来个暗藏杀机的数字证书

Nblock

原帖由 啊弥陀佛 于 2007-10-23 11:18 发表
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARPKK.EXE
被修改文件:
C:\WINDOWS\SYSTEM32\NPPTOOLS.DLL
是否阻止文件被修改 ...

微点杀

浪滔天

卡巴 125
16个

已删除: 木马程序 Trojan-PSW.Win32.QQGame.ao        文件: F:\病毒样本\TDDOWNLOAD.rar/100.exe//UPX
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.fye        文件: F:\病毒样本\TDDOWNLOAD.rar/113.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.fwx        文件: F:\病毒样本\TDDOWNLOAD.rar/111.exe//PE_Patch.UPX//UPX//PE_Patch
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.ftr        文件: F:\病毒样本\TDDOWNLOAD.rar/108.exe//PE_Patch.UPX//UPX//PE_Patch
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.fnp        文件: F:\病毒样本\TDDOWNLOAD.rar/106.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.fnn        文件: F:\病毒样本\TDDOWNLOAD.rar/109.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.fnn        文件: F:\病毒样本\TDDOWNLOAD.rar/112.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.fmp        文件: F:\病毒样本\TDDOWNLOAD.rar/104.exe//PE_Patch.UPX//UPX
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.fmd        文件: F:\病毒样本\TDDOWNLOAD.rar/101.exe//PE_Patch.UPX//UPX//PE_Patch
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.ffe        文件: F:\病毒样本\TDDOWNLOAD.rar/107.exe//PE_Patch.UPX//UPX
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.fei        文件: F:\病毒样本\TDDOWNLOAD.rar/102.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.fda        文件: F:\病毒样本\TDDOWNLOAD.rar/103.exe//PE_Patch.UPX//UPX
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.fbo        文件: F:\病毒样本\TDDOWNLOAD.rar/105.exe
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.fbm        文件: F:\病毒样本\TDDOWNLOAD.rar/110.exe//PE_Patch.UPX//UPX
已删除: 木马程序 Trojan-Downloader.Win32.Delf.aas        文件: F:\病毒样本\TDDOWNLOAD.rar/hosts.exe
已删除: 风险软件 not-a-virus:NetTool.Win32.Agent.b        文件: F:\病毒样本\TDDOWNLOAD.rar/arpkk.exe//data.rar/Vml.exe

kkgh

日期： 23.10.2007  时间：20:35:36
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\zh\桌面\TDDOWNLOAD.rar
C:\Documents and Settings\zh\桌面\TDDOWNLOAD.rar >>RAR >>hosts.exe - Win32/TrojanDownloader.SMW.A 木马
C:\Documents and Settings\zh\桌面\TDDOWNLOAD.rar >>RAR >>100.exe - 可能是 Win32/AutoRun.Q 蠕虫 的一个变种
C:\Documents and Settings\zh\桌面\TDDOWNLOAD.rar >>RAR >>101.exe - Win32/PSW.OnLineGames.NFL 木马的变种
C:\Documents and Settings\zh\桌面\TDDOWNLOAD.rar >>RAR >>102.exe - Win32/PSW.OnLineGames.NGU 木马
C:\Documents and Settings\zh\桌面\TDDOWNLOAD.rar >>RAR >>103.exe - Win32/PSW.OnLineGames.YA 木马的变种
C:\Documents and Settings\zh\桌面\TDDOWNLOAD.rar >>RAR >>104.exe - Win32/PSW.OnLineGames.NFL 木马的变种
C:\Documents and Settings\zh\桌面\TDDOWNLOAD.rar >>RAR >>105.exe - Win32/PSW.OnLineGames.NFL 木马
C:\Documents and Settings\zh\桌面\TDDOWNLOAD.rar >>RAR >>106.exe - Win32/PSW.OnLineGames.NGU 木马
C:\Documents and Settings\zh\桌面\TDDOWNLOAD.rar >>RAR >>107.exe - Win32/PSW.OnLineGames.YA 木马的变种
C:\Documents and Settings\zh\桌面\TDDOWNLOAD.rar >>RAR >>108.exe - Win32/PSW.OnLineGames.NFL 木马的变种
C:\Documents and Settings\zh\桌面\TDDOWNLOAD.rar >>RAR >>109.exe - Win32/PSW.OnLineGames.NGU 木马
C:\Documents and Settings\zh\桌面\TDDOWNLOAD.rar >>RAR >>110.exe - Win32/PSW.OnLineGames.NFL 木马的变种
C:\Documents and Settings\zh\桌面\TDDOWNLOAD.rar >>RAR >>111.exe - Win32/PSW.OnLineGames.NFL 木马的变种
C:\Documents and Settings\zh\桌面\TDDOWNLOAD.rar >>RAR >>112.exe - Win32/PSW.OnLineGames.NGU 木马
C:\Documents and Settings\zh\桌面\TDDOWNLOAD.rar >>RAR >>113.exe - 可能是 Win32/PSW.OnLineGames.NGU 木马 的一个变种
C:\Documents and Settings\zh\桌面\TDDOWNLOAD.rar >>RAR >>arpkk.exe >>RAR >>wpcap.dll - 是正常的
C:\Documents and Settings\zh\桌面\TDDOWNLOAD.rar >>RAR >>arpkk.exe >>RAR >>npptools.dll - 是正常的
C:\Documents and Settings\zh\桌面\TDDOWNLOAD.rar >>RAR >>arpkk.exe >>RAR >>3.vbs - 是正常的
C:\Documents and Settings\zh\桌面\TDDOWNLOAD.rar >>RAR >>arpkk.exe >>RAR >>drivers\npf.sys - 是正常的
C:\Documents and Settings\zh\桌面\TDDOWNLOAD.rar >>RAR >>arpkk.exe >>RAR >>Vml.exe - 是正常的
C:\Documents and Settings\zh\桌面\TDDOWNLOAD.rar >>RAR >>arpkk.exe >>RAR >>Packet.dll - 是正常的
C:\Documents and Settings\zh\桌面\TDDOWNLOAD.rar >>RAR >>arpkk.exe >>RAR >>run.bat - 是正常的
C:\Documents and Settings\zh\桌面\TDDOWNLOAD.rar >>RAR >>arpkk.exe >>RAR >>WanPacket.dll - 是正常的
C:\Documents and Settings\zh\桌面\TDDOWNLOAD.rar - 多重感染 - 已删除
已扫描的文件数目：24
已发现的病毒数目：15
已清除病毒的文件数目：1
完成时间： 20:35:39 总扫描时间：3 秒 (00:00:03)

