4466a2,MARAN变种!

显示全部楼层 · 发表于 2007-9-1 14:46:12

微点：
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SETUP.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

费尔扫描不报

显示全部楼层 · 发表于 2007-9-1 16:16:06

fs pass

显示全部楼层 · 发表于 2007-9-1 17:41:24

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Paranoia Database - 1362
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder

C:\Documents and Settings\uhthn\Desktop\New Folder\setup.exe - Suspicious of Win32.Trojan-PSW.Game.8

1 Files scanned
0 Infected files found
1 Suspicious files found
0 Files cured
0 Files deleted

显示全部楼层 · 发表于 2007-9-2 17:32:23

危险进程(PID:2676): C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$EX00.109\setup.exe

产品名称: 无
文件版本: 无
公司名称: 无
文件描述: 无
数字签名: 没有发现签名

危险级别: 高
级别评分: 56.418880
状态: 进程已被结束，但还没有清除，等待进一步处理。

在线扫描发现它是一个“密码窃取者”，推荐删除。

显示全部楼层 · 发表于 2007-9-2 17:47:49

Result: 1 malware found
Trojan-PSW.Win32.Maran.mj (virus)
C:\Documents and Settings\ssy\×ÀÃæ\setup.rar\setup.exe

显示全部楼层 · 发表于 2007-9-2 17:59:06

Begin scan in 'C:\Documents and Settings\dell\桌面\setup.rar'
C:\Documents and Settings\dell\桌面\setup.rar
  [0] Archive type: RAR
  --> setup.exe
   [DETECTION] Is the Trojan horse TR/PSW.Maran.MJ
   [INFO]    The file was successfully wiped!
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-9-2 19:48:42

Starting the file scan:

Begin scan in 'C:\Documents and Settings\tim\桌面\setup.rar'
C:\Documents and Settings\tim\桌面\setup.rar
  [0] Archive type: RAR
  --> setup.exe
   [DETECTION] Is the Trojan horse TR/PSW.Maran.MJ
   [INFO]    A backup was created as '474ea352.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-9-2 20:05:37

已检测: 木马程序 Trojan-PSW.Win32.Maran.mj URL: http://bbs.kafan.cn/attachment.php?aid=122073//setup.exe

[病毒样本] 4466a2,MARAN变种!