe >>ASPack v2.12 - 是正常的
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?xuik.exe - 可能是 Win32/Genetik 木马 的一个变种
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?xx.exe - Win32/PSW.Delf.NHI 木马的变种
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?xxxx.exe - Win32/PSW.Delf.NHI 木马的变种
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?zbox2.exe >>ASPack v2.12 - 是正常的
C:\Documents and Settings\Administrator\My Documents\01\1\ ?
?ztjh.exe >>ASPack v2.12 - 是正常的
已扫描的文件数目：34
已发现的病毒数目：17
完成时间： 16:39:18 总扫描时间：24 秒 (00:00:24)

[Scan path] C:\Documents and Settings\Administrator\My Documents\01\1
C:\Documents and Settings\Administrator\My Documents\01\1\0(1).exe infected with Win32.HLLW.Autoruner.146
>C:\Documents and Settings\Administrator\My Documents\01\1\0.exe infected with Trojan.PWS.Gamania
>C:\Documents and Settings\Administrator\My Documents\01\1\1(10).exe infected with Trojan.PWS.Gamania
>C:\Documents and Settings\Administrator\My Documents\01\1\1(2).exe - Ok
C:\Documents and Settings\Administrator\My Documents\01\1\12.exe - Ok
>>>C:\Documents and Settings\Administrator\My Documents\01\1\123(1).exe\SIMPLE~1.EXE - Ok
>C:\Documents and Settings\Administrator\My Documents\01\1\123(1).exe\prot765.exe infected with BackDoor.WebDor
C:\Documents and Settings\Administrator\My Documents\01\1\123(1).exe - archive contains infected objects
>C:\Documents and Settings\Administrator\My Documents\01\1\14.exe\Script.0 - Ok
C:\Documents and Settings\Administrator\My Documents\01\1\14.exe - Ok
>C:\Documents and Settings\Administrator\My Documents\01\1\3(1).exe - Ok
>>C:\Documents and Settings\Administrator\My Documents\01\1\3.exe infected with Trojan.PWS.Gamania.origin
>>C:\Documents and Settings\Administrator\My Documents\01\1\a.exe infected with Trojan.PWS.Qqpass.origin
>>C:\Documents and Settings\Administrator\My Documents\01\1\ad1697.exe\data001 is an adware program Adware.Sogou.origin
>C:\Documents and Settings\Administrator\My Documents\01\1\ad1697.exe\data002 - Ok
>C:\Documents and Settings\Administrator\My Documents\01\1\ad1697.exe\data003 - Ok
C:\Documents and Settings\Administrator\My Documents\01\1\ad1697.exe - archive contains infected objects
>>C:\Documents and Settings\Administrator\My Documents\01\1\ad1939.exe\data001 is an adware program Adware.Sogou.origin
>C:\Documents and Settings\Administrator\My Documents\01\1\ad1939.exe\data002 - Ok
>C:\Documents and Settings\Administrator\My Documents\01\1\ad1939.exe\data003 - Ok
C:\Documents and Settings\Administrator\My Documents\01\1\ad1939.exe - archive contains infected objects
>>C:\Documents and Settings\Administrator\My Documents\01\1\ad2072.exe\data001 is an adware program Adware.Sogou.origin
>C:\Documents and Settings\Administrator\My Documents\01\1\ad2072.exe\data002 - Ok
>C:\Documents and Settings\Administrator\My Documents\01\1\ad2072.exe\data003 - Ok
C:\Documents and Settings\Administrator\My Documents\01\1\ad2072.exe - archive contains infected objects
>>C:\Documents and Settings\Administrator\My Documents\01\1\ad967.exe\data001 is an adware program Adware.Sogou.origin
>C:\Documents and Settings\Administrator\My Documents\01\1\ad967.exe\data002 - Ok
>C:\Documents and Settings\Administrator\My Documents\01\1\ad967.exe\data003 - Ok
C:\Documents and Settings\Administrator\My Documents\01\1\ad967.exe - archive contains infected objects
C:\Documents and Settings\Administrator\My Documents\01\1\bind_50077.exe infected with Trojan.DownLoader.24071
>C:\Documents and Settings\Administrator\My Documents\01\1\d(1).exe\Script.0 - Ok
C:\Documents and Settings\Administrator\My Documents\01\1\d(1).exe - Ok
>C:\Documents and Settings\Administrator\My Documents\01\1\down(3).exe\Script.0 - Ok
C:\Documents and Settings\Administrator\My Documents\01\1\down(3).exe - Ok
>C:\Documents and Settings\Administrator\My Documents\01\1\intranet.exe - Ok
>C:\Documents and Settings\Administrator\My Documents\01\1\mac.exe infected with BackDoor.Beizhu
>>C:\Documents and Settings\Administrator\My Documents\01\1\mm.exe infected with Trojan.PWS.Gamania
C:\Documents and Settings\Administrator\My Documents\01\1\shang.exe - Ok
>>C:\Documents and Settings\Administrator\My Documents\01\1\SIMPLE~1.EXE - Ok
>>C:\Documents and Settings\Administrator\My Documents\01\1\svchost2.exe\data001 - Ok
>C:\Documents and Settings\Administrator\My Documents\01\1\svchost2.exe\data002 - Ok
>>>C:\Documents and Settings\Administrator\My Documents\01\1\svchost2.exe\data003\data001 - Ok
>>C:\Documents and Settings\Administrator\My Documents\01\1\svchost2.exe\data003\data002 - Ok
>>C:\Documents and Settings\Administrator\My Documents\01\1\svchost2.exe\data003\data003 - Ok
>>C:\Documents and Settings\Administrator\My Documents\01\1\svchost2.exe\data003\data004 - Ok
>C:\Documents and Settings\Administrator\My Documents\01\1\svchost2.exe\data003 - Ok
C:\Documents and Settings\Administrator\My Documents\01\1\svchost2.exe - Ok
>C:\Documents and Settings\Administrator\My Documents\01\1\taskmor.exe - Ok
>C:\Documents and Settings\Administrator\My Documents\01\1\tx2cs.exe - Ok
>C:\Documents and Settings\Administrator\My Documents\01\1\winlogin.exe - Ok
>C:\Documents and Settings\Administrator\My Documents\01\1\xuik.exe - Ok
>C:\Documents and Settings\Administrator\My Documents\01\1\xx.exe infected with Trojan.PWS.Gamania
>C:\Documents and Settings\Administrator\My Documents\01\1\xxxx.exe infected with Trojan.PWS.Gamania
>C:\Documents and Settings\Administrator\My Documents\01\1\zbox2.exe - Ok
>C:\Documents and Settings\Administrator\My Documents\01\1\ztjh.exe - Ok

