[MD5: EF1BB4 A1A1A7]

显示全部楼层 · 发表于 2007-7-20 22:57:05

显示全部楼层 · 发表于 2007-7-20 22:58:18

detected: Trojan program Trojan-PSW.Win32.Agent.mh URL: http://bbs.kafan.cn/attachment.p ... xe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.Agent.mh URL: http://bbs.kafan.cn/attachment.php?aid=103194//systhecatdll.exe

显示全部楼层 · 发表于 2007-7-20 22:58:56

蠕虫名称:Worm.Win32.Agent.dah

程序:
E:\病毒库\样本\SYSINJECTMSG.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2007-7-20 23:00:15

二个一样.

显示全部楼层 · 发表于 2007-7-20 23:00:20

Scanning Log
NOD32 version 2409 (20070720) NT
Command line: R:\??.rar
Checking CRC of NOD32.EXE: Status OK
Scanning memory: Not performed (option disabled)
Error occurred while scanning MBR sector of the 2.  ?
?physical disk. Error reading sector.
Error occurred while scanning MBR sector of the 3.  ?
?physical disk. Error reading sector.
Date: 20.7.2007  Time: 22:59:47
Anti-Stealth technology is enabled.
Scanned disks, folders and files: R:\??.rar
R:\??.rar ?RAR ?sysinjectmsg.exe - Win32/Agent.NKX trojan
Number of scanned files: 2
Number of threats found: 1
Time of completion: 22:59:48 Total scanning time: 1 sec  ?
?(00:00:01)

另外一个是死的

显示全部楼层 · 发表于 2007-7-20 23:01:18

Starting the file scan:

Begin scan in 'F:\病毒样本\样本.rar'
F:\病毒样本\样本.rar
  [0] Archive type: RAR
  --> sysinjectmsg.exe
   [DETECTION] Is the Trojan horse TR/PSW.Agent.MH.4
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-7-20 23:09:23

探测到: 木马程序 Trojan-PSW.Win32.Agent.mh 网址: http://bbs.kafan.cn/attachment.p ... xe//PE_Patch//UPack
另外一个没复制

显示全部楼层 · 发表于 2007-7-20 23:12:30

ikarus可以识别文件是否有效，不太会鞭尸
C:\ABC\样本.rar:\sysinjectmsg.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\样本.rar:\systhecatdll.exe
C:\ABC\样本.rar

3 个文件被扫描
(1 个压缩档 2 个文件)
1 个特征码被侦测
0 个可疑代码段被发现
耗时: 0:00.079

[病毒样本] [MD5: EF1BB4 A1A1A7]

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块