3ge[MD5: 696C84 AECC88 812E44]

显示全部楼层 · 发表于 2007-10-2 10:47:46

木马名称:Trojan-Downloader.Win32.Agent.icn

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\RELIVE.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Downloader.Win32.Agent.icf

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MSVCRT.BAK
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ZZM.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\WINDOWS_HM.EXE
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-10-2 10:50:24

显示全部楼层 · 发表于 2007-10-2 10:57:36

显示全部楼层 · 发表于 2007-10-2 11:06:54

瑞星08全杀..

Worm.Win32.Agent.ut 1.rar>>Relive.dll>>upx_c
Worm.Win32.Agent.ut 1.rar>>msvcrt.bak>>upx_c
Backdoor.Win32.Gpigeon.yzy 1.rar>>zzm.exe

显示全部楼层 · 发表于 2007-10-2 11:08:30

2007-10-2 11:08:03 1191294483 Administrator 3200 Sign of "Win32:Autorun-U" has been found in "C:\Documents and Settings\Administrator\桌面\样本1.rar\Relive.dll\[UPX]" file.
2007-10-2 11:08:09 1191294489 Administrator 3200 Sign of "Win32:Autorun-U" has been found in "C:\Documents and Settings\Administrator\桌面\样本1.rar\msvcrt.bak\[UPX]\[Embedded#4ef0]\[UPX]" file.
2007-10-2 11:08:10 1191294490 Administrator 3200 Sign of "Win32:Hupigon-DKF [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本1.rar\zzm.exe" file.

显示全部楼层 · 发表于 2007-10-2 11:10:47

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\��1.rar'
C:\Users\morgan\Documents\
  ��1.rar
[0] Archive type: RAR
--> Relive.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.bmo.11
      [WARNING] Infected files in archives cannot be repaired!
--> msvcrt.bak
      [DETECTION] Is the Trojan horse TR/Autorun.BK
      [WARNING] Infected files in archives cannot be repaired!
--> zzm.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-10-2 11:18:21

deleted: Trojan program Trojan-Downloader.Win32.Agent.bmo File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/Relive.dll//PE_Patch.UPX//UPX
deleted: virus Virus.Win32.AutoRun.ji File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/msvcrt.bak

显示全部楼层 · 发表于 2007-10-2 11:34:57

===================================================================================================
On-demand scanner 7.0.0.9

NSE revision 5.91.07
nvcbin.def revision 5.90.00 of 2007/09/28 15:46:54 (967863 variants)
nvcmacro.def revision 5.90.00 of 2007/09/25 15:36:51 (20411 variants)
Total number of variants: 988274
===================================================================================================

   Time  Filename                                                    Virus name
---------------------------------------------------------------------------------------------------

- Scanning drive: G:\
- Scanning system areas of drive: G:\
- Scanning files matching: G:\v\msvcrt.bak
   3578 ms G:\v\msvcrt.bak
- Scanning files matching: G:\v\Relive.dll
   47 ms G:\v\Relive.dll                                           Trojan W32/Agent.BSPQ ()
- File G:\v\Relive.dll quarantined.
- File G:\v\Relive.dll deleted.
- Scanning files matching: G:\v\zzm.exe
   5391 ms G:\v\zzm.exe

===================================================================================================

The scanning started: 2007/10/02 11:34:40
            ended: 2007/10/02 11:34:49
Logged on as       : Administrator
on hostname       : C3EF58622174424

Scanning results:
Total number of files found..............................:    3
Number of files scanned..................................:    3
Number of files/directories skipped due to exclude list..:    0
Number of files that could not be opened.................:    0
Number of archive files unpacked.........................:    0
Number of archive files not unpacked.....................:    0
Number of infections.....................................:    1

Copyright (c) 1993-2005 Norman ASA.

显示全部楼层 · 发表于 2007-10-2 11:55:56

Scan performed at: 2007-10-2 11:55:02
Scanning Log
NOD32 version 2564 (20071002) NT
Command line: C:\Documents and Settings\Don johnson\桌面\样本1.rar
Operating memory - is OK

Date: 2.10.2007 Time: 11:55:05
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\样本1.rar
C:\Documents and Settings\Don johnson\桌面\样本1.rar ?RAR ?Relive.dll - Win32/PSW.OnLineGames.NBR trojan - was a part of the deleted object
C:\Documents and Settings\Don johnson\桌面\样本1.rar ?RAR ?msvcrt.bak - a variant of Win32/PSW.OnLineGames.NBR trojan
Number of scanned files: 4
Number of threats found: 2
Number of files cleaned: 1
Time of completion: 11:55:16 Total scanning time: 11 sec (00:00:11)

[病毒样本] 3ge[MD5: 696C84 AECC88 812E44]

本帖子中包含更多资源

评分

本帖子中包含更多资源