3只木马样本

显示全部楼层 · 发表于 2007-9-12 11:57:07

大家一起扫扫看

显示全部楼层 · 发表于 2007-9-12 11:59:26

deleted: Trojan program Trojan-PSW.Win32.OnLineGames.cfo File: C:\Documents and Settings\Owner\×ÀÃæ\SYSTEM32.rar/AVZXAST.EXE//UPack
deleted: Trojan program Trojan-Spy.Win32.Delf.aha File: C:\Documents and Settings\Owner\×ÀÃæ\SYSTEM32.rar/WINFORMA9.EXE//UPack

显示全部楼层 · 发表于 2007-9-12 12:00:57

挂了一个

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\SYSTEM32.rar'
C:\Documents and Settings\Administrator\My Documents\
  SYSTEM32.rar
[0] Archive type: RAR
--> RACVSVC.EXE
--> AVZXAST.EXE
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.cfo.1
      [WARNING] Infected files in archives cannot be repaired!
--> WINFORMA9.EXE
      [DETECTION] Is the Trojan horse TR/Spy.Delf.aha
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-9-12 12:01:57

Thank you for your submission. Below you can see the current status of the uploaded files.

A listing of files alongside their results can be found below:
File ID    Filename    Size (Byte) Result
200567    RACVSVC.EXE    32 KB    KNOWN CLEAN

Please find a detailed report concerning each individual sample below:
Filename Result
RACVSVC.EXE    KNOWN CLEAN

The file 'RACVSVC.EXE' has been determined to be 'KNOWN CLEAN'. In particular this means that we could not find any malicious content. Please note that the file is part of 'Windows XP (SP2)'.

显示全部楼层 · 发表于 2007-9-12 12:04:14

Trojan.PSW.Win32.OnlineGames.ymh
Trojan.PSW.Win32.TLOnline.av

还有一个运行无反应……

显示全部楼层 · 发表于 2007-9-12 12:07:20

显示全部楼层 · 发表于 2007-9-12 12:37:53

卡巴斯基互联网安全套装 7.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=126739 is infected with Trojan-PSW.Win32.OnLineGames.cfo virus

显示全部楼层 · 发表于 2007-9-12 14:08:10

对RACVSVC.EXE进行查看，与本机RUNDLL32.EXE数字签名，版本，大小全部相同，MD5值却有差异，不知为什么。

显示全部楼层 · 发表于 2007-9-12 15:24:34

Scan performed at: 2007-9-12 15:24:10
Scanning Log
NOD32 version 2523 (20070912) NT
Command line: C:\Documents and Settings\Don johnson\桌面\SYSTEM32.rar
Operating memory - is OK

Date: 12.9.2007 Time: 15:24:14
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\SYSTEM32.rar
C:\Documents and Settings\Don johnson\桌面\SYSTEM32.rar ?RAR ?AVZXAST.EXE - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\SYSTEM32.rar ?RAR ?WINFORMA9.EXE - probably a variant of Win32/Genetik trojan
Number of scanned files: 4
Number of threats found: 2
Number of files cleaned: 1
Time of completion: 15:24:14 Total scanning time: 0 sec (00:00:00)

显示全部楼层 · 发表于 2007-9-12 16:39:54

微点：
木马名称:Trojan-PSW.Win32.OnLineGames.kru

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\AVZXAST.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Spy.Win32.Delf.dye

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\WINFORMA9.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

2个

[病毒样本] 3只木马样本

本帖子中包含更多资源

本帖子中包含更多资源