木马KERNELWIND64.EXE

显示全部楼层 · 发表于 2008-1-26 13:55:41

协议类型:TCP
本地地址:0.0.0.0
本地端口:2758
远端地址:77.91.229.55(美国)
远端端口:80

木马程序生成以下文件
1) C:\WINDOWS\SYSTEM32\KERNELWIND64.EXE
是否删除木马程序及其衍生物

显示全部楼层 · 发表于 2008-1-26 13:56:40

LZ，樣本重復了。。。

[ 本帖最后由 garyyan456 于 2008-1-26 14:00 编辑 ]

显示全部楼层 · 发表于 2008-1-26 14:01:08

The requested object is INFECTED. The following viruses Trojan-Downloader.Win32.Tibs.uk were found

显示全部楼层 · 发表于 2008-1-26 14:01:13

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\1.rar'
C:\Documents and Settings\Administrator\桌面\1.rar
  [0] Archive type: RAR
  --> 1.exe
   [DETECTION] Contains detection pattern of the worm WORM/Zhelatin.Gen
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2008-1-26 14:05:19

微点砍掉

显示全部楼层 · 发表于 2008-1-26 14:05:26

Rising20.28.50未杀。

显示全部楼层 · 发表于 2008-1-26 14:37:00

kv2008，过

显示全部楼层 · 发表于 2008-1-26 14:48:32

我把压缩包下载后未解压，我先用AVG扫描了压缩包，过！再用小红伞扫描，发现了东西

，见附件。

显示全部楼层 · 发表于 2008-1-26 15:56:18

v7的一次更新就把v8扔下了。。
我要换回v7。。。

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\1.rar'
C:\Documents and Settings\Administrator\My Documents\
  1.rar
[0] Archive type: RAR
--> 1.exe
  1.rar:Zone.Identifier

End of the scan: 2008年1月25日  23:55
Used time: 00:01 min

The scan has been done completely.

   0 Scanning directories
   3 Files were scanned
   0 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   3 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-1-26 20:58:50

McAfee miss

[病毒样本] 木马KERNELWIND64.EXE

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块