小熊福建的vip[57C925]

taitan001

现在挂着呢·····
还有个exe
vba挂

[ 本帖最后由 promised 于 2007-8-13 09:32 编辑 ]

1688388728

扫描进行于：2007-08-12 20:27:11
扫描日志
NOD32版本 2453 (20070812) NT
命令行： D:\病毒库\New Folder.rar
C:\Program Files\Eset\nod32.exe - 是正常的

日期： 12.8.2007  时间：20:27:14
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：D:\病毒库\New Folder.rar
D:\病毒库\New Folder.rar >>RAR >>New Folder\microsofts.exe - 未查明的 NewHeur_PE 病毒 [7]
D:\病毒库\New Folder.rar >>RAR >>New Folder\vip[1].exe - 未查明的 NewHeur_PE 病毒 [7]
D:\病毒库\New Folder.rar >>RAR >>New Folder\microsofts.bat - 未查明的 NewHeur_PE 病毒 [7]
D:\病毒库\New Folder.rar:Zone.Identifier - 是正常的
已扫描的文件数目：5
已发现的病毒数目：3
活动的病毒数目：1
完成时间： 20:27:14 总扫描时间：0 秒 (00:00:00)

注意：
[7] 该文件可能感染上未知病毒。

sb

江民挂了

东京时空

NIS2007又没报了，我操他妈的

nstyle

小红伞
Begin scan in 'C:\Documents and Settings\fd\桌面\New Folder.rar'
C:\Documents and Settings\fd\桌面\New Folder.rar
  [0] Archive type: RAR
  --> New Folder\microsofts.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> New Folder\vip[1].exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> New Folder\microsofts.bat
      [DETECTION] The file name contains an executable file extension disguised as a harmless one HEUR-DBLEXT/Crypted
      [INFO]      The file was deleted!

End of the scan: 2007年8月12日  20:37
Used time: 00:07 min
The scan has been done completely.
      0 Scanning directories
      4 Files were scanned
      3 viruses and/or unwanted programs were found
      1 classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      0 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

自由

3个启发
已删除: 病毒 Heur.Trojan.Generic (变种)        文件: C:\Documents and Settings\Administrator\桌面\New Folder.rar/New Folder\microsofts.exe//FSG
已删除: 病毒 Heur.Trojan.Generic (变种)        文件: C:\Documents and Settings\Administrator\桌面\New Folder.rar/New Folder\vip[1].exe//FSG
已删除: 病毒 Heur.Trojan.Generic (变种)        文件: C:\Documents and Settings\Administrator\桌面\New Folder.rar/New Folder\microsofts.bat//FSG

微点卫士

微点：
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\NEW FOLDER\VIP[1].EXE
是可疑程序!
试图修改系统时间!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\NEW FOLDER\VIP[1].EXE
是否删除病毒程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\NEW FOLDER\MICROSOFTS.EXE
是可疑程序!
试图修改系统时间!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\NEW FOLDER\MICROSOFTS.EXE
是否删除病毒程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\NEW FOLDER\MICROSOFTS.BAT
是可疑程序!
试图修改系统时间!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\NEW FOLDER\MICROSOFTS.BAT
是否删除病毒程序及其衍生物?

yashoo

已检测到: 病毒 Heur.Trojan.Generic (变种)        文件: E:\test\New_Folder.rar/New Folder\microsofts.exe//FSG
已检测到: 病毒 Heur.Trojan.Generic (变种)        文件: E:\test\New_Folder.rar/New Folder\vip[1].exe//FSG
已检测到: 病毒 Heur.Trojan.Generic (变种)        文件: E:\test\New_Folder.rar/New Folder\microsofts.bat//FSG

[ 本帖最后由 yashoo 于 2007-8-12 21:17 编辑 ]

yurius

卡巴、drweb、nod32都是启发

C:\virus\microsofts.exe - probably infected with BINARYRES
C:\virus\vip[1].exe - probably infected with BINARYRES
C:\virus\microsofts.bat - probably infected with BINARYRES

taihuxian

[0] Archive type: RAR
  --> New Folder\microsofts.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> New Folder\vip[1].exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> New Folder\microsofts.bat
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [INFO]      A backup was created as '47361665.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!