临走前抛上一个

显示全部楼层 · 发表于 2008-1-31 15:09:51

费尔报VMP壳

显示全部楼层 · 发表于 2008-1-31 15:10:55

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\down.rar'
C:\Documents and Settings\Administrator\My Documents\
  down.rar
  down.rar:Zone.Identifier
[0] Archive type: RAR
--> down.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    The file was deleted!

显示全部楼层 · 发表于 2008-1-31 15:13:56

AVAST和大蜘蛛都被过

显示全部楼层 · 发表于 2008-1-31 15:18:06

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Packer.Win32.VmpPacker.a

用户来源：互联网

软件版本：20.29.30

瑞星也报壳

显示全部楼层 · 发表于 2008-1-31 15:19:20

Begin scan in 'C:\Documents and Settings\Administrator\桌面\down.rar'
C:\Documents and Settings\Administrator\桌面\down.rar
  [0] Archive type: RAR
  --> down.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [INFO]    The file was deleted!

End of the scan: 2008年1月31日  15:19
Used time: 00:04 min

The scan has been done completely.

   0 Scanning directories
   2 Files were scanned
   1 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes

红伞

显示全部楼层 · 发表于 2008-1-31 15:21:57

UGuard AutoProtect R3Defender v1.9.0 - 开始防护在2008年1月31日15时19分36秒
级别：0，down.exe 试图以复合权限打开注册表项目 \REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Services\VGADown 。 - 允许
级别：3，down.exe 试图打开受保护的文件 \\.\PhysicalDrive0 。 - 允许
UGuard AutoProtect R3Defender - 进程退出在2008年1月31日15时19分37秒，代码：0

要干嘛？？

显示全部楼层 · 发表于 2008-1-31 15:34:25

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Packer.Win32.VmpPacker.a

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.29.30

显示全部楼层 · 发表于 2008-1-31 15:37:51

发现未知木马，是否删除？
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.531\DOWN.EXE
木马程序生成以下文件:
1) C:\WINDOWS\AVP.EXE
2) C:\WINDOWS\SYSTEM32\HSMIA4.DLL
是否删除木马程序及其衍生物?

延迟删除文件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.531\DOWN.EXE
删除失败!

延迟删除文件!

显示全部楼层 · 发表于 2008-1-31 15:48:50

ESET
C:\Documents and Settings\GUNDAM\桌面\down.rar » RAR » down.exe - probably a variant of Win32/PSW.Maran trojan

这个壳脱了好几秒

显示全部楼层 · 发表于 2008-1-31 16:10:01

微点砍掉
我这没有延迟删除的提示

[病毒样本] 临走前抛上一个

本帖子中包含更多资源

3/1一个月前的病毒！

本帖子中包含更多资源

浏览过的版块