抓了好多个样本

gzg

扫扫看

[ 本帖最后由 gzg 于 2007-9-9 21:20 编辑 ]

promised

样本呢。。。。。。

微点卫士

微点：
木马名称:Backdoor.Win32.SdBot.dfz

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MRAVSC32.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:HackTool.Win32.ARP.c

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\LSASS.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:HackTool.Win32.KillTime.a

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SETTIME.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIP[1].EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\SYSTEM6.JUP
2) C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\SYSTEM6.INS
是否删除木马程序及其衍生物?


cap.exe要安装东西，选退出  svchost.exe死的
上报psexec.exe

qigang

瑞星一个未报？？

taihuxian

检测到：恶意程序 Exploit.JS.Agent.am        URL: http://bbs.kafan.cn/attachment.php?aid=125782//vip[1].htm

曲中求

Starting the file scan:

Begin scan in 'E:\病毒\病毒RECYCLER[1].part1'
E:\病毒\病毒RECYCLER[1].part1\lsass.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [WARNING]   The file was ignored!
E:\病毒\病毒RECYCLER[1].part1\mravsc32.exe
      [DETECTION] Contains detection pattern of the worm WORM/Sdbot.406528.1
      [WARNING]   The file was ignored!
E:\病毒\病毒RECYCLER[1].part1\vip3[1].htm
      [DETECTION] Contains detection pattern of the HTML script virus HTML/Shellcode.Gen
      [WARNING]   The file was ignored!
E:\病毒\病毒RECYCLER[1].part1\vip4[1].htm
      [DETECTION] Contains detection pattern of the HTML script virus HTML/Shellcode.Gen
      [WARNING]   The file was ignored!
E:\病毒\病毒RECYCLER[1].part1\vip[1].exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [WARNING]   The file was ignored!


End of the scan: 2007年9月9日  21:28
Used time: 00:14 min

The scan has been done completely.

      1 Scanning directories
     15 Files were scanned
      2 viruses and/or unwanted programs were found
      3 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     13 Files not concerned
      0 Archives were scanned
      5 Warnings
      0 Notes

小邪邪

AVK报了

小邪邪

AVK报了

capsshift

楼主，这一个不是。
cap.exe  KNOWN CLEAN

The file 'cap.exe' has been determined to be 'KNOWN CLEAN'. In particular this means that we could not find any malicious content. Please note that the file is part of 'WinPcap 4.0'.

欠妳緈諨