一对父子

显示全部楼层 · 发表于 2007-12-7 19:15:03

avast报 win32:vb-fbx (3)

显示全部楼层 · 发表于 2007-12-7 19:16:27

Pass

[ 本帖最后由 FBAV 于 2007-12-7 19:18 编辑 ]

显示全部楼层 · 发表于 2007-12-7 19:17:20

Starting the file scan:

Begin scan in 'E:\1207.rar'
E:\1207.rar
  [0] Archive type: RAR
  --> InstallerN60.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Vb.cbc
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-12-7 19:28:14

检测到：病毒 Virus.Win32.VB.ig 文件　: F:\du\1207.rar/BProtect.exe

显示全部楼层 · 发表于 2007-12-7 19:51:49

DRWEB 4.44 Miss

显示全部楼层 · 发表于 2007-12-7 20:19:05

程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\INSTALLERN60.EXE
是否阻止该进程继续运行?
C:\DOCUMENTS AND SETTINGS\DELL\桌面\INSTALLERN60.EXE
协议类型:UDP
本地地址:0.0.0.0
本地端口:1191
远端地址:218.2.135.1(江苏·南京)程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\INSTALLERN60.EXE
是否删除病毒程序及其衍生物?程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\BPROTECT.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\DELL\桌面\BPROTECT.AXV
是否删除木马程序及其衍生物?

远端端口:53

显示全部楼层 · 发表于 2007-12-7 20:26:55

C:\Users\Wesley\Desktop\1207.rar » RAR » InstallerN60.exe - probably unknown NewHeur_PE virus

显示全部楼层 · 发表于 2007-12-7 20:29:23

2007-12-7 20:29:06 Real-time file system protection file F:\virus\1207\InstallerN60.exe probably unknown NewHeur_PE virus deleted - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.

显示全部楼层 · 发表于 2007-12-7 21:20:10

已解毒: 病毒 Virus.Win32.VB.ig 檔案: C:\Documents and Settings\kato9096\桌面\167770.rar/BProtect.exe

一个不报，已上报

显示全部楼层 · 发表于 2007-12-7 21:35:19

The file 'BProtect.exe' has been determined to be 'MALWARE'. Our analysts named the threat W32.Protect.A. Detection will be added to our virus definition file (VDF) with one of the next updates.

[病毒样本] 一对父子

本帖子中包含更多资源

ESET Smart Security

回复 3楼 Graybird 的帖子