偶也来几个样本

显示全部楼层 · 发表于 2007-10-5 19:27:03

大家扫扫看压缩包里隐身文件多呵呵

显示全部楼层 · 发表于 2007-10-5 19:28:03

2007-10-5 19:28:08 Real-time file system protection file G:\V\enwfqxeksy.dll a variant of Win32/PSW.WOW.YB trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007-10-5 19:28:07 Real-time file system protection file G:\V\_rejoice45.exe probably a variant of Win32/Hupigon trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007-10-5 19:28:05 Real-time file system protection file G:\V\教程.Exe Win32/AutoRun.Q worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007-10-5 19:28:04 Real-time file system protection file G:\V\nhbivui.exe Win32/Delf.NDF worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.

显示全部楼层 · 发表于 2007-10-5 19:29:02

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Worm.Win32.AvKiller.bk

MAC地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：19.43.40

文件名字很熟悉，哪见过。

显示全部楼层 · 发表于 2007-10-5 19:30:26

MicroVita AntiSpyware 100 C
_____________________________________________

         风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]
               http://221.10.254.214/
----------------------------------------------
开始扫描……

正在检查启动……
[C:\Documents and Settings\Administrator\桌面\Virus\system32\explorev.exe]
                  …………发现Spy！报告: [4]
文件信息:  大小:600576  MD5:be741ecdaefa273a021043fc0978a277

[C:\Documents and Settings\Administrator\桌面\Virus\system32\nhbivui.exe]
                  …………发现Spy！报告: [4] [1]
文件信息:  大小:32489  MD5:e5dc743c8dff551ae85d271aa4f609ea

[C:\Documents and Settings\Administrator\桌面\Virus\system32\教程.Exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:33063  MD5:2cbef55713cad85ec3937bf71818a069

[C:\Documents and Settings\Administrator\桌面\Virus\system32\_rejoice45.exe]
                  …………发现Spy！报告: [4] [1]
文件信息:  大小:403968  MD5:e4daccdbd211a545aac412f75f2ecce6

[C:\Documents and Settings\Administrator\桌面\Virus\system32\enwfqxeksy.dll]
                  …………发现Spy！报告:[1]
文件信息:  大小:17188  MD5:08891b9d7232712223517b82c39384de

文件数:6 病毒数:5  比重:0.8333333333333
OK  扫描完毕！

  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎
[2] 文件特征码引擎
[1] 文件启发式引擎

[ 本帖最后由 FBAV 于 2007-10-5 19:32 编辑 ]

显示全部楼层 · 发表于 2007-10-5 19:34:07

卡巴 4个

已删除: 病毒 Virus.Win32.AutoRun.qb 文件: F:\病毒样本\system32[1]\nhbivui.exe//FSG
已删除: 木马程序 Backdoor.Win32.Hupigon.ich 文件: F:\病毒样本\system32[1]\explorev.exe
已删除: 木马程序 Trojan-PSW.Win32.QQGame.ai 文件: F:\病毒样本\system32[1]\教程.Exe//UPX
已删除: 木马程序 Trojan-PSW.Win32.WOW.yw 文件: F:\病毒样本\system32[1]\enwfqxeksy.dll//UPack

显示全部楼层 · 发表于 2007-10-5 19:37:13

显示全部楼层 · 发表于 2007-10-5 19:38:54

2007-10-5 19:38:41 1191584321 Administrator 3832 Sign of "Win32:Delf-FKO [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\system32.part3.rar\enwfqxeksy.dll\[Upack]" file.
2007-10-5 19:38:44 1191584324 Administrator 3832 Sign of "Win32:Delf-ERE [Wrm]" has been found in "C:\Documents and Settings\Administrator\桌面\system32.part2.rar\nhbivui.exe\[FSG]" file.
2007-10-5 19:38:44 1191584324 Administrator 3832 Sign of "Win32:Delf-FZG [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\system32.part2.rar\教程.Exe\[UPX]\[Embedded#05ef8]" file.
2007-10-5 19:38:45 1191584325 Administrator 3832 Sign of "Win32:Hupigon-FB [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\system32.part2.rar\_rejoice45.exe\[ASPack]" file.

显示全部楼层 · 发表于 2007-10-5 19:39:44

[Found virus] <W32/Downloader.gen10> C:\ABC\system32\enwfqxeksy.dll
[Found possible virus] < (not disinfectable)> C:\ABC\system32\explorev.exe->(Aspack)->(Aspack)
[Found possible virus] <W32/Threat-SysAdderSml-based!Maximus> C:\ABC\system32\nhbivui.exe
[Clean] C:\ABC\system32\PCdoctor.exe
[Found possible virus] <W32/Trojan-Hupigon-based!Maximus> C:\ABC\system32\_rejoice45.exe
[Clean] C:\ABC\system32\教程.Exe->(UPX)
[Clean] C:\ABC\system32\教程.Exe

显示全部楼层 · 发表于 2007-10-5 19:54:32

2007-10-05 19:50  静态查毒  explorev.exe  D:\Documents and Settings\Administrator\桌面\system32[1]\  Backdoor.Win32.Hupigon.cir  已忽略  Administrator  F05BA72628A8436
2007-10-05 19:50  静态查毒  nhbivui.exe  D:\Documents and Settings\Administrator\桌面\system32[1]\  Worm.IM.Jonie.c  已忽略  Administrator  F05BA72628A8436
2007-10-05 19:50  静态查毒  教程.Exe  D:\Documents and Settings\Administrator\桌面\system32[1]\  Trojan.PSW.OnLineGames.eqo  已忽略  Administrator  F05BA72628A843

显示全部楼层 · 发表于 2007-10-5 19:55:12

Starting the file scan:

Begin scan in 'C:\Documents and Settings\tim\桌面\system32.part2.rar'
C:\Documents and Settings\tim\桌面\system32.part2.rar
  [0] Archive type: RAR
  --> nhbivui.exe
   [DETECTION] Is the Trojan horse TR/Agent.32427
  --> ½Ì³Ì.Exe
   [DETECTION] Is the Trojan horse TR/PSW.QQGame.AI.1
   [INFO]    A backup was created as '4779268a.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
Begin scan in 'C:\Documents and Settings\tim\桌面\system32.part3.rar'
C:\Documents and Settings\tim\桌面\system32.part3.rar
  [0] Archive type: RAR
  --> enwfqxeksy.dll
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    A backup was created as '46d0ac0b.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
Begin scan in 'C:\Documents and Settings\tim\桌面\system32.part1.rar'

End of the scan: Friday, 5 October, 2007  19:54
Used time: 00:02 min

The scan has been done completely.

   0 Scanning directories
   10 Files were scanned
   2 viruses and/or unwanted programs were found
   1 Files were classified as suspicious:
   2 files were deleted
   0 files were repaired
   2 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   8 Files not concerned
   3 Archives were scanned
   0 Warnings
   1 Notes

[病毒样本] 偶也来几个样本

本帖子中包含更多资源

16/1

本帖子中包含更多资源