[MD5: F86C6C 35C710]

显示全部楼层 · 发表于 2007-11-3 18:17:55

扫描进行于：2007-11-3 18:18:27
扫描日志
NOD32版本 2635 (20071102) NT
命令行： C:\Documents and Settings\Administrator.0CDC92BBFF714E5\桌面\样本3.rar

日期： 3.11.2007 时间：18:18:30
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\Administrator.0CDC92BBFF714E5\桌面\样本3.rar
C:\Documents and Settings\Administrator.0CDC92BBFF714E5\桌面\样本3.rar >>RAR >>7793EF25.DLL - Win32/TrojanDownloader.Flux 木马的变种
C:\Documents and Settings\Administrator.0CDC92BBFF714E5\桌面\样本3.rar >>RAR >>DCA57A55.EXE - Win32/TrojanDownloader.Flux 木马的变种
已扫描的文件数目：2
已发现的病毒数目：2
完成时间： 18:18:31 总扫描时间：1 秒 (00:00:01)

显示全部楼层 · 发表于 2007-11-3 18:29:04

Kaspersky Internet Security 7.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=148469 is infected with 2d2d079c-2208-4760-ac29-0bb66b90cdd4 virus

显示全部楼层 · 发表于 2007-11-3 19:15:17

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本3.rar'
C:\Documents and Settings\Administrator\桌面\样本3.rar
  [0] Archive type: RAR
  --> 7793EF25.DLL
   [DETECTION] Contains suspicious code HEUR/Malware
  --> DCA57A55.EXE
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

显示全部楼层 · 发表于 2007-11-3 19:22:03

C:\��3.rar\7793EF25.DLL - infected with Trojan.Popwin.origin

DRWEB 4.44 杀一个漏一个。

显示全部楼层 · 发表于 2007-11-3 20:16:16

卡巴6：飘过……

小红伞：
Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本3.rar'
C:\Documents and Settings\Administrator\桌面\样本3.rar
  [0] Archive type: RAR
  --> 7793EF25.DLL
   [DETECTION] Contains suspicious code HEUR/Malware
  --> DCA57A55.EXE
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [WARNING] The file was ignored!

BD2008：
Remaining issues:Object Name Threat Name Final Status
C:\Documents and Settings\Administrator\桌面\样本3.rar=]7793EF25.DLL Win32.Worm.Winko.I Infected
C:\Documents and Settings\Administrator\桌面\样本3.rar=]DCA57A55.EXE Win32.Worm.Winko.I Infected

看来又是针对卡巴做的免杀……

显示全部楼层 · 发表于 2007-11-3 21:49:26

C:\Documents and Settings\Uhthn\Desktop\New Folder\DCA57A55.EXE : is suspected of Trojan-PSW.Game.63 (paranoid heuristics)
C:\Documents and Settings\Uhthn\Desktop\New Folder\DCA57A55.EXE : backup copy created

Directories    : 0    Files in archives:    Files on disks:
Archives:                - total    : 0    - total    : 2
- scanned       : 0    -  scanned : 0    - scanned    : 2
- contain viruses : 0    -  infected : 0    - infected : 0
- deleted       : 0    -  suspicious : 0    - suspicious  : 1

显示全部楼层 · 发表于 2007-11-3 21:49:56

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 803
Paranoia Database - 48490
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\New Folder

C:\Documents and Settings\Uhthn\Desktop\New Folder\7793EF25.DLL - Infected VIRUS.AUTORUN.4 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\DCA57A55.EXE - Infected BACKDOOR.AGENT.9 - Deleted

2 Files scanned
2 Infected files found
0 Suspected files found
0 Files disinfected
2 Files deleted

显示全部楼层 · 发表于 2007-11-3 21:54:20

FS扫描没有发现
但是运行的时候沙盘起了作用

[病毒样本] [MD5: F86C6C 35C710]

本帖子中包含更多资源

vba32

本帖子中包含更多资源