捆绑了几个

显示全部楼层 · 发表于 2007-10-5 22:27:05

找了半天ACCESS2003 只找到个毒..

http://www.159558.cn/Setup.rar

还有这个，马桶打开他的时候说它启动cmd.exe，点拒绝后 maxthon就退出了
www.verycr.com/Show/Verycr_Show_40060.asp

显示全部楼层 · 发表于 2007-10-5 22:30:50

C:\ABC\Setup.rar:\Install.exe\setup1170.exe
C:\ABC\Setup.rar:\Install.exe\index.tif
C:\ABC\Setup.rar:\Install.exe\MicCal.exe
C:\ABC\Setup.rar:\Install.exe\skyepe.exe - 特征码 'Trojan-PWS.Win32.Nilage.bga' 被发现
C:\ABC\Setup.rar:\Install.exe - 特征码 'Backdoor.Awq.B' 被发现

显示全部楼层 · 发表于 2007-10-5 22:33:30

显示全部楼层 · 发表于 2007-10-5 22:36:55

deleted: virus Worm.Win32.Delf.do File: C:\Documents and Settings\Owner\×ÀÃæ\Setup.rar/Install.exe/skyepe.exe

显示全部楼层 · 发表于 2007-10-5 22:50:25

Starting the file scan:

Begin scan in 'C:\TDDOWNLOAD\Setup.rar'
C:\TDDOWNLOAD\
  Setup.rar
[0] Archive type: RAR
--> Install.exe
      [1] Archive type: RAR SFX (self extracting)
      --> setup1170.exe
      --> index.tif
      --> MicCal.exe
      --> skyepe.exe
         [DETECTION] Contains detection pattern of the worm WORM/Delf.DO
         [WARNING] Infected files in archives cannot be repaired!
      [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-10-5 22:57:01

程序:
C:\WINDOWS.0\SYSTEM\SKYEPE.EXE
可疑程序生成以下文件:
1) C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\05905618.DLL
2) C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\05905618.DAT
3) C:\WINDOWS.0\HELP\05905618.CHM
是否阻止该进程继续运行?

C:\WINDOWS.0\SYSTEM\SETUP1170.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:4915
远端地址:218.16.125.227(广东)
远端端口:80
程序:
C:\WINDOWS.0\SYSTEM\SKYEPE.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\05905618.DLL
2) C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\05905618.DAT
3) C:\WINDOWS.0\HELP\05905618.CHM
是否删除病毒程序及其衍生物?

还要安装脱兔

[病毒样本] 捆绑了几个

本帖子中包含更多资源