红伞区发现的一个毒网[MD5: B5A0A9 09118E 07AA3B]

显示全部楼层 · 发表于 2007-6-27 06:52:00

http://bbs.kafan.cn/viewthread.php?tid=101435

还挺有质量的

显示全部楼层 · 发表于 2007-6-27 06:55:22

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\virus.rar'
C:\Documents and Settings\Administrator\My Documents\
  virus.rar
[0] Archive type: RAR
--> __4.tmp
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
--> __5.tmp
      [DETECTION] Contains suspicious code HEUR/Crypted
      [WARNING] Infected files in archives cannot be repaired!
--> vip.exe
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-6-27 06:56:01

扫描日志
NOD32版本 2354 (20070626) NT
命令行： C:\Documents and Settings\Administrator\My ?
?Documents\virus.rar
正在检查NOD32.EXE文件的CRC：状态正常
D:\Eset\nod32.exe - 是正常的
扫描系统内存中：没有进行 (选项已关闭)
扫描MBR及引导区中：没有进行 (选项已关闭)
日期： 26.6.2007 时间：16:01:35
已关闭反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\ ?
?Administrator\My Documents\virus.rar
C:\Documents and Settings\Administrator\My Documents\ ?
?virus.rar >>RAR >>__4.tmp - Win32/Agent.AAC 木马的变种
C:\Documents and Settings\Administrator\My Documents\ ?
?virus.rar >>RAR >>__5.tmp - Win32/Agent.AAC 木马的变种
C:\Documents and Settings\Administrator\My Documents\ ?
?virus.rar >>RAR >>vip.exe - Win32/PSW.Delf.NHI 木马的变种
已扫描的文件数目：3
已发现的病毒数目：3
完成时间： 16:01:39 总扫描时间：4 秒 (00:00:04)

显示全部楼层 · 发表于 2007-6-27 06:56:48

[Scan path] C:\Documents and Settings\Administrator\My Documents\virus.rar
>C:\Documents and Settings\Administrator\My Documents\virus.rar\__4.tmp infected with BackDoor.Pigeon.1604
>C:\Documents and Settings\Administrator\My Documents\virus.rar\__5.tmp infected with BackDoor.Pigeon.1604
>>>C:\Documents and Settings\Administrator\My Documents\virus.rar\vip.exe infected with Trojan.PWS.Gamania.origin
C:\Documents and Settings\Administrator\My Documents\virus.rar - archive contains infected objects

显示全部楼层 · 发表于 2007-6-27 08:05:29

C:/ABC/\virus.rar:\__4.tmp - Signature 'Backdoor.Win32.Agent.ahj' found
C:/ABC/\virus.rar:\__5.tmp - Signature 'Backdoor.Win32.Agent.ahj' found
C:/ABC/\virus.rar:\vip.exe - Signature 'Trojan-Spy.Win32.Delf.PG' found
C:/ABC/\virus.rar

4 Files scanned
(1 Archiv with 3 files)
3 Signatures found
0 Suspect code-parts found
Used time: 0:00.187

显示全部楼层 · 发表于 2007-6-27 08:09:55

显示全部楼层 · 发表于 2007-6-27 08:56:25

detected: virus Heur.Downloader (modification) File: C:\Documents and Settings\Owner\×ÀÃæ\virus.rar/vip.exe

显示全部楼层 · 发表于 2007-6-27 11:59:48

病毒: Win32:Agent-HZK [Trj], Win32:Delf-EWR [Trj]
檔案: virus[1].rar
目錄: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OGA7RCFL
處理序: GreenBrowser.exe

显示全部楼层 · 发表于 2007-6-27 12:09:00

那里看出质量，很多都抱了％

显示全部楼层 · 发表于 2007-6-27 13:15:57

2007/6/27 13:18:50 Scanning Log
2007/6/27 13:18:50 Version of virus signature database: 2356 (20070627)
2007/6/27 13:18:50 Date: 27.6.2007 Time: 13:18:50
2007/6/27 13:18:50 Scanned disks, folders and files: D:\virus\
2007/6/27 13:18:52 D:\virus\virus.rar - multiple threats - deleted - quarantined
2007/6/27 13:18:52 D:\virus\virus.rar » RAR » __4.tmp - a variant of Win32/Agent.AAC trojan
2007/6/27 13:18:52 D:\virus\virus.rar » RAR » __5.tmp - a variant of Win32/Agent.AAC trojan
2007/6/27 13:18:52 D:\virus\virus.rar » RAR » vip.exe - a variant of Win32/PSW.Delf.NHI trojan
2007/6/27 13:18:53 Number of scanned files: 4
2007/6/27 13:18:53 Number of threats found: 3
2007/6/27 13:18:53 Time of completion: 13:18:53 Total scanning time: 3 sec (00:00:03)

[病毒样本] 红伞区发现的一个毒网[MD5: B5A0A9 09118E 07AA3B]

本帖子中包含更多资源

本帖子中包含更多资源