磁碟机变种（感染型）

显示全部楼层 · 发表于 2007-11-24 22:00:33

Quick Scanning
C:\ABC\disk.rar
C:\ABC\disk.rar\comadmin.dll
C:\ABC\disk.rar\comempty.dat
C:\ABC\disk.rar\comexp.msc
C:\ABC\disk.rar\comrepl.exe
C:\ABC\disk.rar\comrereg.exe
C:\ABC\disk.rar\lsass.exe
C:\ABC\disk.rar\lsass.exe\FILE:0000
C:\ABC\disk.rar\lsass.exe\FILE:0001
>>> Virus 'Mal/Packer' found in file C:\ABC\disk.rar\lsass.exe\FILE:0001
>>> File "C:\ABC\disk.rar\lsass.exe" has been identified as suspicious 'Sus/Malware-A'.
C:\ABC\disk.rar\mtsadmin.tlb
C:\ABC\disk.rar\pagefile.pif
C:\ABC\disk.rar\pagefile.pif\FILE:0000
C:\ABC\disk.rar\pagefile.pif\FILE:0001
>>> Virus 'Mal/Packer' found in file C:\ABC\disk.rar\pagefile.pif\FILE:0001
>>> File "C:\ABC\disk.rar\pagefile.pif" has been identified as suspicious 'Sus/Malware-A'.
C:\ABC\disk.rar\smss.exe
>>> Virus 'Mal/Packer' found in file C:\ABC\disk.rar\smss.exe
2 files swept in 10 seconds.
3 viruses were discovered.
2 suspicious files were discovered.
1 file out of 2 was infected.
Please send infected samples to Sophos for analysis.
For advice consult www.sophos.com, email support@sophos.com
or telephone +44 1235 559933
Ending Sophos Anti-Virus.

显示全部楼层 · 发表于 2007-11-24 22:02:46

可怕的家伙，迟早被公安机关抓了。

RX20.19.52不杀。

显示全部楼层 · 发表于 2007-11-24 22:03:03

Starting the file scan:

Begin scan in 'E:\disk.rar'
E:\disk.rar
  [0] Archive type: RAR
  --> lsass.exe
   [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/FSG). Please verify the origin of the file
  --> pagefile.pif
   [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/FSG). Please verify the origin of the file
  --> smss.exe
   [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/FSG). Please verify the origin of the file
   [INFO]    The file was deleted!

文件已被压缩了一个不寻常的运行时间压缩工具(PCK/FSG)~

[ 本帖最后由 Graybird 于 2007-11-24 22:09 编辑 ]

显示全部楼层 · 发表于 2007-11-24 22:03:49

江民0个

显示全部楼层 · 发表于 2007-11-24 22:18:21

"Win32:Small-DT2 [Wrm]" has been found in "smss.exe" file.
"Win32:Small-DT2 [Wrm]" has been found in "lsass.exe" file.

那个pagefile.pif和lsass.exe实际上是一个文件于是扫描时我剔除了

显示全部楼层 · 发表于 2007-11-24 22:54:50

卡巴过，上报~

显示全部楼层 · 发表于 2007-11-24 22:55:11

上报，明天干掉

显示全部楼层 · 发表于 2007-11-24 22:58:50

红伞P和咔吧7都不报

显示全部楼层 · 发表于 2007-11-24 23:36:54

原帖由 shixinlong044 于 2007-11-24 22:58 发表
红伞P和咔吧7都不报

请仔细看3楼红伞的扫描结果

显示全部楼层 · 发表于 2007-11-24 23:39:57

[病毒样本] 磁碟机变种（感染型）

本帖子中包含更多资源

3

avast! 2

本帖子中包含更多资源