今天在YAHOO抓的木马

显示全部楼层 · 发表于 2007-6-30 09:29:09

今天在YAHOO抓的木马
扫不到就回报吧

显示全部楼层 · 发表于 2007-6-30 09:31:53

detected: virus Virus.Win32.AutoRun.ci URL: http://bbs.kafan.cn/attachment.p ... cr//data.rar/88.exe
deleted: Trojan program Trojan-PSW.Win32.Maran.fi File: C:\Documents and Settings\Owner\×ÀÃæ\0630.zip/0630/nice.scr//data.rar/new10wan.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.Maran.fj File: C:\Documents and Settings\Owner\×ÀÃæ\0630.zip/0630/t14.scr//data.rar/ocmsn.exe//PE_Patch.PECompact//PecBundle//PECompact

[ 本帖最后由 wangjay1980 于 2007-6-30 09:45 编辑 ]

显示全部楼层 · 发表于 2007-6-30 09:34:20

2007/6/30 9:28:44 eAmon file D:\病毒上报\0630\t14.scr a variant of Win32/PSW.Maran trojan deleted - quarantined Event occurred on a file modified by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/6/30 9:28:42 eAmon file D:\病毒上报\0630\nice.scr probably a variant of Win32/PSW.Maran trojan deleted - quarantined Event occurred on a file modified by the application: C:\Program Files\WinRAR\WinRAR.exe.
还有一个上报

显示全部楼层 · 发表于 2007-6-30 09:36:46

全了

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\0630.zip'
C:\Documents and Settings\Administrator\My Documents\
  0630.zip
[0] Archive type: ZIP
--> 0630/080520007008jpg.scr
      [DETECTION] Contains signature of the dropper DR/Agent.ZV.1
      [WARNING] Infected files in archives cannot be repaired!
      [1] Archive type: RAR SFX (self extracting)
      --> error.jpg
      --> 88.exe
         [DETECTION] Contains signature of the dropper DR/Agent.ZV.2
         [WARNING] Infected files in archives cannot be repaired!
--> 0630/nice.scr
      [1] Archive type: RAR SFX (self extracting)
      --> new10wan.exe
         [DETECTION] Contains suspicious code HEUR/Crypted
         [WARNING] Infected files in archives cannot be repaired!
      --> m6.jpg
--> 0630/t14.scr
      [1] Archive type: RAR SFX (self extracting)
      --> t14.jpg
      --> ocmsn.exe
         [DETECTION] Is the Trojan horse TR/PSW.Maran.S.1
         [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-6-30 09:42:40

C:\Documents and Settings\Administrator\桌面\0630
.zip>>0630/080520007008jpg.scr>>88.exe Trojan.DL.Win32.Agent.flr
C:\Documents and Settings\Administrator\桌面\0630
.zip>>0630/t14.scr>>ocmsn.exe>>pecompact2x Trojan.PSW.OnlineGames.apl
狮子吃掉2个

显示全部楼层 · 发表于 2007-6-30 10:19:07

显示全部楼层 · 发表于 2007-6-30 12:03:56

C:/ABC/\0630\0630\080520007008jpg.scr:\error.jpg
C:/ABC/\0630\0630\080520007008jpg.scr:\88.exe - Signature 'Trojan-Downloader.Win32.Small.dbv' found
C:/ABC/\0630\0630\080520007008jpg.scr
C:/ABC/\0630\0630\nice.scr:\new10wan.exe - Signature 'Trojan-Dropper.Win32.Agent.ane' found
C:/ABC/\0630\0630\nice.scr:\m6.jpg
C:/ABC/\0630\0630\nice.scr
C:/ABC/\0630\0630\t14.scr:\t14.jpg
C:/ABC/\0630\0630\t14.scr:\ocmsn.exe - Signature 'Generic.PWS.Maran' found
C:/ABC/\0630\0630\t14.scr

9 Files scanned
(3 Archives with 6 files)
3 Signatures found
0 Suspect code-parts found
Used time: 0:00.329

显示全部楼层 · 发表于 2007-6-30 12:07:57

扫描病毒日志记录
版本 17.0.6353
双引擎反病毒签名 6/29/2007
开始时间: 6/30/2007 12:06
引擎: A 引擎 (AVK 17.5738), B 引擎 (AVKB 17.278)
高启发式: 打开
压缩文件: 打开
系统区域: 打开

扫描系统区域...
扫描所选择的目录和文件...
对象: data.rar 88.exe
在压缩档案里: E:\病毒库\0630\0630\080520007008jpg.scr
Status: 已发现病毒
病毒: Virus.Win32.AutoRun.ci (A 引擎)
对象: 080520007008jpg.scr
路径: E:\病毒库\0630\0630
Status: 文件移入隔离区
病毒: Virus.Win32.AutoRun.ci (A 引擎)
对象: nice.scr
路径: E:\病毒库\0630\0630
Status: 文件移入隔离区
病毒: Win32:Trojan-gen. {Other} (B 引擎)
对象: data.rar ocmsn.exe
在压缩档案里: E:\病毒库\0630\0630\t14.scr
Status: 已发现病毒
病毒: Trojan-PSW.Win32.Maran.fj (A 引擎)
对象: t14.scr
路径: E:\病毒库\0630\0630
Status: 文件移入隔离区
病毒: Trojan-PSW.Win32.Maran.fj (A 引擎)
扫描完成: 6/30/2007 12:06
已检查 3 个文件
已发现 3 个染毒文件
发现 0 个可疑文件

显示全部楼层 · 发表于 2007-7-1 09:17:40

费尔

[病毒样本] 今天在YAHOO抓的木马

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源