继续发MD5: 1FE3A58

显示全部楼层 · 发表于 2007-7-25 10:39:39

微点砍掉

显示全部楼层 · 发表于 2007-7-25 10:42:04

F:\virus\server.rar ?RAR ?server.exe - Win32/Delf.NFE 木马变种

显示全部楼层 · 发表于 2007-7-25 10:43:27

deleted: virus Trojan.Generic (modification) File: C:\Documents and Settings\Administrator\×ÀÃæ\server.rar/server.exe

显示全部楼层 · 发表于 2007-7-25 10:46:45

金山又挂

微点:
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.656\SERVER.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ALL USERS.WINDOWS.0\FAVORITES\PLUG\001.DLL
2) C:\DOCUMENTS AND SETTINGS\ALL USERS.WINDOWS.0\FAVORITES\NETSERVICE.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.656\SERVER.EXE
木马程序生成以下文件:
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-7-25 10:47:32

Begin scan in 'C:\virus\server.rar'
C:\virus\
  server.rar
  server.rar:Zone.Identifier
[0] Archive type: RAR
--> server.exe
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-7-25 10:47:51

IKARUS - T3SCAN V1.25 (WIN32)
      T3 V1.01.08
      Copyright (c) 2003 - 2007 by IKARUS Software.
      Written by Richard Schmoegner.
      All rights reserved.

Signature-database from 18.7.2007 17:07:57 (Build: 69228)

C:\virus\server.rar:\server.exe - Signature 'Trojan-Dropper.Win32.Small.AKJ' fou
nd

      2 Files scanned
      (1 Archiv with 1 file)
      1 Signature found
      0 Suspect code-parts found
      Used time: 0:00.047

显示全部楼层 · 发表于 2007-7-25 10:48:17

谀哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪姆
?          VirusBlokAda (Console scanner)          ?
?Vba32 Windows/CL 3.12.0.2 / 2007.07.15 21:04 (Vba32.W) ?
?       Copyright (c) 1993-2007 by VBA Ltd.          ?
酝屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯图
Key file not found
Demo mode
Command line options:
/r=susp.rpt /ha=3 /collect_suspects /nc /af+ /ar+ /bt- /mr- /wk+ /ml+ /rw+ /as-
Ctrl-C will terminate program execution

C:\virus\server.rar
C:\...\server.exe : is suspected of Trojan-Spy.Banker.68 (paranoid heuristics)

Directories    : 0    Files in archives:    Files on disks:
Archives:                - total    : 1    - total    : 2
- scanned       : 1    -  scanned : 1    - scanned    : 2
- contain viruses : 0    -  infected : 0    - infected : 0
- deleted       : 0    -  suspicious : 1    - suspicious  : 1

Startup : 10:48:43 25-07-2007
End       : 10:48:48 25-07-2007
Total time : 00:00:05

显示全部楼层 · 发表于 2007-7-25 11:21:18

Scan taken on 25 Jul 2007 03:19:16 (GMT)
A-Squared	Found nothing
AntiVir	Found BDS/Hupigon.Gen
ArcaVir	Found nothing
Avast	Found nothing
AVG Antivirus	Found Delf.AEO
BitDefender	Found DeepScan:Generic.Graybird.D64C6627
ClamAV	Found nothing
CPsecure	Found nothing
Dr.Web	Found Trojan.MulDrop.7999
F-Prot Antivirus	Found nothing
F-Secure Anti-Virus	Found nothing
Fortinet	Found nothing
Kaspersky Anti-Virus	Found nothing
NOD32	Found a variant of Win32/Delf.NFE
Norman Virus Control	Found nothing
Panda Antivirus	Found nothing
Rising Antivirus	Found nothing
Sophos Antivirus	Found Mal/Behav-004, Mal/Behav-053
VirusBuster	Found nothing
VBA32	Found Backdoor.GrayBird.1 (paranoid heuristics) (probable variant)

显示全部楼层 · 发表于 2007-7-25 11:23:15

Scan performed at: 2007-7-25 11:22:40
Scanning Log
NOD32 version 2417 (20070724) NT
Command line: C:\Documents and Settings\wangcheng\桌面\server.rar
C:\Program Files\Eset\nod32.exe - is OK

Date: 25.7.2007 Time: 11:22:42
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\wangcheng\桌面\server.rar
C:\Documents and Settings\wangcheng\桌面\server.rar ?RAR ?server.exe - a variant of Win32/Delf.NFE trojan
Number of scanned files: 2
Number of threats found: 1
Number of active threats: 1
Time of completion: 11:22:43 Total scanning time: 1 sec (00:00:01)

[病毒样本] 继续发MD5: 1FE3A58

本帖子中包含更多资源

本帖子中包含更多资源