卡巴启发，360报木马

显示全部楼层 · 发表于 2007-7-16 17:15:34

修改系统时间到2001年，使咔吧监控停止、在C：根目录创建自运行文件

显示全部楼层 · 发表于 2007-7-16 17:17:01

谀哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪姆
?          VirusBlokAda (Console scanner)          ?
?Vba32 Windows/CL 3.12.0.2 / 2007.07.15 21:04 (Vba32.W) ?
?       Copyright (c) 1993-2007 by VBA Ltd.          ?
酝屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯图
Key file not found
Demo mode
Command line options:
/r=susp.rpt /ha=3 /collect_suspects /nc /af+ /ar+ /bt- /mr- /wk+ /ml+ /rw+ /as-
Ctrl-C will terminate program execution

C:\virus\样本.rar
C:\virus\样本.rar:<RAR>\补丁3.exe : is suspected of Downloader.Small.19

Directories    : 0    Files in archives:    Files on disks:
Archives:                - total    : 2    - total    : 2
- scanned       : 1    -  scanned : 2    - scanned    : 2
- contain viruses : 0    -  infected : 0    - infected : 0
- deleted       : 0    -  suspicious : 1    - suspicious  : 1

Startup : 17:17:37 16-07-2007
End       : 17:17:41 16-07-2007
Total time : 00:00:04

显示全部楼层 · 发表于 2007-7-16 17:17:18

IKARUS - T3SCAN V1.25 (WIN32)
      T3 V1.01.08
      Copyright (c) 2003 - 2007 by IKARUS Software.
      Written by Richard Schmoegner.
      All rights reserved.

Signature-database from 15.7.2007 17:07:11 (Build: 69212)

C:\virus\样本.rar:\补丁3.exe - Suspect code-parts found (Level: 15)

      3 Files scanned
      (1 Archiv with 2 files)
      0 Signatures found
      1 Suspect code-part found
      Used time: 0:00.125

显示全部楼层 · 发表于 2007-7-16 17:17:51

C:\virus\
  样本.rar
  样本.rar:Zone.Identifier
[0] Archive type: RAR
--> conime.exe
--> ²¹¶¡3.exe
      [DETECTION] Contains signature of the worm WORM/Delf.CJ.1
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-7-16 17:18:31

默认35以下是不报的把

显示全部楼层 · 发表于 2007-7-16 17:19:47

Sign of "Win32:Agent-HUT [Wrm]" has been found in "C:\virus\样本.rar\补丁3.exe" file.

显示全部楼层 · 发表于 2007-7-16 17:20:25

设置了大于0的都报

显示全部楼层 · 发表于 2007-7-16 17:21:19

这个不要变态死了

上报一下很快就会处理的

显示全部楼层 · 发表于 2007-7-16 17:21:22

C:\Documents and Settings\Administrator\桌面\样本
.rar>>补丁3.exe Worm.Win32.Agent.ikn

显示全部楼层 · 发表于 2007-7-16 17:22:04

nod pass

[病毒样本] 卡巴启发，360报木马

本帖子中包含更多资源

回复 #3 yurius 的帖子

回复 #5 promised 的帖子