用了微点一段时间后再用nod32扫描出的病毒！

显示全部楼层 · 发表于 2007-10-1 08:23:28

（祝所有的卡饭国庆快乐！）微点杀不到的病毒都被ｎｏｄ３２杀掉了！

显示全部楼层 · 发表于 2007-10-1 08:31:04

两个ani，一个html，一个autorun.inf
打从心底对楼主彻底佩服

显示全部楼层 · 发表于 2007-10-1 08:34:12

2007-10-1 8:33:34 1191198814 SYSTEM 1276 Sign of "CVE-2007-0038" has been found in "http://bbs.kafan.cn/attachment.php?aid=134093\1[1].jpg" file.
2007-10-1 8:33:46 1191198826 SYSTEM 1276 Sign of "CVE-2007-0038" has been found in "http://bbs.kafan.cn/attachment.php?aid=134095\Ani[1].c" file.

显示全部楼层 · 发表于 2007-10-1 08:35:41

挖出来的木马
Http://web.858656.com/103/1.exe
http://www.ip369.net/mmm/3.exe

显示全部楼层 · 发表于 2007-10-1 08:39:17

木马名称:Trojan-Downloader.Win32.Agent.jyv

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\G9QZ85QN\1[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\3.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\SYSTEM6.JUP
2) C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\SYSTEM6.INS
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-10-1 08:42:44

Virus: Exploit.Win32.IMG-ANI.k

Virus found while downloading Web content.

Address: bbs.kafan.cn

Virus: Trojan-Downloader.JS.Small.ew

Virus found while downloading Web content.

Address: bbs.kafan.cn

Virus: Exploit.Win32.IMG-ANI.ac

Virus found while downloading Web content.

Address: bbs.kafan.cn
最后一个不是

显示全部楼层 · 发表于 2007-10-1 08:44:00

Virus: Trojan-Downloader.Win32.Agent.dex

Virus found while downloading Web content.

Address: web.858656.com

Virus: Trojan-PSW.Win32.Delf.ada

Virus found while downloading Web content.

Address: www.ip369.net

显示全部楼层 · 发表于 2007-10-1 08:50:39

无语了。。。
实际建议lz多去看看castlecops的malware listserv
然后就会明白，实际上nod32杀病毒根本就什么都不是。。
就不用到处发这种半死不活的样本了。。

显示全部楼层 · 发表于 2007-10-1 08:53:16

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\Ani[1].rar'
C:\Users\morgan\Documents\
  Ani[1].rar
[0] Archive type: RAR
--> Ani[1].c
      [DETECTION] Contains detection pattern of the exploits EXP/Ani.Gen
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!
Begin scan in 'C:\Users\morgan\Documents\1[1].rar'
C:\Users\morgan\Documents\
  1[1].rar
[0] Archive type: RAR
--> 1[1].jpg
      [DETECTION] Contains detection pattern of the exploits EXP/Ani.Gen
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!
Begin scan in 'C:\Users\morgan\Documents\002[1].rar'
C:\Users\morgan\Documents\
  002[1].rar
[0] Archive type: RAR
--> 002[1].htm
      [DETECTION] Contains detection pattern of the HTML script virus HTML/ADODB.Exploit.Gen
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!
Starting the file scan:

Begin scan in 'C:\TDDOWNLOAD\1.exe'
C:\TDDOWNLOAD\
1.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Small.GOC.1
      [INFO]    The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\3.exe'
C:\TDDOWNLOAD\
3.exe
      [DETECTION] Is the Trojan horse TR/PSW.Delf.ada
      [INFO]    The file was deleted!

[ 本帖最后由 mofunzone 于 2007-9-30 16:54 编辑 ]

显示全部楼层 · 发表于 2007-10-1 09:01:23

[ 本帖最后由 a256886572008 于 2007-10-1 09:03 编辑 ]

[病毒样本] 用了微点一段时间后再用nod32扫描出的病毒！

本帖子中包含更多资源

回复 4楼 solcroft 的帖子

本帖子中包含更多资源