样本

显示全部楼层 · 发表于 2007-10-5 13:27:42

http://bbs.kafan.cn/viewthread.php?tid=139254&extra=page%3D1&page=1所提到的毒网所挂的全部样本

显示全部楼层 · 发表于 2007-10-5 13:29:17

就这样全灭
Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\virus.rar'
C:\Users\morgan\Documents\
  virus.rar
[0] Archive type: RAR
--> virus\bbbb.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> virus\pps.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> virus\1.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Baser.W.2
      [WARNING] Infected files in archives cannot be repaired!
--> virus\Baidu.cab
      [1] Archive type: CAB (Microsoft)
      --> Baidu.Exe
         [DETECTION] Contains detection pattern of the dropper DR/AutoRun.F.5
         [WARNING] Infected files in archives cannot be repaired!
--> virus\down.exe
      [DETECTION] Contains detection pattern of the worm WORM/AutoRun.AI
      [WARNING] Infected files in archives cannot be repaired!
--> virus\down2(1).exe
      [DETECTION] Contains detection pattern of the worm WORM/AutoRun.AI
      [WARNING] Infected files in archives cannot be repaired!
--> virus\down2.exe
      [DETECTION] Contains detection pattern of the worm WORM/AutoRun.AI
      [WARNING] Infected files in archives cannot be repaired!
--> virus\sms.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Baser.W.2
      [WARNING] Infected files in archives cannot be repaired!
--> virus\svcos.exe
      [DETECTION] Is the Trojan horse TR/Drop.Delf.NFS
      [WARNING] Infected files in archives cannot be repaired!
--> virus\ah.c
      [DETECTION] Contains detection pattern of the exploits EXP/Ani.Gen
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

End of the scan: 2007年10月4日  22:28
Used time: 00:07 min

The scan has been done completely.

   0 Scanning directories
   12 Files were scanned
   10 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   2 Archives were scanned
   11 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-10-5 13:31:15

显示全部楼层 · 发表于 2007-10-5 13:35:37

木马名称:Trojan-Downloader.Win32.Baser.h

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\1.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\DOWN2(1).EXE
由
C:\AUTORUN.INF
自启动运行!
并生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\NEWTEMP.BAK
2) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\NEWTEMP.DLL
3) C:\PEGEFILE.PIF
4) D:\PEGEFILE.PIF
5) C:\AUTORUN.INF
以及可由此INF文件引导自启的文件:
C:\PEGEFILE.PIF

是否删除木马程序及其衍生物?
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\DOWN.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\DOWN2.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\BBBB.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\SER2VET.EXE
是否删除木马程序及其衍生物?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\PPS.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\SMS.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\IE7.EXE
是否删除木马程序及其衍生物?
木马名称:Trojan-Dropper.Win32.Delf.crp

程序:
C:\WINDOWS.0\SYSTEM32\KK.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\BAIDU.EXE
由
C:\AUTORUN.INF
自启动运行!
并生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\NEWTEMP.BAK
2) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\NEWTEMP.DLL
3) C:\PEGEFILE.PIF
4) C:\AUTORUN.INF
以及可由此INF文件引导自启的文件:
C:\PEGEFILE.PIF

是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-10-5 13:37:24

蜘蛛全灭

显示全部楼层 · 发表于 2007-10-5 13:42:30

小a 漏一个

2007-10-5 13:41:45 1191562905 Administrator 3240 Sign of "Win32:Delf-FVX [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\virus.rar\virus\bbbb.exe\[UPX]" file.
2007-10-5 13:41:47 1191562907 Administrator 3240 Sign of "Win32:Delf-FVX [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\virus.rar\virus\pps.exe\[UPX]" file.
2007-10-5 13:41:47 1191562907 Administrator 3240 Sign of "Win32:Delf-FVX [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\virus.rar\virus\1.exe\[UPX]" file.
2007-10-5 13:41:47 1191562907 Administrator 3240 Sign of "Win32:Nilage-AI [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\virus.rar\virus\Baidu.cab\Baidu.Exe\[Embedded#DATAINFO]" file.
2007-10-5 13:41:47 1191562907 Administrator 3240 Sign of "Win32:Nilage-AI [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\virus.rar\virus\Baidu.cab\Baidu.Exe" file.
2007-10-5 13:41:47 1191562907 Administrator 3240 Sign of "Win32:Nilage-AI [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\virus.rar\virus\down.exe\[Embedded#DATAINFO]" file.
2007-10-5 13:41:47 1191562907 Administrator 3240 Sign of "Win32:Nilage-AI [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\virus.rar\virus\down.exe" file.
2007-10-5 13:41:47 1191562907 Administrator 3240 Sign of "Win32:Nilage-AI [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\virus.rar\virus\down2(1).exe\[Embedded#DATAINFO]" file.
2007-10-5 13:41:47 1191562907 Administrator 3240 Sign of "Win32:Nilage-AI [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\virus.rar\virus\down2(1).exe" file.
2007-10-5 13:41:47 1191562907 Administrator 3240 Sign of "Win32:Nilage-AI [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\virus.rar\virus\down2.exe\[Embedded#DATAINFO]" file.
2007-10-5 13:41:47 1191562907 Administrator 3240 Sign of "Win32:Nilage-AI [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\virus.rar\virus\down2.exe" file.
2007-10-5 13:41:47 1191562907 Administrator 3240 Sign of "Win32:Delf-FVX [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\virus.rar\virus\sms.exe\[UPX]" file.
2007-10-5 13:41:48 1191562908 Administrator 3240 Sign of "CVE-2007-0038" has been found in "C:\Documents and Settings\Administrator\桌面\virus.rar\virus\ah.c" file.

显示全部楼层 · 发表于 2007-10-5 13:51:34

9

Trojan.Exploit.131,不操作,1,ah.c
W32.Fubalca.E,不操作,1,sms.exe
W32.SillyFDC,不操作,1,down2.exe
W32.SillyFDC,不操作,1,down2(1).exe
W32.SillyFDC,不操作,1,down.exe
W32.SillyFDC,不操作,1,Baidu.Exe
W32.Fubalca.E,不操作,1,1.exe
W32.Fubalca.E,不操作,1,pps.exe
W32.Fubalca.E,不操作,1,bbbb.exe

显示全部楼层 · 发表于 2007-10-5 13:52:13

看圖說話。。矣。一個病毒未查出來。不知道為什麼！
而卡八查出來了！

[ 本帖最后由 quange 于 2007-10-5 14:00 编辑 ]

显示全部楼层 · 发表于 2007-10-5 13:55:22

你很强。。。。十分的强。。。。。。。。

显示全部楼层 · 发表于 2007-10-5 14:06:56

我的NOD是怎麼了？怎麼會這樣的！

[病毒样本] 样本

本帖子中包含更多资源

本帖子中包含更多资源

我的NOD啊。讓我失望到了及點！

本帖子中包含更多资源

回复 8楼 quange 的帖子