先锋论坛被挂的东东和其生成的东东

显示全部楼层 · 发表于 2007-10-14 12:18:05

[ 本帖最后由 promised 于 2007-10-14 12:19 编辑 ]

显示全部楼层 · 发表于 2007-10-14 12:20:33

上报

显示全部楼层 · 发表于 2007-10-14 12:22:58

2007-10-14 12:22:50 文件保护(创建文件) 操作:阻止
进程路径:G:\V\allinstall.exe
文件路径:C:\WINDOWS\system32\alldele.ini

显示全部楼层 · 发表于 2007-10-14 12:23:57

2007-10-14 12:23:27 文件保护(创建文件) 操作:阻止
进程路径:G:\V\candoall.exe
文件路径:C:\WINDOWS\system32\hideme.sys

显示全部楼层 · 发表于 2007-10-14 12:24:26

2007-10-14 12:24:12 应用程序保护(运行应用程序) 操作:允许
进程路径:C:\WINDOWS\Explorer.EXE
文件路径:G:\V\passsd.exe
米动作了

显示全部楼层 · 发表于 2007-10-14 12:31:26

DRWEB 4.44 MISS

显示全部楼层 · 发表于 2007-10-14 12:54:59

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\virus.rar'
C:\Users\morgan\Documents\
  virus.rar
  virus.rar:Zone.Identifier
[0] Archive type: RAR
--> allinstall.exe
--> candoall.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
--> hideme.sys
--> MASSLTUAS35.DLL
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
--> masxml32.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
--> passsd.exe
      [WARNING] The file was ignored!

End of the scan: 2007年10月13日  21:54
Used time: 00:04 min

The scan has been done completely.

   0 Scanning directories
   8 Files were scanned
   0 viruses and/or unwanted programs were found
   3 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   8 Files not concerned
   1 Archives were scanned
   4 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-10-14 12:56:52

上报去

显示全部楼层 · 发表于 2007-10-14 13:02:19

Start of the scan: Sunday, 14 October, 2007  13:02

Starting the file scan:

Begin scan in 'C:\Documents and Settings\tim\桌面\virus.rar'
C:\Documents and Settings\tim\桌面\virus.rar
  [0] Archive type: RAR
  --> candoall.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> MASSLTUAS35.DLL
   [DETECTION] Contains suspicious code HEUR/Malware
  --> masxml32.dll
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    A backup was created as '4783a33c.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!

End of the scan: Sunday, 14 October, 2007  13:02
Used time: 00:02 min

The scan has been done completely.

   0 Scanning directories
   7 Files were scanned
   0 viruses and/or unwanted programs were found
   3 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   1 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   7 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-10-14 15:26:18

NOD32 MISS

[病毒样本] 先锋论坛被挂的东东和其生成的东东

本帖子中包含更多资源

浏览过的版块