[408543]

显示全部楼层 · 发表于 2007-9-15 13:12:00

2007-9-15 13:11:36 1189833096 Administrator 3424 Sign of "Win32:Delf-FBY [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\a.rar\a.exe\[ASPack]\[Embedded#EXE1]" file.

显示全部楼层 · 发表于 2007-9-15 13:15:17

难道是 http://bbs.kafan.cn/viewthread.php?tid=130604&extra=page%3D2 的妈妈？

显示全部楼层 · 发表于 2007-9-15 13:17:26

Undet [ ]( ) in D:\download\virusscan\a.rar,(a.exe)
Undet [ ]( ) in D:\download\virusscan\a.rar

显示全部楼层 · 发表于 2007-9-15 13:31:25

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\a.rar'
C:\Documents and Settings\Administrator\My Documents\
  a.rar
[0] Archive type: RAR
--> a.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Delf.Symu Backdoor server programs
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-9-15 13:33:12

卡巴 7.0.0.125

已检测到: 木马程序 Backdoor.Win32.Delf.btt URL: http://bbs.kafan.cn/attachment.php?aid=127868//a.exe//ASPack

显示全部楼层 · 发表于 2007-9-15 13:43:00

微点：
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\A.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\KERNL32.EXE
2) C:\WINDOWS.0\TASKMANT.EXE
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-9-15 15:14:40

瑞星08主动防御拦截

显示全部楼层 · 发表于 2007-9-15 15:21:58

nod32 pass

显示全部楼层 · 发表于 2007-9-15 17:07:43

Virus: Backdoor.Win32.Delf.btt

Virus found while downloading Web content.

Address: bbs.kafan.cn

[病毒样本] [408543]

本帖子中包含更多资源