72df1c,过卡6!

显示全部楼层 · 发表于 2007-9-21 22:08:19

好像是MARAN,卡7貌似可以启发

显示全部楼层 · 发表于 2007-9-21 22:10:44

Scan performed at: 2007-9-21 22:09:55
Scanning Log
NOD32 version 2543 (20070921) NT
Command line: C:\Documents and Settings\Don johnson\桌面\丘比特.rar
Operating memory - is OK

Date: 21.9.2007 Time: 22:09:58
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\丘比特.rar
C:\Documents and Settings\Don johnson\桌面\丘比特.rar ?RAR ?丘比特.scr ?RAR ?winlogoh.exe - a variant of Win32/PSW.Maran trojan - was a part of the deleted object
Number of scanned files: 3
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 22:09:59 Total scanning time: 1 sec (00:00:01)

显示全部楼层 · 发表于 2007-9-21 22:11:51

没错，KIS7启发
已删除：病毒 Heur.Trojan.Generic 文件: D:\ps\丘比特.rar/丘比特.scr//data.rar/winlogoh.exe//PE_Patch.PECompact//PecBundle//PECompact

显示全部楼层 · 发表于 2007-9-21 22:14:54

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.OnlineGames.cvo

MAC地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：19.41.42

显示全部楼层 · 发表于 2007-9-21 22:20:17

C:\ABC\丘比特.rar:\丘比特.scr\winlogoh.exe - 特征码 'Generic.PWStealer' 被发现

显示全部楼层 · 发表于 2007-9-21 22:31:29

美人鱼换成了帅哥

显示全部楼层 · 发表于 2007-9-21 23:05:59

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\��.rar'
C:\Documents and Settings\Administrator\My Documents\
  ��.rar
[0] Archive type: RAR
--> Çð±ÈÌØ.scr
      [1] Archive type: RAR SFX (self extracting)
      --> album.jpg
      --> winlogoh.exe
         [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
         [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-9-22 05:28:56

2007-9-22 5:28:38 1190410118 Administrator 3968 Sign of "Win32:Maran-AU [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\丘比特.rar\丘比特.scr\winlogoh.exe\[PECompact]\[Embedded#IPFILTER]" file.

[病毒样本] 72df1c,过卡6!

本帖子中包含更多资源

nod32对maran的检测还是比较好的

5/1

本帖子中包含更多资源