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 43
Infected objects found: 11
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 4
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 272 Kb/s
Scan time: 00:00:11

红心王子

3，6不报
剩下的KV70%截获
LZ发的样本有的好像重了

wangjay1980

deleted: virus Virus.Win32.AutoRun.bv        File: C:\Documents and Settings\Owner\×ÀÃæ\01\1\0(1).exe//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-PSW.Win32.Delf.qc        File: C:\Documents and Settings\Owner\×ÀÃæ\01\1\3.exe//UPX
deleted: adware not-a-virus:AdWare.Win32.BHO.av        File: C:\Documents and Settings\Owner\×ÀÃæ\01\1\ad2072.exe//stream//data0001
deleted: Trojan program Trojan-Clicker.Win32.Chimoz.ak        File: C:\Documents and Settings\Owner\×ÀÃæ\01\1\winlogin.exe//ASPack
deleted: Trojan program Trojan-PSW.Win32.Delf.qc        File: C:\Documents and Settings\Owner\×ÀÃæ\01\1\0.exe//UPX
deleted: adware not-a-virus:AdWare.Win32.BHO.av        File: C:\Documents and Settings\Owner\×ÀÃæ\01\1\ad1939.exe//stream//data0001
deleted: Trojan program Trojan-PSW.Win32.QQPass.wm        File: C:\Documents and Settings\Owner\×ÀÃæ\01\1\a.exe//UPX
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.wy        File: C:\Documents and Settings\Owner\×ÀÃæ\01\1\1(2).exe
deleted: Trojan program Trojan-PSW.Win32.Nilage.aeg        File: C:\Documents and Settings\Owner\×ÀÃæ\01\1\ztjh.exe//ASPack
deleted: adware not-a-virus:AdWare.Win32.BHO.av        File: C:\Documents and Settings\Owner\×ÀÃæ\01\1\ad967.exe//stream
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.qv        File: C:\Documents and Settings\Owner\×ÀÃæ\01\1\12.exe
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.wy        File: C:\Documents and Settings\Owner\×ÀÃæ\01\1\3(1).exe
deleted: adware not-a-virus:AdWare.Win32.BHO.av        File: C:\Documents and Settings\Owner\×ÀÃæ\01\1\ad1697.exe//stream//data0001
deleted: Trojan program Trojan-PSW.Win32.Delf.qc        File: C:\Documents and Settings\Owner\×ÀÃæ\01\1\mm.exe//UPX
deleted: Trojan program Trojan-Clicker.Win32.Chimoz.ak        File: C:\Documents and Settings\Owner\×ÀÃæ\01\1\taskmor.exe//ASPack
detected: Trojan program Trojan-PSW.Win32.Delf.qc File: C:\Documents and Settings\Owner\×ÀÃæ\01\1\xxxx.exe//NEWINFO.BMP
detected: virus Invader (modification) File: C:\Documents and Settings\Owner\×ÀÃæ\01\1\tx2cs.exe
detected: Trojan program Trojan-PSW.Win32.Delf.qc File: C:\Documents and Settings\Owner\×ÀÃæ\01\1\xx.exe//NEWINFO.BMP
detected: Trojan program Trojan-PSW.Win32.Delf.qc File: C:\Documents and Settings\Owner\×ÀÃæ\01\1\1(10).exe//NEWINFO.BMP
detected: Trojan program Backdoor.Win32.Hupigon.ene File: C:\Documents and Settings\Owner\×ÀÃæ\01\1\mac.exe//SYST.DLL
detected: virus Trojan.Generic File: C:\Documents and Settings\Owner\×ÀÃæ\01\1\mac.exe

[ 本帖最后由 wangjay1980 于 2007-6-18 08:42 编辑 ]