一个微点报马的网页

显示全部楼层 · 发表于 2007-11-9 11:43:40

http://www.smoile.com/article.asp?id=820

显示全部楼层 · 发表于 2007-11-9 12:46:08

瑞星金山防漏瑞星防漏没报什么

显示全部楼层 · 发表于 2007-11-9 12:57:00

HIPS没有表现出行为,杀软也没报,我用OPERA浏览器

显示全部楼层 · 发表于 2007-11-9 13:01:14

开OP FF就不用进去了吧？还有回帖的必要么？

显示全部楼层 · 发表于 2007-11-9 14:44:38

原帖由 cy6266812 于 2007-11-9 12:57 发表
HIPS没有表现出行为,杀软也没报,我用OPERA浏览器

没用ie，打好补丁的就不要去了
我用的ie，系统一个补丁没打
下面是微点报的文件，从隔离区找出来的，解压后记得改后缀

显示全部楼层 · 发表于 2007-11-9 14:53:24

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\C1437CA8.rar'
C:\Users\morgan\Documents\
  C1437CA8.rar
[0] Archive type: RAR
--> C1437CA8.DLL-
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!
Begin scan in 'C:\Users\morgan\Documents\SYS111.rar'
C:\Users\morgan\Documents\
  SYS111.rar
[0] Archive type: RAR
--> SYS111.EXE-
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!
Begin scan in 'C:\Users\morgan\Documents\30BD0591.rar'
C:\Users\morgan\Documents\
  30BD0591.rar
[0] Archive type: RAR
--> 30BD0591.EXE-
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

End of the scan: 2007年11月8日  22:53
Used time: 00:05 min

The scan has been done completely.

   0 Scanning directories
   6 Files were scanned
   2 viruses and/or unwanted programs were found
   1 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   4 Files not concerned
   3 Archives were scanned
   6 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-11-9 15:38:39

detected: Trojan program Backdoor.Win32.Popwin.ait URL: http://bbs.kafan.cn/attachment.php?aid=151032//SYS111.EXE-
detected: Trojan program Backdoor.Win32.Popwin.ait URL: http://bbs.kafan.cn/attachment.php?aid=151033//30BD0591.EXE-
detected: Trojan program Backdoor.Win32.Popwin.ait URL: http://bbs.kafan.cn/attachment.php?aid=151034//C1437CA8.DLL-

显示全部楼层 · 发表于 2007-11-9 19:50:26

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.QQPass.yxf

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.17.41

[病毒样本] 一个微点报马的网页

本帖子中包含更多资源

回复 5楼 xxh21cn 的帖子 6/1