捡到3个[MD5: BEF1A9 1B7C0E 34CEAD]

显示全部楼层 · 发表于 2007-8-29 21:26:18

[MD5: BEF1A9 1B7C0E 34CEAD]

显示全部楼层 · 发表于 2007-8-29 21:28:58

扫描进行于：2007-8-29 21:28:17
扫描日志
NOD32版本 2490 (20070829) NT
命令行： D:\Documents and Settings\EKINCHENG\桌面\???.rar

日期： 29.8.2007 时间：21:28:19
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：D:\Documents and Settings\EKINCHENG\桌面\???.rar
D:\Documents and Settings\EKINCHENG\桌面\???.rar >>RAR >>rav.exe - Win32/Bifrose.ADR 木马的变种
已扫描的文件数目：4
已发现的病毒数目：1
已清除病毒的文件数目：1
完成时间： 21:28:19 总扫描时间：0 秒 (00:00:00)

显示全部楼层 · 发表于 2007-8-29 21:29:39

Ikarus:
29:08:2007 21:27:36 SEARCHTASK "USER_DEFINED" started...
scan item: C:\Documents and Settings\zhenjia\桌面\很多.rar
File scanned: C:\Documents and Settings\zhenjia\桌面\很多.rar:Zone.Identifier
File scanned: C:\Documents and Settings\zhenjia\桌面\很多.rar - SIGNATURE FOUND "Backdoor.Win32.Bifrose.aci"
29:08:2007 21:27:37 SEARCHTASK "USER_DEFINED" FINISHED...
----------------------------------------------------
Directories scanned: 0
Files scanned: 1
Virus found: 1
----------------------------------------------------

AntiVir:
Begin scan in 'C:\Documents and Settings\zhenjia\桌面\很多.rar'
C:\Documents and Settings\zhenjia\桌面\很多.rar
  [0] Archive type: RAR
  --> rav.exe
   [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Agent.BKY Backdoor server programs
   [INFO]    A backup was created as '4703cdb9.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-8-29 21:37:10

已删除: 病毒 Heur.Trojan.Generic (变种) 文件: D:\病毒库\很多.rar/rav.exe

显示全部楼层 · 发表于 2007-8-29 22:20:20

已删除: 病毒 Heur.Trojan.Generic (变种) 文件: E:\test\很多.rar/rav.exe

显示全部楼层 · 发表于 2007-8-29 22:45:46

===================================================================================================
NVCOD On Demand Scanner 5.80.02

NSE revision 5.91.04
nvcbin.def revision 5.90.00 of 2007/08/29 18:15:35 (869548 variants)
nvcmacro.def revision 5.90.00 of 2007/08/27 15:12:22 (20360 variants)
Total number of variants: 889908
Command line: "@C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~OD8.tmp"
===================================================================================================

   Time  Filename                                                    Virus name
---------------------------------------------------------------------------------------------------
- Scanning files matching: F:\v\addon.dat
      0 ms F:\v\addon.dat
      0 ms F:\v\addon.dat:Zone.Identifier
- Scanning files matching: F:\v\key.exe
   4141 ms F:\v\key.exe                                              Virus W32/Malware ( [ General information ]
* **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
* Attempts to run Visual Basic Script (VBS).
* File length:    249945 bytes.

[ Changes to filesystem ]
* Creates directory C:.
* Creates directory C:\WINDOWS.
* Creates directory C:\WINDOWS\TEMP.
* Creates directory C:\WINDOWS\TEMP\RarSFX0.
* Creates file C:\WINDOWS\TEMP\RarSFX0\__tmp_rar_sfx_access_check_74990.
* Deletes file __tmp_rar_sfx_access_check_74990.
* Creates file C:\WINDOWS\TEMP\RarSFX0\key.exe.
* Creates file C:\WINDOWS\TEMP\RarSFX0\1.vbs.
* Creates file C:\WINDOWS\TEMP\RarSFX0\1.exe.

[ Changes to registry ]
* Creates key "HKCU\Software\WinRAR SFX".
* Sets value "c%%"="C:\WINDOWS\TEMP\RarSFX0" in key "HKCU\Software\WinRAR SFX".

[ Process/window information ]
* Attemps to NULL C:\WINDOWS\TEMP\RarSFX0\1.vbs NULL.

)
      0 ms F:\v\key.exe:Zone.Identifier
- Scanning files matching: F:\v\rav.exe
   390 ms F:\v\rav.exe
      0 ms F:\v\rav.exe:Zone.Identifier
- File F:\v\key.exe quarantined.
- File F:\v\key.exe deleted.

===================================================================================================

The scanning started: 2007/08/29 22:45:33
            ended: 2007/08/29 22:45:38
Logged on as       : Administrator
on hostname       : 2FF87FC2B9AB46F

Scanning results:
Total number of files found..............................:    6
Number of files scanned..................................:    6
Number of files/directories skipped due to exclude list..:    0
Number of files that could not be opened.................:    0
Number of archive files unpacked.........................:    0
Number of archive files not unpacked.....................:    0
Number of infections.....................................:    1

Copyright (c) 1993-2005 Norman ASA.

显示全部楼层 · 发表于 2007-8-29 23:21:27

Starting the file scan:

Begin scan in 'F:\病毒样本\很多.rar'
F:\病毒样本\很多.rar
  [0] Archive type: RAR
  --> rav.exe
   [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Agent.BKY Backdoor server programs
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-8-29 23:27:52

rav.exe ..

Keygen.exe只是捆绑了个 1.exe ,运行后ess k i l l ..和上面一个报的一样..

XXX.dat pass ..

显示全部楼层 · 发表于 2007-8-30 00:47:00

显示全部楼层 · 发表于 2007-8-30 05:53:05

Product: BitDefender 9 Professional Plus
// Version: 9.5
//
// 创建在: 29/08/2007 23:54:13
//
//-----------------------------------------------------------------

病毒统计

扫描路径 : D:\下载文件夹\很多.rar
文件夹 : 0
文件 : 4
存档 : 1
被压缩的文件 : 0
被识别的病毒 : 1
被感染文件 : 1
警告 : 0

[病毒样本] 捡到3个[MD5: BEF1A9 1B7C0E 34CEAD]

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源