[MD5: 561318] a little

显示全部楼层 · 发表于 2007-8-6 09:09:28

运行试试

显示全部楼层 · 发表于 2007-8-6 09:11:12

BitDefender

This web page has been blocked by BitDefender Antivirus Real-time Protection!

The blocked web page included objects that were either infected or likely to be infected with a virus. Your system has NOT been infected.

显示全部楼层 · 发表于 2007-8-6 09:20:51

--> 1.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    A backup was created as '46e97778.qua'  ( QUARANTINE )
      [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-8-6 09:29:11

显示全部楼层 · 发表于 2007-8-6 09:34:37

显示全部楼层 · 发表于 2007-8-6 09:35:51

SYSTEM32下释放ggkb.bat
改时间 PING。。。。
然后复制自身到SYSTEM32下4310FAA3.EXE
删除源文件。。

显示全部楼层 · 发表于 2007-8-6 09:39:33

时间被修改到了00年，6楼分析正确

显示全部楼层 · 发表于 2007-8-6 10:44:59

Win32:Agent-JOF [Trj]

显示全部楼层 · 发表于 2007-8-6 10:45:55

微点砍掉

显示全部楼层 · 发表于 2007-8-6 10:56:27

Kaspersky Anti-Virus 7.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=109713 is infected with Trojan.BAT.KillAV.ff virus

[病毒样本] [MD5: 561318] a little

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

回复 #6 lsyer 的帖子

本帖子中包含更多资源