样本来了

promised

C:\ABC\新建文件夹\1261.exe
        C:\ABC\新建文件夹\1261.exe\FILE:0000
>>> File "C:\ABC\新建文件夹\1261.exe" has been identified as suspicious 'Sus/Malware-A'.
        C:\ABC\新建文件夹\5.exe
>>> File "C:\ABC\新建文件夹\5.exe" has been identified as suspicious 'Sus/ComPack-C'.
        C:\ABC\新建文件夹\explorer.exe
>>> Virus 'Mal/Emogen-N' found in file C:\ABC\新建文件夹\explorer.exe
        C:\ABC\新建文件夹\snow.exe
>>> File "C:\ABC\新建文件夹\snow.exe" has been identified as suspicious 'Sus/Behav-1021'.
        C:\ABC\新建文件夹\svohoei.exe
>>> Virus 'Mal/Emogen-N' found in file C:\ABC\新建文件夹\svohoei.exe
        C:\ABC\新建文件夹\windrx.exe
        C:\ABC\新建文件夹\winsys.exe
        C:\ABC\新建文件夹\winsys.inf
        C:\ABC\新建文件夹\winsys.sys

leonfg

FS扫描全过！！！

gho

W:\winsys.sys        W32/MumaWow (Virus)
2007-12-9        10:35:24        Deleted         WHUT-D9193C067E\gho        WinRAR.exe        W:\explorer.exe        Generic Delphi (Trojan)

gho

detected: adware not-a-virus:AdWare.Win32.Ejik.n        File: W:\1261.exe//PE_Patch.PECompact//PecBundle//PECompact
detected: Trojan program Backdoor.Win32.Hupigon.aclq        File: W:\5.exe
detected: Trojan program Trojan-Downloader.Win32.Losabel.ag        File: W:\snow.exe
detected: Trojan program Backdoor.Win32.Hupigon.aclr        File: W:\svohoei.exe

mingxian519

KV2008 没查出来几个....楼主这包里到底有几个是毒啊?

will

2007-12-9 11:33:12 Win32:Baidubar-B [Trj] 1261.exe
2007-12-9 11:33:15 Win32:WinFixer-S [Trj] snow.exe
2007-12-9 11:33:15 Win32:Hupigon-FB [Trj] svohoei.exe
2007-12-9 11:33:15 Win32:Delf-BQR [Trj]   windrx.exe

啊弥陀佛

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹[1]\SVOHOEI.EXE
木马程序生成以下文件:
1) C:\WINNT\SVOHOEI.EXE
2) C:\WINNT\SYSTEM32\_SVOHOEI.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹[1]\5.EXE
是否删除木马程序及其衍生物?

cjl615

天！！！红伞全过！！！！到底有毒吗？