老顾客S168

显示全部楼层 · 发表于 2007-8-14 21:53:30

老顾客

[ 本帖最后由 Redevil 于 2007-8-14 23:08 编辑 ]

显示全部楼层 · 发表于 2007-8-14 21:54:25

病毒: Win32:Autorun-U
文件: S168.rar
目录: D:\病毒库
进程: Explorer.EXE

显示全部楼层 · 发表于 2007-8-14 21:54:53

Start of the scan: 2007年8月14日  21:54

Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\S168.rar
  [0] Archive type: RAR
  --> S168.exe
   [DETECTION] Is the Trojan horse TR/Autorun.BK
   [INFO]    The file was deleted!

End of the scan: 2007年8月14日  21:54
Used time: 00:09 min

The scan has been done completely.

   1 Scanning directories
   2 Files were scanned
   1 viruses and/or unwanted programs were found
   0 classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes
   0 Hidden objects were found

显示全部楼层 · 发表于 2007-8-14 21:55:27

AVAST灭之

显示全部楼层 · 发表于 2007-8-14 21:57:26

看来作者只专门过卡巴

显示全部楼层 · 发表于 2007-8-14 22:04:18

http://bbs.kafan.cn/attachment.php?aid=113712\S168.exe\[UPX]\[Embedded#52f0]\[UPX] [L] Win32:Autorun-U (0)
文件被成功移至隔离区...

显示全部楼层 · 发表于 2007-8-14 22:04:42

微点：
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S168.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\RKSLDK.BAK
2) C:\PROGRAM FILES\INTERNET EXPLORER\RKSLDK.DLL
3) C:\PROGRAM FILES\COMMON FILES\GOSKDL.DLL
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-8-14 22:05:35

A还比较可以的灭了

显示全部楼层 · 发表于 2007-8-14 23:04:15

C:\virus\S168.exe - infected with Win32.HLLW.Autoruner.175

显示全部楼层 · 发表于 2007-8-14 23:10:22

脱壳一层，NORTON马上报

[病毒样本] 老顾客S168

本帖子中包含更多资源

红伞扫描

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块