毒网

rasis

1.zip
  [0] Archive type: ZIP
  --> 1.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Zhidao

woai_jolin

===================================================================================================
NVCOD On Demand Scanner 5.80.02

NSE revision 5.91.02
nvcbin.def revision 5.90.00 of 2007/07/13 18:54:26 (807131 variants)
nvcmacro.def revision 5.90.00 of 2007/06/29 06:32:19 (20341 variants)
Total number of variants: 827472
Command line: "@C:\Users\Jason\AppData\Local\Temp\~ODA364.tmp"
===================================================================================================

       Time  Filename                                                     Virus name
---------------------------------------------------------------------------------------------------
- Scanning files matching: D:\v\1.zip
       78 ms D:\v\1.zip : 1.exe                                           Security Risk W32/Suspicious_U.gen ()
        0 ms D:\v\1.zip                                                  
        3 ms D:\v\1.zip:Zone.Identifier                                 
- File D:\v\1.zip quarantined.

===================================================================================================

The scanning started: 2007/07/14 14:47:33
               ended: 2007/07/14 14:47:37
Logged on as        : Jason
on hostname         : JASON-PC

Scanning results:
   Total number of files found..............................:       3
   Number of files scanned..................................:       3
   Number of files/directories skipped due to exclude list..:       0
   Number of files that could not be opened.................:       0
   Number of archive files unpacked.........................:       1
   Number of archive files not unpacked.....................:       0
   Number of infections.....................................:       1

Copyright (c) 1993-2005 Norman ASA.

蓝色牛仔裤

[Scan path] C:\Documents and Settings\Administrator\桌面\1.zip
>>C:\Documents and Settings\Administrator\桌面\1.zip\1.exe infected with Win32.HLLW.Wace
C:\Documents and Settings\Administrator\桌面\1.zip - archive contains infected objects

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 3
Infected objects found: 1
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 13 Kb/s
Scan time: 00:00:00

微点卫士

微点没有反应.诶.对付网毒微点就没声音了

jimmyleo

原帖由 rasis 于 2007-7-14 14:54 发表
1.zip
  [0] Archive type: ZIP
  --> 1.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Zhidao

知道？源自中国……

微点卫士

那个网页我怎么打不开的拉?

jlennon

捞了4个，其中一个ANI，诸位自己分析htm和js文件吧

promised

这些我在发之前都看过了，都指向我发的那个
现在流行连环套

[ 本帖最后由 promised 于 2007-7-14 16:15 编辑 ]

jlennon

说明效率低下，鸡蛋都放一个篮子的确不保险。

秋叶濛濛

时间        模块        对象        名称        病毒        操作        用户名称        信息
2007-7-14 16:50:17        AMON        文件        C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\user\current\Local Settings\Temp\Temporary Internet Files\Content.IE5\2R5IM2UX\1[1].jpg        Win32/TrojanDownloader.Ani.Gen 木马的变种        已隔离 - 已删除 - 清除中 时发生错误 - 操作不适用于此类对象.        DEEPIN-4014E706\wangjian        程序新建文件时发生事件： C:\Program Files\Internet Explorer\IEXPLORE.EXE. 文件已被移入隔离区。您可以关闭本窗口。