最后10个

显示全部楼层 · 发表于 2007-9-4 20:12:08

[MD5: ABF278 59DD6F 517BF2 E3315A 386725 B74AF1 9C0A71 D61CEF 9D0218 1B81BF]

显示全部楼层 · 发表于 2007-9-4 20:16:50

已检测到: 病毒 Worm.Win32.VB.cn URL: http://bbs.kafan.cn/attachment.php?aid=123308//112.exe

显示全部楼层 · 发表于 2007-9-4 20:17:07

微点：
广告软件名称:AdWare.Win32.SurfSideKick.a

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DXCUPDATER3.EXE
是广告软件!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\2.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TEMPORARY INTERNET FILES\CONTENT.IE5\OPWLGBC7\NETROSAE[1].TXT
2) C:\WINDOWS.0\SYSTEM32\NETROSAE.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\2.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\444.EXE
是否删除木马程序及其衍生物?
木马名称:未知后门程序

程序:
C:\WINDOWS.0\SYSTEM32\KERNL32.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\623.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\QRAFGSY.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\624.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\ZSMSCC070901.EXE
2) C:\PROGRAM FILES\INTERNET EXPLORER\ZSMSCC32.DLL
3) C:\PROGRAM FILES\INTERNET EXPLORER\ZSMSCC070901.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\NEWSSETUP903[1].EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\CHECKUPDATE903.EXE
2) C:\WINDOWS\SYSTEM32\WBEM\CGLRXCHMSXCHMR.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SETUP_BAR_015.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\HUSJDD8S.EXE
2) C:\WINDOWS.0\SYSTEM32\OSIESD3.DLL
是否删除木马程序及其衍生物?

上报112 121 567

显示全部楼层 · 发表于 2007-9-4 20:34:49

瑞星3个

显示全部楼层 · 发表于 2007-9-4 20:42:46

扫描开始时间: 2007-9-4 20:42:27
扫描日志
NOD32 版本 2502 (20070904) NT
命令行: F:\virus\样本.rar

日期: 2007年9月4日时间: 20:42:28
反 Rookits 技术已启用。
已扫描磁盘、文件夹和文件: F:\virus\样本.rar
F:\virus\样本.rar ?RAR ?112.exe<病毒 - 未知的 NewHeur_PE 病毒 [7]>
F:\virus\样本.rar ?RAR ?121.exe<病毒 - 未知的 NewHeur_PE 病毒 [7]>
F:\virus\样本.rar ?RAR ?444.exe<病毒 - 可能是 Win32/Genetik 木马变种>
F:\virus\样本.rar ?RAR ?567.exe<病毒 - 未知的 NewHeur_PE 病毒 [7]>
F:\virus\样本.rar ?RAR ?DxcUpdater3.exe<病毒 - Win32/Adware.SurfSideKick 应用程序>
F:\virus\样本.rar ?RAR ?setup_bar_015.exe<病毒 - 可能是 Win32/Genetik 木马变种>
F:\virus\样本.rar ?RAR ?624.exe<病毒 - 可能是 Win32/Genetik 木马变种>
已扫描文件数量: 10
已发现病毒数量: 7
完成时间: 20:42:31 总共扫描时间: 3 秒 (00:00:03)

注意:
[7] 文件可能感染了未知病毒。

显示全部楼层 · 发表于 2007-9-4 20:44:59

detected: virus Worm.Win32.VB.cn File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/112.exe
detected: Trojan program Trojan.Win32.Agent.bdg File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/121.exe//PE_Patch.PECompact//PecBundle//PECompact
detected: virus Heur.Trojan.Generic (modification) File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/567.exe
detected: virus Heur.Invader (modification) File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/623.exe//PE_Patch//MewBundle//MEW
detected: adware not-a-virus:AdWare.Win32.SurfSide.ay File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/DxcUpdater3.exe/InpB//DxcBho.dll
detected: adware not-a-virus:AdWare.Win32.SurfSide.ay File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/DxcUpdater3.exe/InpB//DxcCore.dll
detected: adware not-a-virus:AdWare.Win32.SurfSide.bb File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/DxcUpdater3.exe/InpB//Dxc.exe
detected: adware not-a-virus:AdWare.Win32.SurfSide.bb File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/DxcUpdater3.exe/InpB//DxcRepairInstall.exe
detected: Trojan program Trojan-Downloader.Win32.Adload.kl File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/NewsSetup903[1].exe//ASPack
detected: virus Heur.Trojan.Generic (modification) File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/setup_bar_015.exe//ASPack
detected: Trojan program Trojan.Win32.Agent.bfb File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/624.exe//PE_Patch//UPack

显示全部楼层 · 发表于 2007-9-4 20:45:47

Begin scan in \样本.rar
  [0] Archive type: RAR
  --> 112.exe
   [DETECTION] Contains signature of the worm WORM/VB.CN.21
  --> 121.exe
   [DETECTION] Is the Trojan horse TR/Agent.bdg.1
  --> 444.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPI.Gen
  --> 567.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> 623.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> 2.exe
   [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> DxcUpdater3.exe
   [DETECTION] Contains signature of the dropper DR/SurfSide.AY
  --> setup_bar_015.exe
   [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Exaal.45056 Backdoor server programs
  --> 624.exe
   [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
   [INFO]    The file was deleted!

End of the scan: 2007年9月4日  20:45
Used time: 00:10 min

The scan has been done completely.

   0 Scanning directories
   12 Files were scanned
   9 viruses and/or unwanted programs were found
   2 classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes
   0 Hidden objects were found

显示全部楼层 · 发表于 2007-9-4 20:47:44

C:\ABC\样本\112.exe - 特征码 'Trojan-Downloader.Win32.VB.atk' 被发现
C:\ABC\样本\121.exe - 特征码 'Trojan.Win32.Agent.ajr' 被发现
C:\ABC\样本\2.exe - 特征码 'Win32.SuspectCrc' 被发现
C:\ABC\样本\444.exe - 特征码 'Packed.Win32.Klone.af' 被发现
C:\ABC\样本\567.exe - 特征码 'Trojan-Downloader.Win32.Delf.ACC' 被发现
C:\ABC\样本\623.exe - 可疑代码段被发现 (Level: 140)
C:\ABC\样本\624.exe - 特征码 'Trojan-Spy.Win32.Agent.pn' 被发现
C:\ABC\样本\DxcUpdater3.exe - 特征码 'Application.Win32.AdWare.SurfSideKick' 被发现
C:\ABC\样本\NewsSetup903[1].exe - 特征码 'BehavesLikeTrojan.Downloader' 被发现
C:\ABC\样本\setup_bar_015.exe - 特征码 'Trojan-Downloader' 被发现

10 文件被扫描
(0 压缩档 0 文件)
9 特征码被侦测
1 可疑代码段被发现
耗时: 0:04.781

显示全部楼层 · 发表于 2007-9-4 20:58:22

除了卡巴，就佩服IK

显示全部楼层 · 发表于 2007-9-4 20:59:31

DR WEB 5个
费尔4个

[病毒样本] 最后10个

本帖子中包含更多资源