popwin[MD5: 26F601 8073AC]

显示全部楼层 · 发表于 2007-11-9 20:34:38

detected: virus Heur.Trojan.Generic (modification) URL: http://bbs.kafan.cn/attachment.php?aid=151328//A65461A2.EXE

显示全部楼层 · 发表于 2007-11-9 20:35:55

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\A65461A2.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\886131C6.EXE
2) C:\WINDOWS\SYSTEM32\85EE8C1F.DLL
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-11-9 20:36:13

RX20.17.42未杀。

显示全部楼层 · 发表于 2007-11-9 20:39:26

C:\Documents and Settings\wangcheng\桌面\样本.rar » RAR » 34805C67.DLL - a variant of Win32/TrojanDownloader.Flux trojan
C:\Documents and Settings\wangcheng\桌面\样本.rar » RAR » A65461A2.EXE - a variant of Win32/TrojanDownloader.Flux trojan
C:\Documents and Settings\wangcheng\桌面\样本.rar:Zone.Identifier - is OK

显示全部楼层 · 发表于 2007-11-9 20:45:47

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本.rar'
C:\Documents and Settings\Administrator\桌面\样本.rar
  [0] Archive type: RAR
  --> 34805C67.DLL
   [DETECTION] Is the Trojan horse TR/Dldr.SmallAl.fvn
  --> A65461A2.EXE
   [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-11-11 02:19:45

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 814
Paranoia Database - 48608
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\a

C:\Documents and Settings\Uhthn\Desktop\a\34805C67.DLL - Infected BACKDOOR.AGENT.5 - Deleted
C:\Documents and Settings\Uhthn\Desktop\a\A65461A2.EXE - Infected TROJAN-DOWNLOADER.AGENT.3 - Deleted

2 Files scanned
2 Infected files found
0 Suspected files found
0 Files disinfected
2 Files deleted

[病毒样本] popwin[MD5: 26F601 8073AC]

本帖子中包含更多资源