8个

qianwenxiang

顺便吼一下 不要在样本区发布实验室样本 这几天样本区口水战太多了 杀软喜好看自己 不要总是展开某杀软FANS对抗某杀软FANS的攻势 版规修改的事情目前还在联系番茄ing..

电影结束了

对象: pcihdd.sys
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\DRIVERS.RAR
        Status: 已发现病毒
        病毒: Trojan-Downloader.Win32.Agent.blm (KAV 引擎), Rootkit.Agent.VX (BD 引擎)
对象: runtime.sys
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\DRIVERS.RAR
        Status: 已发现病毒
        病毒: Trojan-Downloader.Win32.Agent.dpe (KAV 引擎), Trojan.Pandex.S (BD 引擎)
对象: nod32drv.sys
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\DRIVERS.RAR
        Status: 已发现病毒
        病毒: Trojan-Proxy.Win32.Saturn.t (KAV 引擎), Trojan.Spambot.BZH (BD 引擎)

Graybird

Starting the file scan:

Begin scan in 'E:\DRIVERS.RAR'
E:\DRIVERS.rar
  [0] Archive type: RAR
  --> pcihdd.sys
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.blm.3
  --> runtime.sys
      [DETECTION] Contains detection pattern of the worm WORM/Ntech.Z.2
  --> nod32drv.sys
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [WARNING]   The file was ignored!

冷冷

ＩＫ
I:\virus\DRIVERS.RAR:\NSDriver.sys
I:\virus\DRIVERS.RAR:\pcihdd.sys - Signature 'Trojan-Downloader.Win32.Agent.hif' found
I:\virus\DRIVERS.RAR:\runtime.sys - Signature 'Rootkit.Win32.Agent.dw' found
I:\virus\DRIVERS.RAR:\hidusb.sys
I:\virus\DRIVERS.RAR:\KAVSafe.sys
I:\virus\DRIVERS.RAR:\mouhid.sys
I:\virus\DRIVERS.RAR:\NMnt.sys
I:\virus\DRIVERS.RAR:\nod32drv.sys - Signature 'Trojan-Proxy.Win32.Agent.nu' found
I:\virus\DRIVERS.RAR

        9 Files scanned
          (1 Archiv with 8 files)
        3 Signatures found
        0 Suspect code-parts found
        Used time: 0:00.063

ClamAV
I:\virus\test/nod32drv.sys: Broken.Executable FOUND
I:\virus\test/pcihdd.sys: Trojan.Downloader-13207 FOUND
I:\virus\test/runtime.sys: Trojan.Rootkit-227 FOUND
----------- SCAN SUMMARY -----------
Known viruses: 201991
Engine version: 0.92
Scanned directories: 1
Scanned files: 8
Infected files: 3
Data scanned: 0.22 MB
Time: 6.406 sec (0 m 6 s)

[ 本帖最后由 冷_冷 于 2008-2-2 18:36 编辑 ]

gho

2008年2月2日 18:34:36 - 18:34:37
计算机名称: CN-89FF4B9EA4D6
扫描类型: 扫描指定目标
目标: I:\hanxiaojun\DRIVERS(1).RAR


--------------------------------------------------------------------------------

结果: 发现3个恶意软件
Trojan-Downloader.Win32.Agent.blm (病毒)
I:\hanxiaojun\DRIVERS(1).RAR\pcihdd.sys
Trojan-Downloader.Win32.Agent.dpe (病毒)
I:\hanxiaojun\DRIVERS(1).RAR\runtime.sys
Trojan-Proxy.Win32.Saturn.t (病毒)
I:\hanxiaojun\DRIVERS(1).RAR\nod32drv.sys

Joker

deleted: Trojan program Trojan-Downloader.Win32.Agent.blm        File: C:\Documents and Settings\Administrator\×ÀÃæ\DRIVERS.RAR/pcihdd.sys
deleted: Trojan program Trojan-Downloader.Win32.Agent.dpe        File: C:\Documents and Settings\Administrator\×ÀÃæ\DRIVERS.RAR/runtime.sys
deleted: Trojan program Trojan-Proxy.Win32.Saturn.t        File: C:\Documents and Settings\Administrator\×ÀÃæ\DRIVERS.RAR/nod32drv.sys

sam.to

已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Agent.blm        檔案: C:\Documents and Settings\kato9096\桌面\DRIVERS.RAR/pcihdd.sys
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Agent.dpe        檔案: C:\Documents and Settings\kato9096\桌面\DRIVERS.RAR/runtime.sys
已刪除: 特洛伊木馬程式 Trojan-Proxy.Win32.Saturn.t        檔案: C:\Documents and Settings\kato9096\桌面\DRIVERS.RAR/nod32drv.sys

不报的上报

Nerazzurri

扫描进行于：2008-2-2 18:44:36
扫描日志
NOD32版本 2845 (20080202) NT
命令行： C:\Documents and Settings\Nerazzurri\桌面\DRIVERS.RAR

日期： 2.2.2008  时间：18:44:38
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\Nerazzurri\桌面\DRIVERS.RAR
C:\Documents and Settings\Nerazzurri\桌面\DRIVERS.RAR >>RAR >>pcihdd.sys - Win32/TrojanDownloader.Small.HLV 木马
C:\Documents and Settings\Nerazzurri\桌面\DRIVERS.RAR >>RAR >>runtime.sys - Win32/Rootkit.Agent.NDF 木马
C:\Documents and Settings\Nerazzurri\桌面\DRIVERS.RAR >>RAR >>nod32drv.sys - Win32/Nulprot.A 蠕虫的变种
已扫描的文件数目：8
已发现的病毒数目：3
完成时间： 18:44:39 总扫描时间：1 秒 (00:00:01)

woai_jolin

2008-2-2 18:52:18        Real-time file system protection        file        G:\v\nod32drv.sys        a variant of Win32/Nulprot.A worm        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-2-2 18:52:17        Real-time file system protection        file        G:\v\runtime.sys        Win32/Rootkit.Agent.NDF trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-2-2 18:52:16        Real-time file system protection        file        G:\v\pcihdd.sys        Win32/TrojanDownloader.Small.HLV trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.

woai_jolin

2008-2-2 18:55:01 Kernel File  'G:\v\NMnt.sys' was sent to ESET for analysis.
2008-2-2 18:54:50 Kernel File  'G:\v\mouhid.sys' was sent to ESET for analysis.
2008-2-2 18:53:42 Kernel File  'G:\v\KAVSafe.sys' was sent to ESET for analysis.
2008-2-2 18:53:10 Kernel File  'G:\v\NSDriver.sys' was sent to ESET for analysis.
2008-2-2 18:59:17 Kernel File  'G:\v\rarjfpi.dll' was sent to ESET for analysis.

[ 本帖最后由 woai_jolin 于 2008-2-2 19:01 编辑 ]