来几个实际点的！[MD5: FDDC01 B8A8DA 11AC53]

显示全部楼层 · 发表于 2007-6-24 09:52:12

样本区不是实验黑客工具的场所

g:\virus\sample\Archive.zip:\q.exe - Signature 'Backdoor.Win32.EggDrop.19' found
g:\virus\sample\Archive.zip:\spy.exe - Signature 'Backdoor.Win32.Prosti.AP' found
g:\virus\sample\Archive.zip:\windowsmod.exe - Signature 'Generic.Graybird' found
g:\virus\sample\Archive.zip

话说回来，这么小的鸽子？

显示全部楼层 · 发表于 2007-6-24 09:53:17

Scan performed at: 2007-6-24 9:58:02
Scanning Log
NOD32 version 2349 (20070623) NT
Command line: C:\Documents and Settings\EQ2\桌面\virus
Operating memory - is OK

Date: 24.6.2007 Time: 09:58:06
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\virus\
C:\Documents and Settings\EQ2\桌面\virus\q.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\EQ2\桌面\virus\spy.exe - probably unknown NewHeur_PE virus [7]
Number of scanned files: 3
Number of threats found: 2
Number of files cleaned: 2
Time of completion: 09:58:13 Total scanning time: 7 sec (00:00:07)

Notes:
[7] File is probably infected with an unknown virus.

显示全部楼层 · 发表于 2007-6-24 09:56:59

jotti是不是坏了？停止服务了

显示全部楼层 · 发表于 2007-6-24 09:57:24

jotti是习惯性的坏了

显示全部楼层 · 发表于 2007-6-24 10:00:18

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\virus.rar'
C:\Documents and Settings\Administrator\My Documents\
  virus.rar
[0] Archive type: RAR
--> q.exe
--> spy.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [WARNING] Infected files in archives cannot be repaired!
--> windowsmod.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-6-24 10:01:17

显示全部楼层 · 发表于 2007-6-24 10:01:42

q.exe不是病毒，ls两个的误报了

显示全部楼层 · 发表于 2007-6-24 10:02:21

avast报的毒名有点意思啊

显示全部楼层 · 发表于 2007-6-24 10:14:33

deleted: Trojan program Backdoor.Win32.EggDrop.19 File: C:\Documents and Settings\Owner\×ÀÃæ\virus.rar/q.exe//ASPack//PE_Patch.AvSpoof
deleted: virus Packed.Win32.Klone.af File: C:\Documents and Settings\Owner\×ÀÃæ\virus.rar/spy.exe

显示全部楼层 · 发表于 2007-6-24 10:19:35

Virus: Backdoor.Win32.EggDrop.19, Packed.Win32.Klone.af
File: 92087
Directory: C:\Documents and Settings\Administrator\Application Data\IDM\DwnlData\Administrator\92087_208
Process: IDMan.exe

[病毒样本] 来几个实际点的！[MD5: FDDC01 B8A8DA 11AC53]

本帖子中包含更多资源

评分

本帖子中包含更多资源

本帖子中包含更多资源