686c859

显示全部楼层 · 发表于 2007-8-30 10:06:33

某个样本的生成物.......

显示全部楼层 · 发表于 2007-8-30 10:08:10

Starting the file scan:

Begin scan in 'F:\病毒样本\ruixing.rar'
F:\病毒样本\ruixing.rar
  [0] Archive type: RAR
  --> ruixing.exe
   [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-8-30 10:15:12

MicroVita AntiSpyware 100 C
_____________________________________________

         风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]
               http://221.10.254.214/
----------------------------------------------
开始扫描……

[C:\Documents and Settings\Administrator\桌面\virus\ruixing.rar]
                  …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\ruixing.rar]
                  …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\ruixing.rar]
                  …………引擎[2]发现病毒:Win32.NkHack.Svk.A
OK  扫描完毕！

显示全部楼层 · 发表于 2007-8-30 10:15:37

江民杀毒 10.00.650 2007.08.28 2007-08-28 Trojan/PSW.GamePass.xqm 0.746
金山毒霸 2007.6.20.249 2007.8.30 2007-08-30 Packes.MaskPE.a 0.832

显示全部楼层 · 发表于 2007-8-30 10:16:13

微点：
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\RUIXING.EXE
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\_DELETEME.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\RUIXING.EXE
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\_DELETEME.BAT
是否删除可疑程序?

显示全部楼层 · 发表于 2007-8-30 10:20:06

K7 pass

显示全部楼层 · 发表于 2007-8-30 13:30:05

C:\Documents and Settings\uhthn\Desktop\virus\ruixing.exe : infected Trojan-Downloader.Win32.Banload.awy

Directories    : 0    Files in archives:    Files on disks:
Archives:                - total    : 0    - total    : 1
- scanned       : 0    -  scanned : 0    - scanned    : 1
- contain viruses : 0    -  infected : 0    - infected : 1
- deleted       : 0    -  suspicious : 0    - suspicious  : 0

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Heuristics - OPEN
Scan in - C:\Documents and Settings\uhthn\Desktop\virus

C:\Documents and Settings\uhthn\Desktop\virus\ruixing.exe - Suspicious of Win32.Trojan-PSW.Game.1

1 Files scanned
0 Infected files found
1 Suspicious files found
0 Files cured
0 Files deleted

显示全部楼层 · 发表于 2007-8-30 13:55:08

RS2007 19.38.30 Pass..

显示全部楼层 · 发表于 2007-8-30 14:12:24

这个报不报无所谓..
只执行一个删除自身的批处理和弹出"网页保存"的询问框就退出了..

显示全部楼层 · 发表于 2007-8-30 16:42:15

蜘蛛ＰＡＳＳ

[病毒样本] 686c859

本帖子中包含更多资源