游戏网上下载的三个。。【6c7bd5，443d5e】

显示全部楼层 · 发表于 2007-9-13 16:54:27

6c7bd59b351ff8dd49af5c9e9591ddd5 microsofts.vbs
6c7bd59b351ff8dd49af5c9e9591ddd5 NTDETECT.EXE
443d5e869fac8091760ce5799c5e1218 microsofts.bat

NOD干掉 bat。。。

显示全部楼层 · 发表于 2007-9-13 16:56:28

Access to the data has been denied!
Warning: A virus or unwanted program has been found in the HTTP Data.

Requested URL: bbs.kafan.cn/attachment.php?aid=127150
Information: Is the Trojan horse TR/Runner.Z

--------------------------------------------------------------------------------
Generated by AntiVir WebGuard 7.01.00.11, AVE 7.6.0.10, VDF 6.39.1.124

显示全部楼层 · 发表于 2007-9-13 16:57:09

又是NTDETECT。。。。。。无语ing

显示全部楼层 · 发表于 2007-9-13 17:14:27

MicroVita AntiSpyware 100 C
_____________________________________________

         风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]
               http://221.10.254.214/
----------------------------------------------
开始扫描……

正在检查启动……
[C:\Documents and Settings\Administrator\桌面\virus\microsofts\microsofts.bat]
                  …………特征码引擎[1]发现病毒
文件数:3 病毒数:1  比重:0.3333333333333
OK  扫描完毕！[:1:]

显示全部楼层 · 发表于 2007-9-13 17:16:21

Starting the file scan:

Begin scan in 'E:\病毒\microsofts'
E:\病毒\microsofts\microsofts.bat
   [DETECTION] Contains suspicious code HEUR/Crypted.E
   [WARNING] The file was ignored!
E:\病毒\microsofts\microsofts.vbs
   [DETECTION] Is the Trojan horse TR/Runner.Z
   [WARNING] The file was ignored!
E:\病毒\microsofts\NTDETECT.exe
   [DETECTION] Is the Trojan horse TR/Runner.Z
   [WARNING] The file was ignored!

End of the scan: 2007年9月13日  17:16
Used time: 00:17 min

The scan has been done completely.

   1 Scanning directories
   3 Files were scanned
   2 viruses and/or unwanted programs were found
   1 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   0 Archives were scanned
   3 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-9-13 17:36:20

小A直接拦截

显示全部楼层 · 发表于 2007-9-13 17:47:22

F:\microsofts.rar >>RAR >>microsofts.bat - Win32/PSW.Delf.NIY 木马的变种

显示全部楼层 · 发表于 2007-9-13 17:57:16

已删除：木马程序 Trojan.VBS.Runner.z 文件　: D:\病毒库\microsofts\microsofts.vbs
已删除：木马程序 Trojan.VBS.Runner.z 文件　: D:\病毒库\microsofts\NTDETECT.EXE

显示全部楼层 · 发表于 2007-9-13 18:02:36

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Paranoia Database - 4661
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder

C:\Documents and Settings\uhthn\Desktop\New Folder\microsofts.vbs - OK
C:\Documents and Settings\uhthn\Desktop\New Folder\microsofts.bat - Suspicious of Win32.Trojan-Downloader.Zlob.1
C:\Documents and Settings\uhthn\Desktop\New Folder\NTDETECT.EXE - OK

3 Files scanned
0 Infected files found
1 Suspicious files found
0 Files cured
0 Files deleted

显示全部楼层 · 发表于 2007-9-13 21:27:30

网站是什么啊!! 这个网马还是MS06014的变种!

用VBS 去启动BAT . 我的比它要完美!

[病毒样本] 游戏网上下载的三个。。【6c7bd5，443d5e】

本帖子中包含更多资源