过卡巴的一支［MD5:546ca2］

显示全部楼层 · 发表于 2007-8-14 20:41:40

原帖由 zxkf 于 2007-8-14 20:33 发表

有改系统时间么？偶这里设置不能改系统时间的，但MS这支不单过了卡巴的扫描，连主动防御都过了，有用卡7的试试～

如果锁定系统时间
微点：
程序:
C:\WINDOWS.0\SYSTEM32\CRSSS.EXE
由
C:\AUTORUN.INF
自启动运行!
并生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\CRSSS.EXE
2) C:\GHO.EXE
3) C:\AUTORUN.INF
以及可由此INF文件引导自启的文件:
C:\GHO.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.531\GHO.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.531\GHO.EXE
删除失败!
延迟删除文件!

显示全部楼层 · 发表于 2007-8-14 21:06:04

显示全部楼层 · 发表于 2007-8-14 21:28:00

卡巴7 来试试

显示全部楼层 · 发表于 2007-8-14 21:52:55

Start of the scan: 2007年8月14日  21:52

Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\Suspicious.part5.rar
  [0] Archive type: RAR
  --> GHO.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [INFO]    The file was deleted!

End of the scan: 2007年8月14日  21:52
Used time: 00:09 min

The scan has been done completely.

   1 Scanning directories
   2 Files were scanned
   1 viruses and/or unwanted programs were found
   0 classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes
   0 Hidden objects were found

显示全部楼层 · 发表于 2007-8-14 22:11:22

http://bbs.kafan.cn/attachment.php?aid=113648\GHO.exe\[NsPack] [L] Win32:Delf-FKN [Trj] (0)
文件被成功移至隔离区...

显示全部楼层 · 发表于 2007-8-15 01:09:39

搞错了过不了卡7的前慑防御

CreateFile C:\WINDOWS\system32\crsss.exe
CreateRegValue \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\crsss

显示全部楼层 · 发表于 2007-8-15 03:11:00

TrustPort Antivirus pass

显示全部楼层 · 发表于 2007-8-15 06:06:03

Worm.Win32.Small.w

显示全部楼层 · 发表于 2007-8-15 11:45:56

亲自试验过了，过了卡7的主动防御。

显示全部楼层 · 发表于 2007-8-15 11:48:46

卡巴可以杀，
已删除: 病毒 Virus.Win32.AutoRun.cp 文件: C:\Documents and Settings\gho\桌面\GHO.exe

[病毒样本] 过卡巴的一支［MD5:546ca2］

本帖子中包含更多资源

本帖子中包含更多资源

红伞杀了