母亲 734604 孩子 [MD5: D2373F 9743AE 3D0D53 C1E336]

显示全部楼层 · 发表于 2007-8-15 02:19:32

这个页面将显示安全盾阻止的文件和进程，如果你想手动配置你的安全设置，请先认真阅读设置说明。
每改动或新增一项设置，请随时查看本页面是否阻止了你的正常程序。
如果你对网上下载的某个程序不放心，你可以先试安装，安装后程序运行如果有问题，可以采用“不信任程序安装”模式。
该模式在工作中会对有可能的木马启动项及文件弹出提示是否继续安装。而如果安装某个确信没有问题的程序后失败(比如硬
件驱动或微软补丁)，可以使用“信任程序安装”模式。
首次运行安全盾请检查监控设置页的网页监视是否自动侦测到您的浏览器,如果没有请手动添加您的浏览器。

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JF5FJ9SW\sdadlrow-t2[1].exe  2007-08-15 02:16:33
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\XYHXSTUM\wr-1-361[1].exe  2007-08-15 02:16:35
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WSTIAARK\user10[1].exe  2007-08-15 02:16:39
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4L2N0HI7\3[1].exe  2007-08-15 02:16:44

显示全部楼层 · 发表于 2007-8-15 02:23:28

病毒: Win32:VB-AIF [Trj]
文件: 样本[1].rar
目录: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EGMKN5N4
进程: Maxthon.exe

检测到一个应用程序尝试创建一个 DNS 请求
询问名称:
DNS 服务器: 61.128.114.133, 61.128.114.166

显示全部楼层 · 发表于 2007-8-15 03:08:03

TrustPort Antivirus pass

显示全部楼层 · 发表于 2007-8-15 03:09:53

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\新建文件夹'
C:\Documents and Settings\Administrator\桌面\新建文件夹\5C.rar
  [0] Archive type: RAR
  --> 5C.exe
   [DETECTION] Contains code of the Windows virus W32/Virut.P
   [INFO]    The file was moved to '46effe53.qua'!

End of the scan: 2007年8月15日  03:10
Used time: 00:03 min

The scan has been done completely.

   1 Scanning directories
   7 Files were scanned
   1 viruses and/or unwanted programs were found
   0 classified as suspicious:
   0 files were deleted
   0 files were repaired
   1 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   6 Files not concerned
   2 Archives were scanned
   0 Warnings
   0 Notes
   0 Hidden objects were found

显示全部楼层 · 发表于 2007-8-15 03:29:21

Scan performed at: 2007-8-15 3:29:12
Scanning Log
NOD32 version 2460 (20070814) NT
Command line: C:\Documents and Settings\EQ2\桌面\5C.rar
Operating memory - is OK

Date: 15.8.2007 Time: 03:29:18
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\5C.rar
C:\Documents and Settings\EQ2\桌面\5C.rar ?RAR ?5C.exe - Win32/Virut.NAI virus - was a part of the deleted object
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 03:29:18 Total scanning time: 0 sec (00:00:00)

显示全部楼层 · 发表于 2007-8-15 08:25:58

Start of the scan: 2007年8月15日  08:24

Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\5C.rar
  [0] Archive type: RAR
  --> 5C.exe
   [DETECTION] Contains code of the Windows virus W32/Virut.P
   [INFO]    The file was deleted!

End of the scan: 2007年8月15日  08:25
Used time: 00:13 min

The scan has been done completely.

   1 Scanning directories
   7 Files were scanned
   1 viruses and/or unwanted programs were found
   0 classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   6 Files not concerned
   2 Archives were scanned
   0 Warnings
   0 Notes
   0 Hidden objects were found

显示全部楼层 · 发表于 2007-8-15 08:27:37

显示全部楼层 · 发表于 2007-8-15 08:27:52

===================================================================================================
Norman Virus Control On-demand scanner 7.0.0.9

NSE revision 5.91.04
nvcbin.def revision 5.90.00 of 2007/08/09 20:07:15 (824384 variants)
nvcmacro.def revision 5.90.00 of 2007/08/06 19:46:49 (20358 variants)
Total number of variants: 844742
===================================================================================================

   Time  Filename                                                    Virus name
---------------------------------------------------------------------------------------------------

- Scanning drive: F:\
- Scanning system areas of drive: F:\
- Scanning files in the directory: F:\v\v1\
   31 ms F:\v\v1\3.exe
   16 ms F:\v\v1\5C.exe                                              Virus W32/Virut.G ()
- File F:\v\v1\5C.exe quarantined.
- File F:\v\v1\5C.exe deleted.
   16 ms F:\v\v1\sdadlrow-t2.exe
      0 ms F:\v\v1\user10.exe
      0 ms F:\v\v1\waverevenue.exe

===================================================================================================

The scanning started: 2007/08/15 08:27:27
            ended: 2007/08/15 08:27:28
Logged on as       : Administrator
on hostname       : 2FF87FC2B9AB46F

Scanning results:
Total number of files found..............................:    5
Number of files scanned..................................:    5
Number of files/directories skipped due to exclude list..:    0
Number of files that could not be opened.................:    0
Number of archive files unpacked.........................:    0
Number of archive files not unpacked.....................:    0
Number of infections.....................................:    1

Copyright (c) 1993-2005 Norman ASA.

显示全部楼层 · 发表于 2007-8-15 08:40:28

红伞
5C
Virus or unwanted program 'W32/Virut.P [W32/Virut.P]'
detected in file 'C:\Documents and Settings\****\Local Settings\Temp\Rar$EX00.187\5C.exe.
Action performed: Deny access

样本
运行所有文件
红伞和微点未报

显示全部楼层 · 发表于 2007-8-15 09:10:21

样本
微点：
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\5C.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:1252
远端地址:64.187.111.183(加拿大)
远端端口:80
没什么动作么
驱逐舰样本挂
5C只报一个

[病毒样本] 母亲 734604 孩子 [MD5: D2373F 9743AE 3D0D53 C1E336]

本帖子中包含更多资源

红伞扫描

本帖子中包含更多资源

本帖子中包含更多资源