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 659
Paranoia Database - 48035
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\TDDOWNLOAD

C:\Documents and Settings\Uhthn\Desktop\TDDOWNLOAD\hosts.exe - Suspected WIN32.TROJAN-DOWNLOADER.ZLOB.1
C:\Documents and Settings\Uhthn\Desktop\TDDOWNLOAD\100.exe - Infected WIN32.TROJAN-PSW.QQPASS.A - Deleted
C:\Documents and Settings\Uhthn\Desktop\TDDOWNLOAD\101.exe - Infected TROJAN-PSW.ONLINEGAMES.43 - Deleted
C:\Documents and Settings\Uhthn\Desktop\TDDOWNLOAD\102.exe - Infected TROJAN-PSW.ONLINEGAMES.48 - Deleted
C:\Documents and Settings\Uhthn\Desktop\TDDOWNLOAD\103.exe - Infected TROJAN-PSW.ONLINEGAMES.43 - Deleted
C:\Documents and Settings\Uhthn\Desktop\TDDOWNLOAD\104.exe - Infected TROJAN-PSW.ONLINEGAMES.43 - Deleted
C:\Documents and Settings\Uhthn\Desktop\TDDOWNLOAD\105.exe - Infected TROJAN-PSW.ONLINEGAMES.8 - Deleted
C:\Documents and Settings\Uhthn\Desktop\TDDOWNLOAD\106.exe - Infected TROJAN-PSW.ONLINEGAMES.48 - Deleted
C:\Documents and Settings\Uhthn\Desktop\TDDOWNLOAD\107.exe - Suspected TROJAN-DOWNLOADER.SMALL.2
C:\Documents and Settings\Uhthn\Desktop\TDDOWNLOAD\108.exe - Infected TROJAN-PSW.ONLINEGAMES.43 - Deleted
C:\Documents and Settings\Uhthn\Desktop\TDDOWNLOAD\109.exe - Infected TROJAN-PSW.ONLINEGAMES.48 - Deleted
C:\Documents and Settings\Uhthn\Desktop\TDDOWNLOAD\110.exe - Infected TROJAN-PSW.ONLINEGAMES.43 - Deleted
C:\Documents and Settings\Uhthn\Desktop\TDDOWNLOAD\111.exe - Infected TROJAN-PSW.ONLINEGAMES.43 - Deleted
C:\Documents and Settings\Uhthn\Desktop\TDDOWNLOAD\112.exe - Infected TROJAN-PSW.ONLINEGAMES.48 - Deleted
C:\Documents and Settings\Uhthn\Desktop\TDDOWNLOAD\113.exe - Infected TROJAN-PSW.ONLINEGAMES.48 - Deleted
C:\Documents and Settings\Uhthn\Desktop\TDDOWNLOAD\arpkk.exe - OK

16 Files scanned
13 Infected files found
2 Suspected files found
0 Files cured
13 Files deleted