送上一個樣本! 冰刀 Wsyscheck 會失效

211

送上一個樣本! 冰刀 Wsyscheck 會失效

解壓縮密碼 virus
http://www.91files.com/?PBEO2UCWXDR6O2POLOTC

scottxzt

Begin scan in 'C:\Documents and Settings\dell\桌面\新建文件夹'
C:\Documents and Settings\dell\桌面\新建文件夹\Win32\dumped_.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Tibs.OF
      [WARNING]   The file was ignored!
C:\Documents and Settings\dell\桌面\新建文件夹\Win32\win32.exe
      [DETECTION] Contains detection pattern of the worm WORM/Zhelatin.Gen
      [WARNING]   The file was ignored!

红心王子

2007-10-10        18:01:39        1192010499        SYSTEM        1196        Sign of "Win32:Tibser" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹\Win32\win32.exe" file.  
2007-10-10        18:01:44        1192010504        SYSTEM        1196        Sign of "Win32:Tibs-BBQ [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\新建文件夹\Win32\dumped_.exe" file.

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 364
Paranoia Database - 7024
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\Win32

C:\Documents and Settings\uhthn\Desktop\Win32\win32.exe - Suspected Trojan-Downloader.Small.2
C:\Documents and Settings\uhthn\Desktop\Win32\dumped_.exe - Suspected Trojan-Downloader.Small.2

2 Files scanned
0 Infected files found
2 Suspected files found
0 Files cured
0 Files deleted

wangfeng66

C:\Win32\win32.exe - infected with Trojan.Packed.142
C:\Win32\dumped_.exe - infected with Trojan.DownLoader.19256

DRWEB 4.44

曲中求

踩踩。。

电影结束了

Scan performed at: 2007-10-10 19:11:47
Scanning Log
NOD32 version 2582 (20071009) NT
Command line: C:\Documents and Settings\wangcheng\桌面\win32.rar
C:\Program Files\Eset\nod32.exe - is OK

Date: 10.10.2007  Time: 19:11:49
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\wangcheng\桌面\win32.rar
C:\Documents and Settings\wangcheng\桌面\win32.rar ?RAR ?Win32\dumped_.exe - probably a variant of Win32/TrojanDownloader.Small.AWA trojan
C:\Documents and Settings\wangcheng\桌面\win32.rar ?RAR ?Win32\win32.exe - Win32/Nuwar.Gen worm
Number of scanned files: 3
Number of threats found: 2
Number of active threats: 1
Time of completion: 19:11:51 Total scanning time: 2 sec (00:00:02)

motnahp

失效是啥意思，放行病毒以后监测不到hook还是驱动被拦住了无法注入

wangjay1980

deleted: virus Packed.Win32.Tibs.ch        File: C:\Documents and Settings\Owner\×ÀÃæ\Win32.rar/Win32\win32.exe
deleted: Trojan program Trojan-Downloader.Win32.Tibs.of        File: C:\Documents and Settings\Owner\×ÀÃæ\Win32.rar/Win32\dumped_.exe

残缺的唯美

Malicious code found in file C:\Users\Administrator\Desktop\Win32\Win32\win32.exe.
Infection: Packed.Win32.Tibs.ch
Action: The file was deleted.

Malicious code found in file C:\Users\Administrator\Desktop\Win32\Win32\dumped_.exe.
Infection: Trojan-Downloader.Win32.Tibs.of
Action: The file was deleted.