来个＋3

显示全部楼层 · 发表于 2008-2-7 21:11:08

跟着LZ跑

刚弄完一个，又来一个

显示全部楼层 · 发表于 2008-2-7 21:14:53

油你敢一次性放完么

病毒 2008-02-07  21:13:43 病毒在文件C:\Users\挪威的冬天\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6RKBCP8K\mkkh[1].exe中 Win32.Packed.MaskPE 处理成功（操作：删除）

信息 2008-02-07  21:14:46 您此次查毒共查出4个病毒以及危险代码
信息 2008-02-07  21:14:46 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件5个
信息 2008-02-07  21:14:46 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
风险程序 2008-02-07  21:14:46 C:\Users\挪威的冬天\Desktop\常用工具.rar\灰鸽子配置器.exe Win32.RiskWare.mPacker.a.282265 跳过，未处理
风险程序 2008-02-07  21:14:46 C:\Users\挪威的冬天\Desktop\常用工具.rar\ntscan.exe Win32.RiskWare.mPacker.a.282265 跳过，未处理
风险程序 2008-02-07  21:14:46 C:\Users\挪威的冬天\Desktop\常用工具.rar\s扫描器.exe Win32.RiskWare.mPacker.a.282265 跳过，未处理
风险程序 2008-02-07  21:14:46 C:\Users\挪威的冬天\Desktop\常用工具.rar\3322客户端.exe Win32.RiskWare.mPacker.a.282265 跳过，未处理

显示全部楼层 · 发表于 2008-2-7 21:18:23

IK
I:\virus\test\102146535906.rar:\new_33.EXE - Signature 'Trojan-Downloader.Win32.Banload.ase' found
I:\virus\test\102146535906.rar
I:\virus\test\QQ信息炸弹v1[1].0.rar:\QQ信息炸弹v1.0.exe
I:\virus\test\QQ信息炸弹v1[1].0.rar
I:\virus\test\qzone.rar:\QQ空间人气精灵.exe - Suspect code-parts found (Level: 110)
I:\virus\test\qzone.rar:\版本说明.txt
I:\virus\test\qzone.rar:\免责声明.txt
I:\virus\test\qzone.rar:\升级方法.txt
I:\virus\test\qzone.rar
I:\virus\test\TKGZ.rar:\黑防灰鸽子脱壳版.exe - Signature 'MalwareScope.Backdoor.Hupigon.3' found
I:\virus\test\TKGZ.rar:\Cache\CServer.dat - Signature 'Generic.Graybird' found
I:\virus\test\TKGZ.rar:\Config\2007-08-15_114915.dat
I:\virus\test\TKGZ.rar:\Config\2007-08-15_114915.ini
I:\virus\test\TKGZ.rar:\dat\QQwry.dat
I:\virus\test\TKGZ.rar:\dat\ResHacker.EXE
I:\virus\test\TKGZ.rar:\SOUND\downfile.wav
I:\virus\test\TKGZ.rar:\SOUND\login.wav
I:\virus\test\TKGZ.rar:\SOUND\offline.wav
I:\virus\test\TKGZ.rar:\SOUND\setting.wav
I:\virus\test\TKGZ.rar:\SOUND\upfile.wav
I:\virus\test\TKGZ.rar:\Operate.ini
I:\virus\test\TKGZ.rar
22 Files scanned
(4 Archives with 18 files)
3 Signatures found
1 Suspect code-part found
Used time: 0:01.438

显示全部楼层 · 发表于 2008-2-7 21:19:28

最后那个红伞卡巴ALL kill

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\mkkh.exe'
C:\Documents and Settings\Administrator\桌面\mkkh.exe
[DETECTION] Is the Trojan horse TR/Crypt.NSPI.Gen
[INFO] The file was deleted!

显示全部楼层 · 发表于 2008-2-7 21:28:02

微点能过吗

显示全部楼层 · 发表于 2008-2-7 21:51:13

Hello,

####.txt, ####.txt1, ####.txt2, QQ######.exed, QQ####v1.0.exed

No malicious code were found in these files.

Please quote all when answering.

