U盘

显示全部楼层 · 发表于 2007-10-12 20:05:12

2个

显示全部楼层 · 发表于 2007-10-12 20:08:17

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Worm.Win32.AvKiller.bo
病毒： Worm.Win32.PaBug.ao

MAC地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：19.44.42

显示全部楼层 · 发表于 2007-10-12 20:14:41

卡巴

已删除: 病毒 Virus.Win32.AutoRun.sz 文件: F:\病毒样本\capxteo.rar/capxteo.exe//NSPack
已删除: 病毒 Virus.Win32.AutoRun.th 文件: F:\病毒样本\capxteo.rar/AutoRun.exe//UPX

显示全部楼层 · 发表于 2007-10-12 20:15:00

C:\ABC\capxteo.rar:\capxteo.exe - 特征码 'Virus.Win32.AutoRun.mv' 被发现
C:\ABC\capxteo.rar:\autorun.inf
C:\ABC\capxteo.rar:\AutoRun.exe - 特征码 'Virus.Win32.AutoRun.bs' 被发现

显示全部楼层 · 发表于 2007-10-12 20:17:25

Result: 2 malware found
Virus.Win32.AutoRun.sz (virus)
C:\Users\Administrator\Desktop\capxteo.rar\capxteo.exe
Virus.Win32.AutoRun.th (virus)
C:\Users\Administrator\Desktop\capxteo.rar\AutoRun.ex

显示全部楼层 · 发表于 2007-10-12 20:23:38

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\capxteo.rar'
C:\Documents and Settings\Administrator\桌面\capxteo.rar
  [0] Archive type: RAR
  --> capxteo.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPI.Gen
  --> AutoRun.exe
   [DETECTION] Is the Trojan horse TR/PSW.Steal.45190.1
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-10-12 21:08:42

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 505
Paranoia Database - 10371
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder (2)

C:\Documents and Settings\uhthn\Desktop\New Folder (2)\capxteo.exe - Suspected MalwareDetector:Win32.Trojan-Downloader.Delf.1
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\autorun.inf - OK
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\AutoRun.exe - Infected Win32.Trojan-PSW.QQPass.a

3 Files scanned
1 Infected files found
1 Suspected files found
0 Files cured
1 Files deleted

显示全部楼层 · 发表于 2007-10-12 21:58:21

C:\Documents and Settings\Don johnson\桌面\capxteo.rar » RAR » capxteo.exe - Win32/Delf.NDF worm
C:\Documents and Settings\Don johnson\桌面\capxteo.rar » RAR » AutoRun.exe - probably a variant of Win32/AutoRun.Q worm

显示全部楼层 · 发表于 2007-10-13 12:39:51

Start of the scan: Saturday, 13 October, 2007  12:39

Starting the file scan:

Begin scan in 'C:\Documents and Settings\tim\桌面\capxteo.rar'
C:\Documents and Settings\tim\桌面\capxteo.rar
  [0] Archive type: RAR
  --> capxteo.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPI.Gen
  --> AutoRun.exe
   [DETECTION] Is the Trojan horse TR/PSW.Steal.45190.1
   [INFO]    A backup was created as '47804c6a.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!

End of the scan: Saturday, 13 October, 2007  12:39
Used time: 00:01 min

The scan has been done completely.

   0 Scanning directories
   4 Files were scanned
   2 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   1 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   1 Archives were scanned
   0 Warnings

显示全部楼层 · 发表于 2007-10-13 14:40:00

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\AUTORUN.EXE
由
E:\AUTORUN.INF
自启动运行!
并生成以下文件:
1) E:\AUTORUN.EXE
2) E:\AUTORUN.INF
以及可由此INF文件引导自启的文件:
E:\AUTORUN.EXE

是否删除木马程序及其衍生
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\CAPXTEO.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\COMMON FILES\SYSTEM\MVGCJCW.EXE
2) C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WSOPOJC.EXE
是否删除木马程序及其衍生物?

[病毒样本] U盘

本帖子中包含更多资源

6/2