[MD5: 0374A1 4D3286]这样加壳都行..

显示全部楼层 · 发表于 2007-8-5 16:43:22

Setup.exe\[BeRoEXE]\[UPX]\[MaskPE]\[genPEcrypt] : (卡了11秒) Win32:Trojano-3485 [Trj]
Setup.exe\[?] 中间还有一个捆绑的跳过去了没看见
Setup.exe\[Embedded#17620]\[NsPack] : (卡了3秒) Win32:Hupigon-ZA [Trj]
Setup.exe : Win32:Trojan-gen. {Other}接着avast报错..
SoundMen.exe ：(又顿了3秒) Win32:Trojan-gen. {VC}

不知道今天机子怎么回事...

显示全部楼层 · 发表于 2007-8-5 16:47:06

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\SoundMen.rar'
C:\Documents and Settings\Administrator\桌面\
  SoundMen.rar
[0] Archive type: RAR
--> SoundMen.exe
      [DETECTION] Is the Trojan horse TR/Spy.32768
      [WARNING] Infected files in archives cannot be repaired!
--> Setup.exe
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    A backup was created as '472a8ef9.qua'  ( QUARANTINE )
      [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-8-5 16:47:34

斧头全干掉

江民杀毒软件报告文件

北京江民新科技术有限公司

扫描引擎 10.00.650
病毒库日期 2007-08-05
更新日期 2007-08-05

扫描目标 C:\Documents and Settings\Administrator\桌面\SoundMen.rar

开始时间 2007-08-05 16:46:50

在 C:\Documents and Settings\Administrator\桌面\SoundMen.rar->SoundMen.exe 中发现 Trojan/Agent.hgj 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\SoundMen.rar->Setup.exe 中发现 Trojan/PSW.OnLineGames.axd 病毒, 已删除
正常结束。

扫描结果:
               文件数 :448                               病毒体 :2
               删除 :2                                  解毒 :0
扫描速度(千字节/秒) :12329                            扫描时间 :00:00:10
扫描文件速度(个/秒) :44

== == ==       == == == == == == == == == == == == == == == == == == == == == == ==    == == == == == ==       == == ==

显示全部楼层 · 发表于 2007-8-5 16:49:35

趋势报！

显示全部楼层 · 发表于 2007-8-5 16:50:31

微点直接报了
木马名称:Trojan.Win32.Agent.fos

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SOUNDMEN.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

点GENERATE后
程序:
C:\WINDOWS.0\C+.EXE
可疑程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\SVCH0ST.EXE
2) C:\WINDOWS.0\DELETE.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SETUP.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\注册机.EXE
2) C:\WINDOWS.0\C+.EXE
3) C:\WINDOWS.0\SYSTEM32\SVCH0ST.EXE
是否删除木马程序及其衍生物?

程序:
C:\WINDOWS.0\C+.EXE
1) C:\WINDOWS.0\DELETE.BAT
是否删除可疑程序?

[ 本帖最后由微点卫士于 2007-8-5 16:51 编辑 ]

显示全部楼层 · 发表于 2007-8-5 16:52:42

原帖由 yym1988520 于 2007-8-5 16:49 发表
趋势报！

报的是什么，4楼的麻烦下回给截个图

显示全部楼层 · 发表于 2007-8-5 16:53:45

金山全部干掉

显示全部楼层 · 发表于 2007-8-5 16:53:59

卡巴6：
已检测: 木马程序 Trojan.Win32.StartPage.aoz 文件: C:\Documents and Settings\Administrator\桌面\SoundMen.rar/SoundMen.exe
已检测: 木马程序 Trojan-PSW.Win32.OnLineGames.mu 文件: C:\Documents and Settings\Administrator\桌面\SoundMen.rar/Setup.exe//BeRo//PE_Patch.UPX//UPX//PE_Patch.MaskPE//PE_Patch

红伞：
Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\SoundMen.rar'
C:\Documents and Settings\Administrator\桌面\SoundMen.rar
  [0] Archive type: RAR
  --> SoundMen.exe
   [DETECTION] Is the Trojan horse TR/Spy.32768
  --> Setup.exe
   [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-8-5 16:55:13

7楼的麻烦截个图

显示全部楼层 · 发表于 2007-8-5 16:56:42

原帖由 红心王子 于 2007-8-5 16:55 发表
7楼的麻烦截个图

金山报压缩包的毒都不显示病毒名称的诶,只显示病毒数

[病毒样本] [MD5: 0374A1 4D3286]这样加壳都行..

本帖子中包含更多资源