貌似很老的毒

显示全部楼层 · 发表于 2007-9-27 19:27:39

http://news.163-stv.com/page/image/page.exe
http://news.163-stv.com/page/image/down.exe

显示全部楼层 · 发表于 2007-9-27 19:30:57

病毒: Trojan-Downloader.Win32.Small.fso
文件: page[1].exe
目录: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\AW9V89LH
进程: Maxthon.exe
病毒: Win32:Agent-IPV [Trj]
文件: down[1].exe
目录: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\AW9V89LH
进程: Maxthon.exe

显示全部楼层 · 发表于 2007-9-27 19:38:47

同意楼主说法，老夫老妻！

显示全部楼层 · 发表于 2007-9-27 19:44:25

一老一新

显示全部楼层 · 发表于 2007-9-27 22:43:40

Starting the file scan:

Begin scan in 'C:\TDDOWNLOAD\page.exe'
C:\TDDOWNLOAD\
  page.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [INFO]    The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\down.exe'
C:\TDDOWNLOAD\
  down.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-9-27 23:56:33

panda

显示全部楼层 · 发表于 2007-9-28 04:05:25

Scan performed at: 2007-9-28 4:04:45
Scanning Log
NOD32 version 2555 (20070927) NT
Command line: C:\Documents and Settings\Don johnson\桌面\down.exe C:\Documents and Settings\Don johnson\桌面\page.exe
Operating memory - is OK

Date: 28.9.2007 Time: 04:04:49
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\down.exe; C:\Documents and Settings\Don johnson\桌面\page.exe
C:\Documents and Settings\Don johnson\桌面\down.exe - a variant of Win32/TrojanDownloader.Small.NXD trojan
C:\Documents and Settings\Don johnson\桌面\page.exe - Win32/TrojanDownloader.Small.NXD trojan - quarantined - unable to clean - deleted
Number of scanned files: 2
Number of threats found: 2
Number of files cleaned: 2
Time of completion: 04:04:49 Total scanning time: 0 sec (00:00:00)

显示全部楼层 · 发表于 2007-9-28 07:40:40

2007-9-28 7:40:08 1190936408 Administrator 1272 Sign of "Win32:Agent-IPV [Trj]" has been found in "C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\D0KGB9D3\page[1].exe\[NsPack]" file.
2007-9-28 7:40:20 1190936420 Administrator 1272 Sign of "Win32:Agent-IPV [Trj]" has been found in "C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\AZL580NN\down[1].exe\[NsPack]" file.

显示全部楼层 · 发表于 2007-9-28 10:07:53

已删除：木马程序 Trojan-Downloader.Win32.Small.fso 文件: F:\9.28\page.exe
已删除：木马程序 Trojan-Downloader.Win32.Small.fvu 文件: F:\9.28\down.exe

显示全部楼层 · 发表于 2007-9-28 10:22:29

kv2007清除之

[已鉴定] 貌似很老的毒

kv2007