小小的一只[MD5: AC1CE0]

显示全部楼层 · 发表于 2007-8-16 22:26:57

[MD5: AC1CE0]

显示全部楼层 · 发表于 2007-8-16 22:28:28

咖啡，蜘蛛PASS!

显示全部楼层 · 发表于 2007-8-16 22:28:32

过BD，驱逐舰~~~~~~~~~~~~~~~~~~·

显示全部楼层 · 发表于 2007-8-16 22:38:14

Start of the scan: 2007年8月16日  22:37

Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\my_70032.rar
  [0] Archive type: RAR
  --> my_70032.exe
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    The file was deleted!

End of the scan: 2007年8月16日  22:37
Used time: 00:12 min

The scan has been done completely.

   1 Scanning directories
   2 Files were scanned
   1 viruses and/or unwanted programs were found
   1 classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   0 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes
   0 Hidden objects were found

显示全部楼层 · 发表于 2007-8-16 22:41:49

微点：
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MY_70032.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:2376
远端地址:58.211.7.25(江苏·苏州)
远端端口:80
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TEMPAQ
协议类型:TCP
本地地址:0.0.0.0
本地端口:2397
远端地址:58.211.7.35(江苏·苏州)
远端端口:80程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MY_70032.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TEMPAQ
2) C:\WINDOWS.0\SYSTEM32\DRIVERS\YW7ZITG.SYS
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-8-16 22:48:51

江苏老客户? qqhelper不奏效了..

显示全部楼层 · 发表于 2007-8-16 23:13:35

vba32 miss

显示全部楼层 · 发表于 2007-8-17 00:15:48

nod miss

显示全部楼层 · 发表于 2007-8-17 01:04:07

DRWEB挂

PS:看来LZ经常从FF转样本过来，记得在FF也多发样本喔。

显示全部楼层 · 发表于 2007-8-17 01:23:36

这病毒小A启发了还是咋滴拦截了不让下

[病毒样本] 小小的一只[MD5: AC1CE0]

本帖子中包含更多资源

浏览过的版块