[MD5: 5E2A3E]

显示全部楼层 · 发表于 2007-7-4 12:41:15

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\样本.rar'
C:\Documents and Settings\Administrator\My Documents\
  样本.rar
[0] Archive type: RAR
--> MM.exe
      [DETECTION] Is the Trojan horse TR/QQPass.bg.2.C
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-7-4 12:42:28

detected: virus Heur.Downloader (modification) File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/MM.exe//UPack

shangbao

Hello,

MM.exe_ - Trojan-PSW.Win32.QQPass.pf

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vladimir Lebedev
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

> Attachment: ??mm.zip

[ 本帖最后由 wangjay1980 于 2007-7-4 15:00 编辑 ]

显示全部楼层 · 发表于 2007-7-4 12:52:14

显示全部楼层 · 发表于 2007-7-4 12:52:33

病毒: Win32:Nilage-AI [Trj]
文件: 样本[1].rar
目录: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WAW7BC7B
进程: GreenBrowser.exe

显示全部楼层 · 发表于 2007-7-4 12:57:00

C:\ABC\样本.rar:\MM.exe - Signature 'Trojan-Spy.Win32.Agent.hz' found
C:\ABC\样本.rar

2 Files scanned
(1 Archiv with 1 file)
1 Signature found
0 Suspect code-parts found
Used time: 0:00.016

显示全部楼层 · 发表于 2007-7-4 13:01:47

扫描进行于：2007/7/4 12:58:42
扫描日志
NOD32版本 2377 (20070704) NT
命令行： D:\virus\样本.rar
C:\Program Files\Eset\nod32.exe - 是正常的
1 的MBR区.物理磁盘 - 是正常的
1 的启动引导区.物理磁盘 - 是正常的

日期： 4.7.2007 时间：12:58:43
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：D:\virus\样本.rar
D:\virus\样本.rar >>RAR >>MM.exe - 可能是 Win32/Genetik 木马的一个变种
D:\virus\样本.rar:Zone.Identifier - 是正常的
已扫描的文件数目：2
已发现的病毒数目：1
完成时间： 12:58:43 总扫描时间：0 秒 (00:00:00)

显示全部楼层 · 发表于 2007-7-4 13:32:20

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.DL.Win32.Delf.yqj

用户来源：互联网

软件版本：19.30.20

显示全部楼层 · 发表于 2007-7-4 14:03:11

[Scan path] C:\Documents and Settings\Administrator\桌面\样本.rar
>>>C:\Documents and Settings\Administrator\桌面\样本.rar\MM.exe infected with Trojan.PWS.Qqpass.origin
C:\Documents and Settings\Administrator\桌面\样本.rar - archive contains infected objects

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 3
Infected objects found: 1
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 41 Kb/s
Scan time: 00:00:00

显示全部楼层 · 发表于 2007-7-4 14:26:43

KIS 7启发
已经隔离: 病毒 Downloader (变种) 文件: D:\Downloads\样本.rar/MM.exe//UPack

[病毒样本] [MD5: 5E2A3E]

本帖子中包含更多资源

本帖子中包含更多资源