毒品来了(样本)

显示全部楼层 · 发表于 2007-10-21 22:50:31

C:\Documents and Settings\Don johnson\桌面\1_200010211608350750.rar » RAR » AUTORUN.EXE - probably a variant of Win32/AutoRun.Q worm
C:\Documents and Settings\Don johnson\桌面\1_200010211608350750.rar » RAR » KVMXFMA.DLL - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\Don johnson\桌面\1_200010211608350750.rar » RAR » SOS.EXE - a variant of Win32/AutoRun.K worm
C:\Documents and Settings\Don johnson\桌面\1_200010211608350750.rar » RAR » SYSWIN7S.JMP - probably a variant of Win32/AutoRun.Q worm
C:\Documents and Settings\Don johnson\桌面\1_200010211608350750.rar » RAR » WINSYS8S.SYS - probably a variant of Win32/AutoRun.Q worm
C:\Documents and Settings\Don johnson\桌面\1_200010211608350750.rar » RAR » KVMXFIS.EXE - a variant of Win32/PSW.OnLineGames.FDY trojan

显示全部楼层 · 发表于 2007-10-22 00:29:02

费尔

显示全部楼层 · 发表于 2007-10-22 00:29:32

KV2008

显示全部楼层 · 发表于 2007-10-22 00:55:07

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\1_200010211608350750.rar'
C:\Users\morgan\Documents\
  1_200010211608350750.rar
[0] Archive type: RAR
--> AUTORUN.EXE
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> AUTORUN.INF
--> KVMXFMA.DLL
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
--> NETMONINSTALLER.EXE
--> NPF_MGM.EXE
--> RPCAPD.EXE
--> SOS.EXE
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> SYSWIN7S.JMP
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> WINSYS8S.SYS
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
--> DAEMON_MGM.EXE
--> KVMXFIS.EXE
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> ZXARPS.EXE
      [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.2
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

End of the scan: 2007年10月21日  09:55
Used time: 00:04 min

The scan has been done completely.

   0 Scanning directories
   13 Files were scanned
   5 viruses and/or unwanted programs were found
   2 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   8 Files not concerned
   1 Archives were scanned
   8 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-10-22 06:53:40

显示全部楼层 · 发表于 2007-10-22 11:37:32

程序: C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1_200010211608350750\KVMXFIS.EXE 1) C:\DFD640453.BAT 是可疑程序! 试图删除文件! 是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1_200010211608350750\SOS.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\SYSTOM.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1_200010211608350750\RPCAPD.EXE
是否阻止该进程继续运行?

[病毒样本] 毒品来了(样本)

本帖子中包含更多资源

本帖子中包含更多资源

呵呵，的确好久没有见毒了

本帖子中包含更多资源

浏览过的版块