过红伞的一个arp病毒~~~~3B2892

dgww

RT，攻击整个LAN+WAN，哈哈~~~~~

[ 本帖最后由 promised 于 2007-7-19 01:37 编辑 ]

tracydk

Starting the file scan:

Begin scan in 'F:\病毒样本\svchost.rar'
F:\病毒样本\svchost.rar
  [0] Archive type: RAR
  --> svchost.exe
      [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
      [INFO]      The file was deleted!

woai_jolin

===================================================================================================
NVCOD On Demand Scanner 5.80.02

NSE revision 5.91.02
nvcbin.def revision 5.90.00 of 2007/07/17 08:12:37 (810868 variants)
nvcmacro.def revision 5.90.00 of 2007/06/29 06:32:19 (20341 variants)
Total number of variants: 831209
Command line: "@C:\Users\Jason\AppData\Local\Temp\~OD6E43.tmp"
===================================================================================================

       Time  Filename                                                     Virus name
---------------------------------------------------------------------------------------------------
- Scanning files matching: D:\v\svchost.exe
       23 ms D:\v\svchost.exe                                             Security Risk W32/Suspicious_U.gen ()
- File D:\v\svchost.exe quarantined.
- File D:\v\svchost.exe deleted.

===================================================================================================

The scanning started: 2007/07/18 08:50:14
               ended: 2007/07/18 08:50:17
Logged on as        : Jason
on hostname         : JASON-PC

Scanning results:
   Total number of files found..............................:       1
   Number of files scanned..................................:       1
   Number of files/directories skipped due to exclude list..:       0
   Number of files that could not be opened.................:       0
   Number of archive files unpacked.........................:       0
   Number of archive files not unpacked.....................:       0
   Number of infections.....................................:       1

Copyright (c) 1993-2005 Norman ASA.

sharkkong

已检测到: 木马程序 Trojan-PSW.Win32.OnLineGames.fq        URL: http://bbs.kafan.cn/attachment.p ... xe//PE_Patch//UPack
KAV7秒杀

一派胡言

kv2007

在 C:\Documents and Settings\Administrator\桌面\svchost.rar->svchost.exe 中发现 Trojan/PSW.GamePass.spv 病毒, 已删除

freehuang

驱逐舰阻止了~~

tracydk

AhnLab-V3	2007.7.14.0	2007.07.17	no virus found
AntiVir	7.4.0.42	2007.07.17	no virus found
Authentium	4.93.8	2007.07.18	no virus found
Avast	4.7.997.0	2007.07.17	no virus found
AVG	7.5.0.476	2007.07.17	no virus found
BitDefender	7.2	2007.07.17	no virus found
CAT-QuickHeal	9.00	2007.07.17	(Suspicious) - DNAScan
ClamAV	devel-20070416	2007.07.17	Trojan.Sniff
DrWeb	4.33	2007.07.18	Trojan.Sniff
eSafe	7.0.15.0	2007.07.17	Suspicious Trojan/Worm
eTrust-Vet	30.8.3790	2007.07.17	no virus found
Ewido	4.0	2007.07.17	no virus found
FileAdvisor	1	2007.07.18	no virus found
Fortinet	2.91.0.0	2007.07.17	no virus found
F-Prot	4.3.2.48	2007.07.17	no virus found
F-Secure	6.70.13030.0	2007.07.17	no virus found
Ikarus	T3.1.1.8	2007.07.17	Trojan-Downloader.Win32.Zlob.and
Kaspersky	4.0.2.24	2007.07.18	Trojan-PSW.Win32.OnLineGames.fq
McAfee	5076	2007.07.17	New Malware.aj
Microsoft	1.2704	2007.07.17	no virus found
NOD32v2	2404	2007.07.17	no virus found
Norman	5.80.02	2007.07.17	no virus found
Panda	9.0.0.4	2007.07.17	Suspicious file
Sophos	4.19.0	2007.07.17	Mal/Packer
Sunbelt	2.2.907.0	2007.07.18	VIPRE.Suspicious
Symantec	10	2007.07.18	no virus found
TheHacker	6.1.7.148	2007.07.16	no virus found
VBA32	3.12.2	2007.07.17	Trojan.Sniff
VirusBuster	4.3.23:9	2007.07.17
Webwasher-Gateway	6.0.1	2007.07.17	Packer.UPACK

woai_jolin

原帖由 tracydk 于 2007-7-18 09:13 发表
AhnLab-V32007.7.14.02007.07.17no virus foundAntiVir7.4.0.422007.07.17no virus foundAuthentium4.93.82007.07.18no virus foundAvast4.7.997.02007.07.17no virus foundAVG7.5.0.4762007.07.17no virus fou ...

bs直接拿压缩包scan

xiaopangmd

问下楼上的，样本只要不运行仅仅解压没问题吗？

风雪

费尔启发。