[MD5: CC5D6E EA09AE 72DCC4 FF61C3 33CAEE]

显示全部楼层 · 发表于 2007-6-24 00:31:46

License #000000119 Valid till 2006-12-31
Demo mode
Command line options:
/r=susp.rpt /ha=3 /collect_suspects /nc /af+ /ar+ /bt- /mr- /ml+ /rw+ /as-
Ctrl-C will terminate program execution

*:
C:\
C:\ABC\样本.rar:<RAR>\qaa.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\ABC\样本.rar:<RAR>\werwer.exe : is suspected of Downloader.Small.160
C:\ABC\样本.rar:<RAR>\0.exe : is suspected of Downloader.Small.160
C:\ABC\样本.rar:<RAR>\cmi.exe : infected MalwareScope.Trojan-PSW.Game.14
Program execution terminated by user

Directories    : 3    Files in archives:    Files on disks:
Archives:                - total    : 6    - total    : 14
- scanned       : 2    -  scanned : 6    - scanned    : 14
- contain viruses : 1    -  infected : 2    - infected : 1
- deleted       : 0    -  suspicious : 2    - suspicious  : 0

Startup : 00:36:34 24-06-2007
End       : 00:36:39 24-06-2007
Total time : 00:00:05
终止批处理操作吗(Y/N)?

显示全部楼层 · 发表于 2007-6-24 00:32:52

难得一见的启发
这个启发绝对不是报壳

显示全部楼层 · 发表于 2007-6-24 00:35:14

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\样本.rar'
C:\Documents and Settings\Administrator\My Documents\
  样本.rar
[0] Archive type: RAR
--> Microsoft.com
      [1] Archive type: RAR SFX (self extracting)
      --> 1.vbs
         [DETECTION] Contains signature of the VBS script virus VBS/Agent.abj.A
         [WARNING] Infected files in archives cannot be repaired!
--> qaa.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> werwer.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGam.QW
      [WARNING] Infected files in archives cannot be repaired!
--> 0.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGam.QW
      [WARNING] Infected files in archives cannot be repaired!
--> cmi.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-6-24 00:42:07

detected: virus Heur.Invader (modification) File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/qaa.exe
detected: virus Heur.Trojan.Generic (modification) File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/werwer.exe//PE_Patch//UPack
detected: virus Heur.Trojan.Generic (modification) File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/0.exe//PE_Patch//UPack
detected: virus Heur.Trojan.Generic (modification) File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/cmi.exe

显示全部楼层 · 发表于 2007-6-24 00:42:14

detected: virus Invader (modification) URL: http://bbs.kafan.cn/attachment.php?aid=91991//qaa.exe

显示全部楼层 · 发表于 2007-6-24 00:44:03

quarantined: virus Invader (modification) File: E:\Virus sample\2.rar/qaa.exe
quarantined: virus Trojan.Generic (modification) File: E:\Virus sample\2.rar/werwer.exe//PE_Patch//UPack
quarantined: virus Trojan.Generic (modification) File: E:\Virus sample\2.rar/0.exe//PE_Patch//UPack
quarantined: virus Trojan.Generic (modification) File: E:\Virus sample\2.rar/cmi.exe

显示全部楼层 · 发表于 2007-6-24 00:44:42

杀了4个

显示全部楼层 · 发表于 2007-6-24 01:17:56

漏一个。。。

[Scan path] C:\Documents and Settings\Administrator\桌面\样本.rar
>>C:\Documents and Settings\Administrator\桌面\样本.rar\Microsoft.com\1.vbs - Ok
>C:\Documents and Settings\Administrator\桌面\样本.rar\Microsoft.com - Ok
>>C:\Documents and Settings\Administrator\桌面\样本.rar\qaa.exe probably infected with MULDROP.Trojan
>>C:\Documents and Settings\Administrator\桌面\样本.rar\werwer.exe infected with Trojan.PWS.Wsgame
>>C:\Documents and Settings\Administrator\桌面\样本.rar\0.exe infected with Trojan.PWS.Wsgame
>C:\Documents and Settings\Administrator\桌面\样本.rar\cmi.exe infected with Win32.HLLW.Autoruner.149
C:\Documents and Settings\Administrator\桌面\样本.rar - archive contains infected objects

显示全部楼层 · 发表于 2007-6-24 01:31:11

病毒: Win32:Onlinegames-ACD [Trj], Win32:Onlinegames-ACS [Trj] (2x), Win32:Delf-EVJ [Wrm]
檔案: 样本[1].rar
目錄: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MHBENDU2
處理序: GreenBrowser.exe

[病毒样本] [MD5: CC5D6E EA09AE 72DCC4 FF61C3 33CAEE]

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块