nod32过的7个.

显示全部楼层 · 发表于 2007-7-7 22:00:40

估计是一个downloader..下了14个XX,nod32不杀的7个发上来..

EQ2上报吧.
ps.就是allenhippo发的一个downloader.

显示全部楼层 · 发表于 2007-7-7 22:02:04

这个今明两天都不怎么会更新的。。。等星期一再说

显示全部楼层 · 发表于 2007-7-7 22:03:03

卡巴全过

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\temp.rar'
C:\Documents and Settings\Administrator\桌面\temp.rar
  [0] Archive type: RAR
  --> sys.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> sys12.exe
   [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
  --> sys2.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> sys9.exe
   [DETECTION] Is the Trojan horse TR/Hook.Shell.139
   [WARNING] The file was ignored!

[ 本帖最后由 zane_xzz 于 2007-7-7 22:09 编辑 ]

显示全部楼层 · 发表于 2007-7-7 22:05:41

Starting the file scan:

Begin scan in 'F:\病毒样本\temp.rar'
F:\病毒样本\temp.rar
  [0] Archive type: RAR
  --> sys.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> sys12.exe
   [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
  --> sys2.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> sys9.exe
   [DETECTION] Is the Trojan horse TR/Hook.Shell.139
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-7-7 22:06:05

还得送上去两个

c:\ABC\temp\sys.exe - Suspect code-parts found (Level: 100)
c:\ABC\temp\sys12.exe - Signature 'Trojan-Downloader.Win32.Zlob.and' found
c:\ABC\temp\sys14.exe
c:\ABC\temp\sys15.exe
c:\ABC\temp\sys2.exe - Signature 'Trojan-PWS.Win32.Nilage.bjp' found
c:\ABC\temp\sys4.exe - Signature 'Trojan-PWS.OnlineGames.AUP' found
c:\ABC\temp\sys9.exe - Signature 'Trojan-Dropper.Win32.Agent.ane' found

7 Files scanned
(0 Archives with 0 files)
4 Signatures found
1 Suspect code-part found
Used time: 0:00.172

显示全部楼层 · 发表于 2007-7-7 22:07:12

SYS14.exe死尸

显示全部楼层 · 发表于 2007-7-7 22:14:27

没测就发上来了.这些都在windowsupdate文件夹里面的..

显示全部楼层 · 发表于 2007-7-7 22:15:26

上报

Hello,

sys.exek - Trojan-PSW.Win32.OnLineGames.es,
sys12.exek - Trojan-Downloader.Win32.Agent.bto,
sys9.exek - Trojan-Spy.Win32.Delf.uv

These files are already detected. Please update your antivirus bases.

sys14.exek

No malicious code was found in this file.

sys15.exek - not-a-virus:AdWare.Win32.Agent.s

This file is an Advertizing Tool, it is detected by
extended databases set. See more info about
extended databases here: http://www.kaspersky.com/extraavupdates

sys2.exek, sys4.exek

These files are corrupted.

Please quote all when answering.

--
Best regards, Vladimir Krylov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

> Attachment: temp7.zip

[ 本帖最后由 wangjay1980 于 2007-7-8 08:53 编辑 ]

显示全部楼层 · 发表于 2007-7-7 22:22:38

AVAST2

显示全部楼层 · 发表于 2007-7-7 22:35:42

卡巴全过?

难道nod32总在靠卡巴吃饭吗.

[ 本帖最后由 hj5abc 于 2007-7-7 22:37 编辑 ]

[病毒样本] nod32过的7个.

本帖子中包含更多资源

本帖子中包含更多资源

回复 #8 wangjay1980 的帖子