一个过卡扫一个没过

scottxzt

Begin scan in 'C:\Documents and Settings\dell\桌面\msdataaccess[1].rar'
C:\Documents and Settings\dell\桌面\msdataaccess[1].rar
  [0] Archive type: RAR
  --> msdataaccess[1].exe
      [DETECTION] Contains signature of the worm WORM/Zhelatin.Gen
  --> file[1].exe
      [DETECTION] Contains signature of the worm WORM/Zhelatin.Gen
      [INFO]      The file was successfully wiped!
      [INFO]      The file was deleted!

taihuxian

Time        Module        Object        Name        Threat        Action        User        Information
2007-8-20 19:51:12        AMON        file        C:\Documents and Settings\Administrator\×ÀÃæ\msdataaccess[1]\file[1].exe        probably a variant of Win32/Nuwar worm        quarantined - deleted                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe. The file was moved to quarantine. You may close this window.
2007-8-20 19:50:53        AMON        file        C:\Documents and Settings\Administrator\×ÀÃæ\msdataaccess[1]\msdataaccess[1].exe        probably a variant of Win32/Nuwar worm        quarantined - deleted                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe. The file was moved to quarantine. You may close this window.

残缺的唯美

咖啡pass

微点卫士

微点:
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ECARD.EXE
被修改文件:
C:\WINDOWS.0\SYSTEM32\DRIVERS\KBDCLASS.SYS
是否阻止文件被修改?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ECARD.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SPOOLDR.EXE
2) C:\WINDOWS.0\SYSTEM32\SPOOLDR.SYS
是否删除病毒程序及其衍生物?

拦截第2个时死机

碧水寒潭

Start of the scan: 2007年8月20日  21:04

Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\msdataaccess[1].rar
  [0] Archive type: RAR
  --> msdataaccess[1].exe
      [DETECTION] Contains signature of the worm WORM/Zhelatin.Gen
  --> file[1].exe
      [DETECTION] Contains signature of the worm WORM/Zhelatin.Gen
      [INFO]      The file was deleted!


End of the scan: 2007年8月20日  21:04
Used time: 00:09 min

The scan has been done completely.

      1 Scanning directories
      3 Files were scanned
      2 viruses and/or unwanted programs were found
      0 classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

jhtl

原帖由 微点卫士 于 2007-8-20 21:00 发表
微点:
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ECARD.EXE
被修改文件:
C:\WINDOWS.0\SYSTEM32\DRIVERS\KBDCLASS.SYS
是否阻止文件被修改?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\ ...

特征码还应该是主要的防御措施，主动防御只能作为辅助。

yurius

C:\virus\msdataaccess[1].exe - infected with Trojan.Packed.142
C:\virus\file[1].exe - infected with Trojan.Packed.142

我自逍遥

用AntiVirusKit扫描病毒
版本 16.0.7
病毒库签名 2007-8-20
开始时间: 2007-8-20 23:42
引擎: KAV 引擎 (AVK 17.7001), BD  引擎 (BD 17.4789)
启发式: 打开
压缩文件: 打开
系统区域: 打开

扫描系统区域...
扫描所选择的目录和文件...
对象: msdataaccess[1].exe
        在压缩档案里: D:\Documents and Settings\Administrator\桌面\msdataaccess[1].rar
        Status: 已发现病毒
        病毒: Email-Worm.Win32.Zhelatin.gk (KAV 引擎)
对象: file[1].exe
        在压缩档案里: D:\Documents and Settings\Administrator\桌面\msdataaccess[1].rar
        Status: 已发现病毒
        病毒: Email-Worm.Win32.Zhelatin.gk (KAV 引擎)
对象: msdataaccess[1].rar
        路径: D:\Documents and Settings\Administrator\桌面
        Status: 已发现病毒
        病毒: Email-Worm.Win32.Zhelatin.gk (2x) (KAV 引擎)
分析完毕: 2007-8-20 23:42
    已检查 1 个文件
    已发现 1 个染毒文件
    发现 0 个可疑文件

xxx1900

kav7下载 前就报 了

hkt988

Product: BitDefender 9 Professional Plus
//        Version: 9.5
//
//        创建在:        20/08/2007        23:17:54
//
//-----------------------------------------------------------------


病毒统计

扫描路径        : D:\下载文件夹\msdataaccess[1].rar
文件夹        : 0
文件        :  3
存档        : 1
被压缩的文件        : 0
被识别的病毒        : 2
被感染文件        : 2