[MD5: E47559]

显示全部楼层 · 发表于 2007-7-24 20:27:16

Scan performed at: 2007-7-24 20:27:00
Scanning Log
NOD32 version 2416 (20070724) NT
Command line: C:\Documents and Settings\EQ2\桌面\样本.zip
Operating memory - is OK

Date: 24.7.2007 Time: 20:27:06
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\样本.zip
C:\Documents and Settings\EQ2\桌面\样本.zip ?ZIP ?1.exe - a variant of Win32/PSW.OnLineGames.NDA trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 20:27:07 Total scanning time: 1 sec (00:00:01)

显示全部楼层 · 发表于 2007-7-24 20:27:19

avast继续挂

显示全部楼层 · 发表于 2007-7-24 20:27:45

McAfee New Malware.n

显示全部楼层 · 发表于 2007-7-24 20:34:49

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本.zip'
C:\Documents and Settings\Administrator\桌面\样本.zip
  [0] Archive type: ZIP
  --> 1.exe
   [DETECTION] Is the Trojan horse TR/Hook.Shell.202
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-7-24 20:36:55

AhnLab-V3	2007.7.25.0	2007.07.24	no virus found
AntiVir	7.4.0.44	2007.07.24	TR/Hook.Shell.202
Authentium	4.93.8	2007.07.23	no virus found
Avast	4.7.997.0	2007.07.24	no virus found
AVG	7.5.0.476	2007.07.23	no virus found
BitDefender	7.2	2007.07.24	BehavesLike:Trojan.ShellHook
CAT-QuickHeal	9.00	2007.07.23	(Suspicious) - DNAScan
ClamAV	devel-20070416	2007.07.24	no virus found
DrWeb	4.33	2007.07.24	no virus found
eSafe	7.0.15.0	2007.07.23	suspicious Trojan/Worm
eTrust-Vet	31.1.5003	2007.07.24	no virus found
Ewido	4.0	2007.07.24	no virus found
FileAdvisor	1	2007.07.24	no virus found
Fortinet	2.91.0.0	2007.07.24	no virus found
F-Prot	4.3.2.48	2007.07.23	no virus found
F-Secure	6.70.13030.0	2007.07.24	W32/Malware
Ikarus	T3.1.1.8	2007.07.24	Trojan-Dropper.Win32.Agent.ane
Kaspersky	4.0.2.24	2007.07.24	no virus found
McAfee	5080	2007.07.23	New Malware.n
Microsoft	1.2704	2007.07.24	VirTool:Win32/Obfuscator.C
NOD32v2	2416	2007.07.24	a variant of Win32/PSW.OnLineGames.NDA
Norman	5.80.02	2007.07.24	W32/Suspicious_U.gen
Panda	9.0.0.4	2007.07.23	Suspicious file
Sophos	4.19.0	2007.07.17	Mal/Packer
Sunbelt	2.2.907.0	2007.07.24	VIPRE.Suspicious
Symantec	10	2007.07.24	Infostealer
TheHacker	6.1.7.152	2007.07.23	no virus found
VBA32	3.12.2.1	2007.07.23	no virus found
VirusBuster	4.3.26:9	2007.07.23	no virus found
Webwasher-Gateway	6.0.1	2007.07.24	Trojan.Hook.Shell.202

显示全部楼层 · 发表于 2007-7-24 20:38:53

这个到底是什么啊？
刚才不小心运行了，然后文件就消失了
我正在测试Dr.Web，结果没有任何提示，也开了实时监控了，晕啊~~~

显示全部楼层 · 发表于 2007-7-24 20:58:33

微点:

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.391\1.EXE
1) C:\DELETEFILEDOS.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.391\1.EXE
1) C:\DELETEFILEDOS.BAT
是否删除可疑程序?

显示全部楼层 · 发表于 2007-7-24 21:01:13

7楼的有点太冒险了，运行应该加个hips

显示全部楼层 · 发表于 2007-7-24 21:04:33

我双击文件,经常也会消失的.
最灵异的一次是解压文件,居然没有的,再解压提示替换文件,但是桌面上还是没有文件,微点没反应的,你说灵异吧

[病毒样本] [MD5: E47559]

本帖子中包含更多资源

回复 #7 cnlinya 的帖子