0c7fa3

显示全部楼层 · 发表于 2007-9-5 00:35:57

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\cq.rar'
C:\Documents and Settings\Administrator\My Documents\
  cq.rar
[0] Archive type: RAR
-->  cq.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-9-5 00:37:30

显示全部楼层 · 发表于 2007-9-5 00:46:19

程序:
C:\DOCUMENTS AND SETTINGS\WINGCHEN\桌面\CQ\ CQ.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\MSKDFE.EXE
2) C:\WINDOWS\SYSTEM32\MSKDFE.DLL
3) C:\WINDOWS\SYSTEM32\MSKDFF.DLL
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-9-5 01:08:05

nod、蜘蛛pass

显示全部楼层 · 发表于 2007-9-5 01:18:09

2007-09-05 01:16:54 创建文件    操作:阻止
进程路径:D:\病毒库\cq\ cq.exe
文件路径:C:\WINDOWS\system32\mskdfe.exe
触发规则:所有程序规则->文件规则->%systemdrive%\*.exe

2007-09-05 01:16:54 创建文件    操作:阻止
进程路径:D:\病毒库\cq\ cq.exe
文件路径:C:\WINDOWS\system32\mskdfe.dll
触发规则:所有程序规则->文件规则->%systemdrive%\*.dll

2007-09-05 01:16:55 创建文件    操作:阻止
进程路径:D:\病毒库\cq\ cq.exe
文件路径:C:\WINDOWS\system32\mskdff.dll
触发规则:所有程序规则->文件规则->%systemdrive%\*.dll

2007-09-05 01:16:55 运行应用程序    操作:阻止
进程路径:D:\病毒库\cq\ cq.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c D:\病毒库\cq\dsetup.bat
触发规则:所有程序规则->禁止程序->*\cmd.exe

显示全部楼层 · 发表于 2007-9-5 11:28:14

咖啡飘

显示全部楼层 · 发表于 2007-9-5 11:35:24

微点：
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ CQ.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\MSKDFE.EXE
2) C:\WINDOWS.0\SYSTEM32\MSKDFE.DLL
3) C:\WINDOWS.0\SYSTEM32\MSKDFF.DLL
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-9-5 12:24:37

deleted: Trojan program Trojan.Win32.Agent.bff File: C:\Documents and Settings\Owner\×ÀÃæ\cq.zip/ cq.exe//PE_Patch.PECompact//PecBundle//PECompact

显示全部楼层 · 发表于 2007-9-5 16:35:50

Start of the scan: Wednesday, 5 September, 2007  16:35

Starting the file scan:

Begin scan in 'C:\Documents and Settings\tim\桌面\cq.rar'
C:\Documents and Settings\tim\桌面\cq.rar
  [0] Archive type: RAR
  -->  cq.exe
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    A backup was created as '470c6ac7.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!

[病毒样本] 0c7fa3

本帖子中包含更多资源

本帖子中包含更多资源