求助区转过来的，MD5就不扫了

显示全部楼层 · 发表于 2007-9-20 10:37:10

如题
detected: virus Heur.Trojan.Generic (modification) File: C:\Documents and Settings\Owner\×ÀÃæ\ÐÂ½¨ WinRAR Ñ¹ËõÎÄ¼þ.rar/hgz[1].jpg//PE_Patch//UPack
detected: virus Heur.Trojan.Generic (modification) File: C:\Documents and Settings\Owner\×ÀÃæ\ÐÂ½¨ WinRAR Ñ¹ËõÎÄ¼þ.rar/inituser.exe//NSPack

显示全部楼层 · 发表于 2007-9-20 10:40:42

2007-09-20 10:39:04 文件保护(创建文件)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建 WinRAR 压缩文件\inituser.exe
文件路径:C:\WINDOWS\system32\inituser.exe
2007-09-20 10:39:05 应用程序保护(安装服务或者驱动)    操作:阻止
进程路径:C:\WINDOWS\system32\services.exe
文件路径:C:\WINDOWS\system32\inituser.exe
2007-09-20 10:39:05 文件保护(创建文件)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建 WinRAR 压缩文件\inituser.exe
文件路径:C:\WINDOWS\system32\Deledomn.bat

显示全部楼层 · 发表于 2007-9-20 10:41:28

AVAST飘过

显示全部楼层 · 发表于 2007-9-20 10:42:11

Start of the scan: 2007年9月20日  10:42

Starting the file scan:

Begin scan in 'D:\病毒测试\未解压样本\新建 WinRAR 压缩文件.rar'
D:\病毒测试\未解压样本\新建 WinRAR 压缩文件.rar
  [0] Archive type: RAR
  --> hgz[1].jpg
   [DETECTION] Is the Trojan horse TR/PSW.OnLineG.TF.1
  --> inituser.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [INFO]    The file was moved to '47123d12.qua'!

End of the scan: 2007年9月20日  10:42
Used time: 00:32 min

The scan has been done completely.

   0 Scanning directories
   4 Files were scanned
   2 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   1 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-9-20 10:44:51

KIS6.0 直接阻止下载

显示全部楼层 · 发表于 2007-9-20 10:44:51

D:\Documents and Settings\EKINCHENG\桌面\新建 WinRAR 压缩文件.rar - multiple threats - deleted - quarantined
D:\Documents and Settings\EKINCHENG\桌面\新建 WinRAR 压缩文件.rar » RAR » inituser.exe - probably a variant of Win32/TrojanDownloader.Delf.NSA trojan
D:\Documents and Settings\EKINCHENG\桌面\新建 WinRAR 压缩文件.rar » RAR » hgz[1].jpg - probably a variant of Win32/PSW.OnLineGames.NEP trojan

显示全部楼层 · 发表于 2007-9-20 10:45:51

BD

显示全部楼层 · 发表于 2007-9-20 10:59:24

原帖由 欠你幸福 于 2007-9-20 10:41 发表
AVAST飘过

这回

显示全部楼层 · 发表于 2007-9-20 11:46:04

显示全部楼层 · 发表于 2007-9-20 13:35:11

F:\新建 WinRAR 压缩文件.rar >>RAR >>hgz[1].jpg - 可能是 Win32/PSW.OnLineGames.NEP 木马的一个变种
F:\新建 WinRAR 压缩文件.rar >>RAR >>inituser.exe - 可能是 Win32/TrojanDownloader.Delf.NSA 木马的一个变种

[病毒样本] 求助区转过来的，MD5就不扫了

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源