--
Best regards, Denis Maslennikov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

> Attachment: qzone.rar
> Attachment: QQv1.0.rar

显示全部楼层 · 发表于 2008-2-7 21:52:25

2008-2-7 JAY21:47:41 Detected Trojan program Trojan-Dropper.Win32.Flystud.q High E:\下载基地\TKGZ.rar/黑防灰鸽子脱壳版.exe
2008-2-7 JAY21:47:41 Detected Trojan program Backdoor.Win32.Hupigon.dsx High E:\下载基地\TKGZ.rar/Cache\CServer.dat
2008-2-7 JAY21:47:38 Detected Trojan program Trojan-Downloader.Win32.Delf.enh High E:\下载基地\mkkh.exe/UPack/PE_Patch.MaskPE
2008-2-7 JAY21:47:38 Detected Virus Packed.Win32.CPEX-based.d High E:\下载基地\常用工具.rar/灰鸽子配置器.exe
2008-2-7 JAY21:47:38 Detected Virus Packed.Win32.CPEX-based.d High E:\下载基地\常用工具.rar/s扫描器.exe
2008-2-7 JAY21:47:38 Detected Virus Packed.Win32.CPEX-based.d High E:\下载基地\常用工具.rar/ntscan.exe
2008-2-7 JAY21:47:38 Detected Virus Packed.Win32.CPEX-based.d High E:\下载基地\常用工具.rar/3322客户端.exe
2008-2-7 JAY21:47:31 Detected Virus Packed.Win32.PolyCrypt.b High E:\下载基地\102146535906.rar/new_33.EXE/Orien/data0000.cab/11.exe
2008-2-7 JAY21:47:31 Detected Virus Packed.Win32.CPEX-based.d High E:\下载基地\常用工具.rar/灰鸽子配置器.exe
2008-2-7 JAY21:47:31 Detected Virus Packed.Win32.CPEX-based.d High E:\下载基地\常用工具.rar/ntscan.exe
2008-2-7 JAY21:47:31 Detected Virus Packed.Win32.CPEX-based.d High E:\下载基地\常用工具.rar/s扫描器.exe
2008-2-7 JAY21:47:31 Detected Virus Packed.Win32.CPEX-based.d High E:\下载基地\常用工具.rar/3322客户端.exe
2008-2-7 JAY21:47:30 Detected Trojan program Backdoor.Win32.Hupigon.dsx High E:\下载基地\TKGZ.rar/Cache\CServer.dat
2008-2-7 JAY21:47:30 Detected Trojan program Trojan-Dropper.Win32.Flystud.q High E:\下载基地\TKGZ.rar/黑防灰鸽子脱壳版.exe
2008-2-7 JAY21:47:29 Detected Virus Packed.Win32.PolyCrypt.b High E:\下载基地\102146535906.rar/new_33.EXE/Orien/data0000.cab/11.exe
2008-2-7 JAY21:47:29 Detected Trojan program Trojan-Downloader.Win32.Delf.enh High E:\下载基地\mkkh.exe/UPack/PE_Patch.MaskPE

显示全部楼层 · 发表于 2008-2-7 22:10:43

http://shuaixi.cn/TKGZ.rar--5.52M

http://bird972.web1.7it7.cn/常用工具.rar--7.89M

显示全部楼层 · 发表于 2008-2-7 22:11:48

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Win32.ELan.c
病毒： Backdoor.Gpigeon.urw
病毒： Backdoor.Win32.Watcher.d

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.30.20

显示全部楼层 · 发表于 2008-2-7 23:04:55

AVAST 4

Sign of "Win32:Delf-HME [Trj]" has been found in "http://www.jdzblog.com/UploadFiles/2008-1/102146535906.rar\new_33.EXE\[ORiEN]" file.

Sign of "Win32:QQPass-OQ [Trj]" has been found in "http://hckl.9k9k.cn/mkkh.exe\[Upack]\[MaskPE]\[Embedded#DLLFILE]\[NsPack]" file.

Sign of "Win32:Delf-BQR [Trj]" has been found in "http://bird972.web1.7it7.cn/%B3%A3%D3%C3%B9%A4%BE%DF.rar\3322客户端.exe" file.

Sign of "Win32:GrayBird-BD [Trj]" has been found in "http://shuaixi.cn/TKGZ.rar\黑防灰鸽子脱壳版.exe" file.

[已鉴定] 来个＋3

这2个体积巨大！

45/7