4个相关[MD5: 848F6E 3F8D00 C0BB1B 4CF6C4]

显示全部楼层 · 发表于 2007-11-9 20:02:46

http://bbs.kafan.cn/viewthread.php?tid=154442&extra=page%3D1

显示全部楼层 · 发表于 2007-11-9 20:04:47

C:\ABC\样本1.rar:\InstallDn_13[1].exe - 特征码 'Virus.Win32.Agent.KJK' 被发现
C:\ABC\样本1.rar:\gnayinoa.sys - 特征码 'Virus.Win32.Agent.KJK' 被发现
C:\ABC\样本1.rar:\msbqybek.sys - 特征码 'Virus.Win32.Agent.KJK' 被发现
C:\ABC\样本1.rar:\usbplus.sys - 特征码 'Virus.Win32.Agent.KJK' 被发现
C:\ABC\样本1.rar

显示全部楼层 · 发表于 2007-11-9 20:09:20

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\INSTALLDN_13[1].EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\ATICHECK.EXE
2) C:\WINDOWS\SYSTEM32\TAPIEXT.DLL
3) C:\WINDOWS\SYSTEM32\DRIVERS\USBPLUS.SYS
4) C:\EXECMAIN.EXE
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-11-9 20:18:33

RX20.17.42未杀。

显示全部楼层 · 发表于 2007-11-9 20:25:40

AVAST报病毒

显示全部楼层 · 发表于 2007-11-9 20:35:53

kis7全过

显示全部楼层 · 发表于 2007-11-9 20:40:07

ENA一样全过....

显示全部楼层 · 发表于 2007-11-9 22:55:06

AVAST全灭

显示全部楼层 · 发表于 2007-11-9 23:02:48

F-Secure躺了

显示全部楼层 · 发表于 2007-11-9 23:54:13

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\样本1.rar'
C:\Users\morgan\Documents\
  样本1.rar
[0] Archive type: RAR
--> InstallDn_13[1].exe
      [DETECTION] Is the Trojan horse TR/Drop.Agent.135168.3
      [WARNING] Infected files in archives cannot be repaired!
--> gnayinoa.sys
--> msbqybek.sys
--> usbplus.sys
      [WARNING] The file was ignored!

End of the scan: 2007年11月9日  07:53
Used time: 00:05 min

The scan has been done completely.

   0 Scanning directories
   5 Files were scanned
   1 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   4 Files not concerned
   1 Archives were scanned
   2 Warnings
   0 Notes

[病毒样本] 4个相关[MD5: 848F6E 3F8D00 C0BB1B 4CF6C4]

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块