e0cf64 2bd9a8

显示全部楼层 · 发表于 2007-7-15 17:59:33

C:\ABC\805.rar:\805.exe - 特征码 'not-a-virus:AdWare.Win32.NewWeb.i' 被发现
C:\ABC\805.rar
C:\ABC\cc.rar:\cc.exe - 特征码 'Trojan-PWS.Win32.Agent.BU' 被发现
C:\ABC\cc.rar

4 个文件被扫描
(2 个压缩档 2 个文件)
2 个特征码被侦测
0 个可疑代码段被发现
耗时: 0:00.031

显示全部楼层 · 发表于 2007-7-15 18:00:04

Scan performed at: 2007-7-15 17:59:46
Scanning Log
NOD32 version 2399 (20070714) NT
Command line: C:\Documents and Settings\EQ2\桌面\cc.rar C:\Documents and Settings\EQ2\桌面\805.rar
Operating memory - is OK

Date: 15.7.2007 Time: 17:59:52
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\cc.rar; C:\Documents and Settings\EQ2\桌面\805.rar
C:\Documents and Settings\EQ2\桌面\cc.rar ?RAR ?cc.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\EQ2\桌面\805.rar ?RAR ?805.exe ?NSIS ?805~.exe - probably a variant of Win32/Agent.NEO trojan - was a part of the deleted object
Number of scanned files: 5
Number of threats found: 2
Number of files cleaned: 2
Time of completion: 17:59:54 Total scanning time: 2 sec (00:00:02)

显示全部楼层 · 发表于 2007-7-15 18:03:53

detected: Trojan program Trojan-Downloader.Win32.Delf.bgp URL: http://bbs.kafan.cn/attachment.php?aid=101217//805.exe//data0002
detected: riskware Trojan.generic Running process: cc.exe

显示全部楼层 · 发表于 2007-7-15 18:06:35

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\B64X7CKM\805[1].rar\805.exe\data003 - infected with Trojan.Popwin

Archive contains an infected item
程序:
E:\病毒库\CC\CC.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\KUSN33SD.EXE
2) C:\WINDOWS\SYSTEM32\KUSN433SD3.DLL
是否删除木马程序及其衍生物?
程序:
E:\病毒库\CC\CC.EXE
可疑程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\KUSN33SD.EXE
2) C:\WINDOWS\SYSTEM32\KUSN433SD3.DLL
3) C:\WINDOWS\SYSTEM32\KILLME.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?

显示全部楼层 · 发表于 2007-7-15 18:08:33

Starting the file scan:

Begin scan in 'F:\病毒样本\805.rar'
Begin scan in 'F:\病毒样本\cc.rar'
F:\病毒样本\cc.rar
  [0] Archive type: RAR
  --> cc.exe
   [DETECTION] Contains suspicious code HEUR/Crypted
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-7-15 18:10:37

红伞只报一个,另一个上报

显示全部楼层 · 发表于 2007-7-15 18:12:43

AhnLab-V3	2007.7.14.0	2007.07.14	no virus found
AntiVir	7.4.0.39	2007.07.13	no virus found
Authentium	4.93.8	2007.07.13	no virus found
Avast	4.7.997.0	2007.07.13	Win32:Agent-JAX
AVG	7.5.0.476	2007.07.14	no virus found
BitDefender	7.2	2007.07.15	GenPack:Generic.Popwin.3FB0A5A3
CAT-QuickHeal	9.00	2007.07.14	no virus found
ClamAV	devel-20070416	2007.07.15	no virus found
DrWeb	4.33	2007.07.15	Trojan.Popwin
eSafe	7.0.15.0	2007.07.10	no virus found
eTrust-Vet	30.8.3784	2007.07.14	no virus found
Ewido	4.0	2007.07.14	no virus found
FileAdvisor	1	2007.07.15	no virus found
Fortinet	2.91.0.0	2007.07.14	no virus found
F-Prot	4.3.2.48	2007.07.13	no virus found
Ikarus	T3.1.1.8	2007.07.15	not-a-virus:AdWare.Win32.NewWeb.i
Kaspersky	4.0.2.24	2007.07.15	Trojan-Downloader.Win32.Delf.bgp
McAfee	5074	2007.07.13	no virus found
Microsoft	1.2704	2007.07.15	TrojanDownloader:Win32/Delf.gen
NOD32v2	2399	2007.07.14	probably a variant of Win32/Agent.NEO
Norman	5.80.02	2007.07.13	no virus found
Panda	9.0.0.4	2007.07.14	no virus found
Sophos	4.19.0	2007.07.06	no virus found
Sunbelt	2.2.907.0	2007.07.14	no virus found
Symantec	10	2007.07.15	no virus found
TheHacker	6.1.6.146	2007.07.13	no virus found
VBA32	3.12.0.2	2007.07.14	suspected of Trojan-PSW.Game.63 (paranoid heuristics)
VirusBuster	4.3.23:9	2007.07.14	no virus found
Webwasher-Gateway	6.0.1	2007.07.15	no virus found

显示全部楼层 · 发表于 2007-7-15 18:13:15

不知道MICROSFT是不是就是ONECARE

显示全部楼层 · 发表于 2007-7-15 18:15:03

金山没杀,江民没杀,瑞星杀了

[病毒样本] e0cf64 2bd9a8

本帖子中包含更多资源