垃圾信中找到的(NORTON使用者回报吧)

显示全部楼层 · 发表于 2007-6-30 14:55:38

显示全部楼层 · 发表于 2007-6-30 14:56:47

扫描开始时间: 2007-6-30 14:58:31
扫描日志
NOD32 版本 2365 (20070630) NT
命令行: F:\virus\yahoomail0.zip

日期: 2007年6月30日时间: 14:58:32
反 Rookits 技术已启用。
已扫描磁盘、文件夹和文件: F:\virus\yahoomail0.zip
F:\virus\yahoomail0.zip ?ZIP ?yahoomail0/access.exe<病毒 - Win32/Stration.XW 蠕虫变种>
已扫描文件数量: 4
已发现病毒数量: 1
完成时间: 14:58:33 总共扫描时间: 1 秒 (00:00:01)

显示全部楼层 · 发表于 2007-6-30 15:00:52

[:26:]

显示全部楼层 · 发表于 2007-6-30 15:01:57

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\yahoomail0.zip'
C:\Documents and Settings\Administrator\My Documents\
  yahoomail0.zip
[0] Archive type: ZIP
--> yahoomail0/access.exe
      [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> yahoomail0/Grouped.pdf
--> yahoomail0/Manual_Invoice.pdf
--> yahoomail0/WriteDown.pdf
      [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-6-30 15:11:47

?       Copyright (c) 1993-2007 by VBA Ltd.          ?
酝屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯图
License expired
License #000000119 Valid till 2006-12-31
Demo mode
Command line options:
/r=susp.rpt /ha=3 /collect_suspects /n.../af+ /fd+ /ar+ /bt- /mr- /ml+ /rw+ /as-
Ctrl-C will terminate program execution

*:
C:\
C:\ABC\...\yahoomail0\access.exe : infected MalwareScope.Worm.Warezov.1
Program execution terminated by user

Directories    : 3    Files in archives:    Files on disks:
Archives:                - total    : 4    - total    : 11
- scanned       : 1    -  scanned : 4    - scanned    : 11
- contain viruses : 1    -  infected : 1    - infected : 1
- deleted       : 0    -  suspicious : 0    - suspicious  : 0

Startup : 15:11:33 30-06-2007
End       : 15:11:39 30-06-2007
Total time : 00:00:06
终止批处理操作吗(Y/N)?

显示全部楼层 · 发表于 2007-6-30 15:42:14

病毒: Email-Worm.Win32.Warezov.pk
文件: yahoomail0[1].zip
目录: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\9ZJO5KCR
进程: GreenBrowser.exe

显示全部楼层 · 发表于 2007-6-30 15:50:01

2007/6/30 15:39:48 eAmon file D:\病毒上报\YAHOOMAIL0\ACCESS.EXE a variant of Win32/Stration.XW worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\Program Files\Micropoint\MPSVC2.exe.

显示全部楼层 · 发表于 2007-6-30 16:10:13

显示全部楼层 · 发表于 2007-6-30 22:57:27

http://www.bitdefender.com/vfind/?q=Win32.Warezov.ZW@mm

显示全部楼层 · 发表于 2007-7-1 00:00:08

Win32/Stration.XW worm.这个高居eset threat center 之首.

[病毒样本] 垃圾信中找到的(NORTON使用者回报吧)

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源