一个[DF3D3D]

一派胡言

江民飘过。

woai_jolin

===================================================================================================
NVCOD On Demand Scanner 5.80.02

NSE revision 5.91.02
nvcbin.def revision 5.90.00 of 2007/07/24 08:21:08 (815016 variants)
nvcmacro.def revision 5.90.00 of 2007/06/29 06:32:19 (20341 variants)
Total number of variants: 835357
Command line: "@C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~OD12.tmp"
===================================================================================================

       Time  Filename                                                     Virus name
---------------------------------------------------------------------------------------------------
- Scanning files matching: F:\v\bbs.exe
      437 ms F:\v\bbs.exe                                                 Virus W32/Malware ( [ General information ]
    * **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
    * Accesses executable file from resource section.
    * File length:        66560 bytes.

[ Changes to filesystem ]
    * Creates file C:\WINDOWS\SYSTEM32\mupdate.exe.
    * Creates file C:\WINDOWS\msearch.dll.

[ Changes to registry ]
    * Creates key "HKCR\CLSID\{6843E020-2197-44EC-B621-A4508CCAE168}".
    * Sets value ""="TFHOOK" in key "HKCR\CLSID\{6843E020-2197-44EC-B621-A4508CCAE168}".
    * Creates key "HKCR\CLSID\{6843E020-2197-44EC-B621-A4508CCAE168}\InProcServer32".
    * Sets value ""="C:\WINDOWS\msearch.dll" in key "HKCR\CLSID\{6843E020-2197-44EC-B621-A4508CCAE168}\InProcServer32".
    * Sets value "ThreadingModel"="Apartment" in key "HKCR\CLSID\{6843E020-2197-44EC-B621-A4508CCAE168}\InProcServer32".

[ Network ]
    * Hooks into Shell explorer.

[ Process/window information ]
    * Creates a mutex TFExeMutex.

)
- File F:\v\bbs.exe quarantined.
- File F:\v\bbs.exe deleted.

===================================================================================================

The scanning started: 2007/07/25 16:12:38
               ended: 2007/07/25 16:12:38
Logged on as        : Administrator
on hostname         : 2FEA146376E2420

Scanning results:
   Total number of files found..............................:       1
   Number of files scanned..................................:       1
   Number of files/directories skipped due to exclude list..:       0
   Number of files that could not be opened.................:       0
   Number of archive files unpacked.........................:       0
   Number of archive files not unpacked.....................:       0
   Number of infections.....................................:       1

Copyright (c) 1993-2005 Norman ASA.

promised

MM
C:\ABC\bbs.rar:\bbs.exe - 特征码 'Trojan-Dropper.Win32.Delf.MM' 被发现
C:\ABC\bbs.rar

        2 个文件被扫描
          (1 个压缩档 1 个文件)
        1 个特征码被侦测
        0 个可疑代码段被发现
        耗时: 0:00.015

微点卫士

金山挂
费尔报带壳程序Packed.NSPack.a,第一次看见费尔这么报

xxwpk007

已检测到: 木马程序 Trojan-PSW.Win32.OnLineGames.wo        URL: http://bbs.kafan.cn/attachment.php?aid=104815//bbs.exe

woai_jolin