3个更新[MD5: 807B23 5537B4 A33F31]

显示全部楼层 · 发表于 2007-10-12 17:14:27

C:\Documents and Settings\Don johnson\桌面\样本1.rar » RAR » 2003.exe - a variant of Win32/PSW.Lineage.ACN trojan
C:\Documents and Settings\Don johnson\桌面\样本1.rar » RAR » svcos.exe - probably unknown NewHeur_PE virus
C:\Documents and Settings\Don johnson\桌面\样本1.rar » RAR » ndmai.dll - a variant of Win32/PSW.Lineage.DN trojan

显示全部楼层 · 发表于 2007-10-12 17:17:33

kv

http://bbs.kafan.cn/attachment.php?aid=138703->svcos.exe trojan/vb.small.adi 2007-10-12 下午 05:14:48 已删除

显示全部楼层 · 发表于 2007-10-12 17:19:23

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本1.rar'
C:\Documents and Settings\Administrator\桌面\样本1.rar
  [0] Archive type: RAR
  --> 2003.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> svcos.exe
   [DETECTION] Is the Trojan horse TR/VB.bhp
  --> ndmai.dll
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-10-12 17:20:29

瑞星全灭

显示全部楼层 · 发表于 2007-10-12 17:21:14

你又用瑞星？？？？

显示全部楼层 · 发表于 2007-10-12 18:05:13

\ABC\样本1.rar:\2003.exe - 特征码 'Trojan-Dropper.Win32.Delf.MM' 被发现
C:\ABC\样本1.rar:\svcos.exe - 特征码 'Trojan.Win32.VB.bhp' 被发现
C:\ABC\样本1.rar:\ndmai.dll - 特征码 'Trojan-PWS.Lineage.DN' 被发现
C:\ABC\样本1.rar

4 文件被扫描
(1 压缩档 3 文件)
3 特征码被侦测
0 可疑代码段被发现
耗时: 0:00.047

显示全部楼层 · 发表于 2007-10-12 18:51:56

程序:
D:\客户端\样本1\2003.EXE
木马程序生成以下文件:
1) C:\WINDOWS\WEB\PRINTERS\IMAGES\NDMAI.EXE
2) C:\WINDOWS\WEB\PRINTERS\IMAGES\NDMAI.DLL
是否删除木马程序及其衍生物?
程序:
D:\客户端\样本1\SVCOS.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\2008~1\LC.EXE
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-10-12 19:01:07

Result: 1 malware found
Trojan.Win32.VB.bhp (virus)
C:\Users\Administrator\Desktop\Ñù±¾1.rar\svcos.exe

显示全部楼层 · 发表于 2007-10-12 19:03:31

NIS2008 两个
Unresolved Threats:
Infostealer.Lineage
Virus ID: 28547
Type: Compressed
Risk: High (High Stealth, High Removal, High Performance, High Privacy)
Categories: Virus
State: Remove Failed
-----------
1 File
[2003.exe] inside of [c:\users\m\desktop\af1.rar] - Infected

W32.SillyFDC
Virus ID: 35916
Type: Compressed
Risk: High (High Stealth, High Removal, High Performance, High Privacy)
Categories: Virus
State: Remove Failed
-----------
1 File

[病毒样本] 3个更新[MD5: 807B23 5537B4 A33F31]

本帖子中包含更多资源

本帖子中包含更多资源

回复 5楼坐在墙头的帖子

[病毒样本] 3个更新[MD5: 807B23 5537B4 A33F31]

本帖子中包含更多资源

本帖子中包含更多资源

回复 5楼 坐在墙头 的帖子

回复 5楼坐在墙头的帖子