被远程操控微点截获的木马X4

显示全部楼层 · 发表于 2009-7-8 16:43:53

微点很猛，刚才电脑被黑客远程操控，植入6只木马，都被微点干掉啦~！！！！！！！

显示全部楼层 · 发表于 2009-7-8 16:45:20

McAfee 已自动阻止并隔离计算机上感染病毒的文件。您可以在 SecurityCenter 的“恢复”窗格中恢复隔离的文件。

关于此特洛伊木马程序
已检测到: New Malware.aq (特洛伊木马程序)
隔离来源: C:\Documents and Settings\Administrator\桌面\新建文件夹\样本一\1.EXE

关于此特洛伊木马程序
已检测到: Generic!atr (特洛伊木马程序)
位置: C:\Documents and Settings\Administrator\桌面\新建文件夹\样本二\autorun.inf

关于此特洛伊木马程序
已检测到: Generic Dropper.gf (特洛伊木马程序), Generic Dropper.gf (特洛伊木马程序)
位置: C:\Documents and Settings\Administrator\桌面\新建文件夹\样本三\PHPQ.DLL

咖啡missed one

显示全部楼层 · 发表于 2009-7-8 16:45:25

IKARUS - T3SCAN V1.32.10.0 (WIN32)
      T3 V1.01.64
      Copyright (c) 2006 - 2009 by Ikarus Software.
      All rights reserved.

Signature-database from 8.7.2009 08:01:16 (Build: 72998)

e:\4\PHPQ.DLL - Signature 'Trojan.Win32.Dogrobot' found
e:\4\1.EXE - Signature 'Trojan-Dropper.Agent' found
e:\4\autorun.inf - Signature 'Win32.SuspectCrc' found
e:\4\FUNC.DLL - Signature 'Virus.Win32.Agent.BQC' found

      4 Files scanned
      (0 Archives with 0 files)
      4 Signatures found
      0 Suspect code-parts found
      Used time: 0:00.016

显示全部楼层 · 发表于 2009-7-8 16:46:02

autorun.inf就不用发了吧。。。

显示全部楼层 · 发表于 2009-7-8 16:49:43

to kaba kill.

显示全部楼层 · 发表于 2009-7-8 16:55:36

autorun.inf - Win32/AutoRun.Agent.PG 蠕虫 - 是已删除对象的一部分
PHPQ.DLL - Win32/AutoRun.Agent.NP 蠕虫的变种 - 是已删除对象的一部分
1.EXE - 可能是 Win32/AutoRun.KillAV.A 蠕虫的变种 - 是已删除对象的一部分

显示全部楼层 · 发表于 2009-7-8 17:34:17

显示全部楼层 · 发表于 2009-7-8 17:42:17

Starting the file scan:

Begin scan in 'C:\Users\Administrator\Desktop\样本一'
C:\Users\Administrator\Desktop\样本一\1.EXE
[DETECTION] Is the TR/Crypt.XDR.Gen Trojan
[NOTE]    The file was deleted!
C:\Users\Administrator\Desktop\样本一\FUNC.DLL
  [0] Archive type: RSRC
[DETECTION] Is the TR/Dropper.Gen Trojan
[NOTE]    The file was deleted!
C:\Users\Administrator\Desktop\样本一\PHPQ.DLL
[DETECTION] Is the TR/Crypt.XDR.Gen Trojan
[NOTE]    The file was deleted!

End of the scan: 2009年7月8日  02:42
Used time: 00:03 Minute(s)

The scan has been done completely.

   1 Scanned directories
   4 Files were scanned
   3 Viruses and/or unwanted programs were found
   0 Files were classified as suspicious
   3 files were deleted
   0 Viruses and unwanted programs were repaired
   0 Files were moved to quarantine
   0 Files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   0 Archives were scanned
   0 Warnings
   3 Notes

显示全部楼层 · 发表于 2009-7-8 17:59:17

to ll,顺路上报kl

显示全部楼层 · 发表于 2009-7-8 18:04:03

为什么F-Secure查杀是0呢？

[病毒样本] 被远程操控微点截获的木马X4

本帖子中包含更多资源

这样本一天看N次。

回复 1楼时尚的帖子

本帖子中包含更多资源

浏览过的版块

[病毒样本] 被远程操控 微点截获的木马X4

本帖子中包含更多资源

这样本一天看N次。

回复 1楼 时尚 的帖子

本帖子中包含更多资源

浏览过的版块

[病毒样本] 被远程操控微点截获的木马X4

回复 1楼时尚的帖子