a77c30 a218ff fec644

显示全部楼层 · 发表于 2007-8-14 15:37:29

微点：
木马名称:Trojan-PSW.Win32.OnLineGames.idt

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S168.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MH.EXE
1) C:\DFD5626390.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MH.EXE
1) C:\DFD5626390.BAT
是否删除可疑程序?
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MMINSTALL.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:1206
远端地址:58.211.7.35(江苏·苏州)
远端端口:80
mminstall三个生成物，微点又挂在这里了

显示全部楼层 · 发表于 2007-8-14 15:38:00

http://bbs.kafan.cn/attachment.php?aid=113522\s168.exe\[UPX]\[Embedded#52f0]\[UPX] [L] Win32:Autorun-U (0)
File was successfully moved to chest...

显示全部楼层 · 发表于 2007-8-14 15:43:24

显示全部楼层 · 发表于 2007-8-14 15:45:31

Start of the scan: 2007年8月14日  15:44

Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\3.zip
  [0] Archive type: ZIP
  --> s168.exe
   [DETECTION] Is the Trojan horse TR/Autorun.BK
  --> mh.exe
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    The file was deleted!

End of the scan: 2007年8月14日  15:44
Used time: 00:16 min

The scan has been done completely.

   1 Scanning directories
   4 Files were scanned
   2 viruses and/or unwanted programs were found
   1 classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes
   0 Hidden objects were found

显示全部楼层 · 发表于 2007-8-14 15:45:36

病毒: Virus.Win32.AutoRun.bk, Trojan-Spy.Win32.Delf.uv, Trojan-Downloader.Win32.Agent.bbb
文件: 3[1].zip
目录: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EGMKN5N4
进程: Maxthon.exe

显示全部楼层 · 发表于 2007-8-14 15:45:46

NOD32启发

显示全部楼层 · 发表于 2007-8-14 16:03:48

显示全部楼层 · 发表于 2007-8-14 16:07:10

为PC护航风暴微塔
_____________________________________________

         风暴微塔反病毒
                        [内测版]
               http://www.v0day.com/
----------------------------------------------
开始扫描……

[C:\Documents and Settings\Administrator\桌面\virus\3.zip]
                  …………引擎[2]发现病毒:Win32.Unknow
OK  扫描完毕！

显示全部楼层 · 发表于 2007-8-14 16:11:43

Scan duration: 00:00:04

Scan areas:
F:\v\n\3.zip  - recursive

Objects
-------------------
Scanned       4       Disinfected    0
Infected       1       Deleted       0
Suspicious    1       Quarantined    0

Error(s) occurred during the scan: 0

[病毒样本] a77c30 a218ff fec644

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源