继续挖掘[E12599]

显示全部楼层 · 发表于 2007-9-30 19:26:52

秀后
detected: Trojan program Trojan-Downloader.Win32.Delf.cgm URL: http://bbs.kafan.cn/attachment.php?aid=133842//unpack_.exe

显示全部楼层 · 发表于 2007-9-30 21:44:22

已删除：木马程序 Trojan-Downloader.Win32.Delf.cgm 文件: F:\9.30\qq.rar/qq.EXE//ASPack

显示全部楼层 · 发表于 2007-9-30 23:10:24

木马名称:Trojan-Downloader.Win32.Delf.hfl

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\QQ.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2007-9-30 23:36:26

他应该是用巡警的那个vmunpacker脱的……所以……

显示全部楼层 · 发表于 2007-9-30 23:40:20

那东西据说能脱很多壳

不过我从来不用，老实点手动脱有好处的

显示全部楼层 · 发表于 2007-9-30 23:40:36

AVAST都不认识

显示全部楼层 · 发表于 2007-10-1 00:25:29

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 279
Paranoia Database - 6300
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder

C:\Documents and Settings\uhthn\Desktop\New Folder\qq_unpacked.EXE - Infected with SDB:Win32.Trojan-Dropper.Small.1 - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\unpack_.exe - Infected with SDB:Win32.Trojan-Dropper.Small.1 - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\qq.EXE - Infected with SDB:Win32.Trojan-Dropper.Small.1 - Deleted

3 Files scanned
3 Infected files found
0 Suspicious files found
0 Files cured
3 Files deleted

显示全部楼层 · 发表于 2007-10-1 01:27:32

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\qq_unpacked.zip'
C:\Users\morgan\Documents\
  qq_unpacked.zip
[0] Archive type: ZIP
--> qq_unpacked.EXE
      [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/Dumped). Please verify the origin of the file
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!
Begin scan in 'C:\Users\morgan\Documents\unpack_.rar'
C:\Users\morgan\Documents\
  unpack_.rar
[0] Archive type: RAR
--> unpack_.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-10-1 05:13:51

显示全部楼层 · 发表于 2007-10-1 07:52:24

[病毒样本] 继续挖掘[E12599]

回复 8楼 promised 的帖子

回复 14楼 jimmyleo 的帖子

本帖子中包含更多资源

本帖子中包含更多资源