挖掘者【a85de8 8acca2】

显示全部楼层 · 发表于 2007-8-20 00:20:36

egin scan in 'C:\Documents and Settings\dell\桌面\exe.rar'
C:\Documents and Settings\dell\桌面\exe.rar
  [0] Archive type: RAR
  --> file.exe
   [DETECTION] Contains signature of the worm WORM/Zhelatin.Gen
  --> msdataaccess.exe
   [DETECTION] Contains signature of the worm WORM/Zhelatin.Gen
   [INFO]    The file was successfully wiped!
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-8-20 04:32:01

扫描不报
看下运行，主动防御拦截
后一个msdateaccess.exe运行，监控直接删除

显示全部楼层 · 发表于 2007-8-20 06:37:03

C:\Documents and Settings\Administrator\桌面\exe.rar=>file.exe Infected: Trojan.Peed.IFP
C:\Documents and Settings\Administrator\桌面\exe.rar=>file.exe Disinfection failed
C:\Documents and Settings\Administrator\桌面\exe.rar=>file.exe Move failed
C:\Documents and Settings\Administrator\桌面\exe.rar=>msdataaccess.exe Infected: Trojan.Peed.IFP
C:\Documents and Settings\Administrator\桌面\exe.rar=>msdataaccess.exe Disinfection failed
C:\Documents and Settings\Administrator\桌面\exe.rar=>msdataaccess.exe Move failed

显示全部楼层 · 发表于 2007-8-20 08:28:16

检测到病毒: Email-Worm.Win32.Zhelatin.gk (2x)

发现病毒,在下载网页内容时.

地址: bbs.kafan.cn

[病毒样本] 挖掘者【a85de8 8acca2】

本帖子中包含更多资源

浏览过的版块