木马9个.rar

‹‹ 上一主题 | 下一主题 ››

木马名称:Trojan-Downloader.Win32.Agent.egt
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\木马9个\木马9个\QQ[2].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\木马9个\木马9个\DO[1].EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\木马9个\木马9个\M[1].EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\UPXDND.EXE
是否删除木马程序及其衍生物?

程序:
C:\WINNT\MPPDS.EXE
是否删除木马程序及其衍生物?

我是用微点来杀的。有几个杀不了。呵呵！

红伞全杀:
Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\木马9个.rar'
C:\Documents and Settings\Administrator\桌面\木马9个.rar
  [0] Archive type: RAR
  --> ľÂí9¸ö\cm[1].exe
      [DETECTION] Is the Trojan horse TR/Agent.20480.26
  --> ľÂí9¸ö\qq[2].exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> ľÂí9¸ö\20303[1].exe
      [DETECTION] Contains signature of the Ad- or Spyware ADSPY/NewWeb.W.1
  --> ľÂí9¸ö\do[1].exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> ľÂí9¸ö\w[1].exe
      [DETECTION] Is the Trojan horse TR/Agent.10240.21
  --> ľÂí9¸ö\cx[2].exe
      [DETECTION] Is the Trojan horse TR/Proxy.Delf.CA
  --> ľÂí9¸ö\r[1].exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> ľÂí9¸ö\m[1].exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> ľÂí9¸ö\q[1].exe
      [DETECTION] Is the Trojan horse TR/Proxy.Delf.CA
      [INFO]      A backup was created as '464a04df.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!


End of the scan: 2007年4月2日  10:29
Used time: 00:06 min

The scan has been done completely.

      0 Scanning directories
     11 Files were scanned
      9 viruses and/or unwanted programs were found
      1 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

用蜘蛛只能查出４个，包含一个疑似下载器

zlock2007  居然全miss

瑞星6月15日的病毒库可以查杀8个。

[attach]2866[/attach]

AntiVir PersonalEdition Classic
Report file date: 2007年7月19日  11:37

Scanning for 949171 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Username:         Administrator
Computer name:    DEEPIN-7070C11F

Version information:
BUILD.DAT    : 247           14437 Bytes   2007-5-10 11:55:00
AVSCAN.EXE   : 7.0.4.15     282664 Bytes   2007-4-20 23:09:38
AVSCAN.DLL   : 7.0.4.4       33832 Bytes   2007-3-27 05:31:54
LUKE.DLL     : 7.0.4.11     143400 Bytes   2007-3-27 05:26:04
LUKERES.DLL  : 7.0.4.0       10280 Bytes   2007-3-19 05:18:59
ANTIVIR0.VDF : 6.35.0.1    7371264 Bytes   2006-5-31 06:14:26
ANTIVIR1.VDF : 6.39.0.129  7251968 Bytes   2007-7-10 22:21:46
ANTIVIR2.VDF : 6.39.0.148   395776 Bytes   2007-7-16 23:42:35
ANTIVIR3.VDF : 6.39.0.163    82432 Bytes   2007-7-18 23:42:35
AVEWIN32.DLL : 7.4.0.44    2499072 Bytes   2007-7-18 23:42:35
AVWINLL.DLL  : 1.0.0.7       14376 Bytes   2007-2-26 03:36:26
AVPREF.DLL   : 7.0.2.1       24616 Bytes   2007-3-27 05:31:50
AVREP.DLL    : 7.0.0.1      155688 Bytes   2007-6-20 14:56:58
AVPACK32.DLL : 7.3.0.13     360488 Bytes   2007-6-27 13:14:00
AVREG.DLL    : 7.0.1.2       31784 Bytes   2007-3-15 02:05:08
AVEVTLOG.DLL : 7.0.0.18      86056 Bytes   2007-3-27 05:16:05
AVARKT.DLL   : 1.0.0.17     278568 Bytes    2007-5-8 13:12:14
NETNT.DLL    : 7.0.0.0        7720 Bytes    2007-3-8 04:09:42
RCIMAGE.DLL  : 7.0.1.15    2228264 Bytes   2007-3-13 03:46:18
RCTEXT.DLL   : 7.0.45.0      86056 Bytes   2007-3-19 05:42:42

Configuration settings for the scan:
Jobname..........................: ShlExt
Configuration file...............: D:DOCUME~1ADMINI~1LOCALS~1Tempd52b3b0e.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: D:,
Scan memory......................: on
Process scan.....................: off
Scan registry....................: off
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: 2007年7月19日  11:37

Starting the file scan:

Begin scan in 'D:Documents and SettingsAdministratorMy DocumentsDownloadsCompressed木马9个.rar'
D:Documents and SettingsAdministratorMy DocumentsDownloadsCompressed木马9个.rar
  [0] Archive type: RAR
  --> ľÂí9¸öcm[1].exe
      [DETECTION] Is the Trojan horse TR/Agent.20480.26
  --> ľÂí9¸öqq[2].exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.VO.8
  --> ľÂí9¸ödo[1].exe
      [DETECTION] Contains signature of the Windows virus W32/Viking.B
  --> ľÂí9¸öw[1].exe
      [DETECTION] Is the Trojan horse TR/Agent.10240.21
  --> ľÂí9¸öcx[2].exe
      [DETECTION] Is the Trojan horse TR/Dldr.Harnig.8
  --> ľÂí9¸ör[1].exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ES.1712
  --> ľÂí9¸öm[1].exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.KW.116
  --> ľÂí9¸öq[1].exe
      [DETECTION] Is the Trojan horse TR/Dldr.Harnig.8
      [INFO]      The file was moved to '46d876fb.qua'!


End of the scan: 2007年7月19日  11:37
Used time: 00:08 min

The scan has been done completely.

      0 Scanning directories
     10 Files were scanned
      8 viruses and/or unwanted programs were found
      0 classified as suspicious:
      0 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found