刚才那个下载者下载的病毒【4B03C2】

显示全部楼层 · 发表于 2007-7-27 20:47:05

经过我深层次的分析，何止下载一个 1.exe 那么简单啊！

分别下载
http://qqgood.dns0755.net/down/1.exe

http://qqgood.dns0755.net/down/a.exe

http://qqgood.dns0755.net/down/2.exe

http://qqgood.dns0755.net/down/3.exe

显示全部楼层 · 发表于 2007-7-27 20:48:25

显示全部楼层 · 发表于 2007-7-27 20:48:53

我是顺着sandbox下来的
不敢运行
xp上没装svs

显示全部楼层 · 发表于 2007-7-27 20:49:22

2007/7/27 20:49:11 Scanning Log
2007/7/27 20:49:11 Version of virus signature database: 2425 (20070727)
2007/7/27 20:49:11 Date: 27.7.2007 Time: 20:49:11
2007/7/27 20:49:11 Scanned disks, folders and files: F:\v\ggggg.rar
2007/7/27 20:49:16 F:\v\ggggg.rar - multiple threats [7] - deleted - quarantined
2007/7/27 20:49:16 F:\v\ggggg.rar » RAR » 1.exe - probably unknown NewHeur_PE virus [7]
2007/7/27 20:49:16 F:\v\ggggg.rar » RAR » 2.exe - Win32/PSW.Agent.NFX trojan
2007/7/27 20:49:16 F:\v\ggggg.rar » RAR » 3.exe - a variant of Win32/Hupigon trojan
2007/7/27 20:49:16 Number of scanned files: 5
2007/7/27 20:49:16 Number of threats found: 3
2007/7/27 20:49:16 Time of completion: 20:49:16 Total scanning time: 5 sec (00:00:05)
2007/7/27 20:49:16 Notes:
2007/7/27 20:49:16 [7] File is probably infected with an unknown virus.

显示全部楼层 · 发表于 2007-7-27 20:50:03

我的XP系统经过我的改造，任何病毒都无法运行

内核是Linux的，运行层是Windows模拟

显示全部楼层 · 发表于 2007-7-27 20:51:06

晕linux
强悍

显示全部楼层 · 发表于 2007-7-27 20:53:16

4只全灭

显示全部楼层 · 发表于 2007-7-27 20:56:50

F:\ggggg.rar:<RAR>\1.exe : infected MalwareScope.Trojan-PSW.Game.13
F:\ggggg.rar:<RAR>\2.exe : infected AdWare.Win32.BHO.cd
F:\ggggg.rar:<RAR>\3.exe : infected MalwareScope.Trojan-PSW.Game.14
F:\ggggg.rar:<RAR>\a.exe : is suspected of Downloader.Small.18

显示全部楼层 · 发表于 2007-7-27 21:07:39

微点:
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\2.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\XUNLEIBHO_001.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\3.EXE
是否删除木马程序及其衍生物?
a.exe微点挂了,上报

显示全部楼层 · 发表于 2007-7-27 21:13:13

BitDefender

This web page has been blocked by BitDefender Antivirus Real-time Protection!

The blocked web page included objects that were either infected or likely to be infected with a virus. Your system has NOT been infected.
http://www.bitdefender.com/vfind/?q=GenPack:Worm.Delf.CJ
http://www.bitdefender.com/vfind/?q=BehavesLike:Win32.ExplorerHijack
http://www.bitdefender.com/vfind/?q=Dropped:Trojan.PWS.Agent.KS
http://www.bitdefender.com/vfind/?q=Trojan.PWS.QQPass.NBP

刚才那个下载者下载的病毒【4B03C2】

本帖子中包含更多资源

本帖子中包含更多资源

回复 #5 chenzhan 的帖子

本帖子中包含更多资源