可怜的McAfee用户又中毒了

显示全部楼层 · 发表于 2008-2-14 19:54:36

可怜的McAfee用户又中毒了

显示全部楼层 · 发表于 2008-2-14 19:55:42

木马名称:Trojan-PSW.Win32.QQPass.hbn

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.281\JSWJ.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.QQPass.hbo

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.281\RECYCLED.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2008-2-14 19:56:09

谁让咖啡国内没收集样本的渠道呢

信息 2008-02-14  19:55:25 您此次查毒共查出3个病毒以及危险代码
信息 2008-02-14  19:55:25 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件18个
信息 2008-02-14  19:55:25 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
病毒 2008-02-14  19:55:25 C:\Users\挪威的冬天\Desktop\WINDOWS.rar\Recycled.exe\BindFile\winhelps.exe Win32.Troj.VB.28672 跳过，未处理
病毒 2008-02-14  19:55:25 C:\Users\挪威的冬天\Desktop\WINDOWS.rar\Recycled.exe\BindFile\jswj.exe Win32.PSWTroj.QQPass.65536 跳过，未处理
病毒 2008-02-14  19:55:25 C:\Users\挪威的冬天\Desktop\WINDOWS.rar\jswj.exe Win32.PSWTroj.QQPass.65536 跳过，未处理

不过咖啡现在也带主防了吧应该

显示全部楼层 · 发表于 2008-2-14 19:56:52

G:\Users\Administrator\Desktop\WINDOWS.rar » RAR » Recycled.exe » RAR » jl2.txt » MIME - is OK (internal scanning not performed)
G:\Users\Administrator\Desktop\WINDOWS.rar » RAR » Recycled.exe » RAR » winhelps.exe - probably a variant of Win32/VB trojan
G:\Users\Administrator\Desktop\WINDOWS.rar » RAR » Recycled.exe » RAR » QQ .EXE - probably a variant of Win32/Autorun worm

显示全部楼层 · 发表于 2008-2-14 19:57:18

Start of the scan: 2008年2月14日星期四  19:56

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本\WINDOWS.rar'
C:\Documents and Settings\Administrator\桌面\样本\WINDOWS.rar
  [0] Archive type: RAR
  --> jswj.exe
   [DETECTION] Is the Trojan horse TR/PSW.QQpass.anz
  --> Recycled.exe
   [DETECTION] Contains detection pattern of the dropper DR/PSW.QQPass.anz
   [1] Archive type: RAR SFX (self extracting)
   --> jswj.exe
      [DETECTION] Is the Trojan horse TR/PSW.QQpass.anz
   --> winhelps.exe
      [DETECTION] Is the Trojan horse TR/VB.bmd
   --> QQ .EXE
      [DETECTION] Is the Trojan horse TR/RegChange
   [WARNING] The file was ignored!

End of the scan: 2008年2月14日星期四  19:56
Used time: 00:19 min

The scan has been done completely.

   0 Scanning directories
   18 Files were scanned
   5 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   13 Files not concerned
   4 Archives were scanned
   1 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-2-14 19:58:10

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Win32.VB.yuh
病毒： Trojan.Win32.VB.ypt
病毒： Worm.Win32.VB.yzs

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.31.30

显示全部楼层 · 发表于 2008-2-14 20:01:04

[Scanning : C:\Test]

C:\Test\WINDOWS.rar<RAR>:jswj.exe <- Trojan.Psw.Qqpass.Anz : No action
C:\Test\WINDOWS.rar<RAR>:Recycled.exe<RAR>:jswj.exe <- Trojan.Psw.Qqpass.Anz : No action
C:\Test\WINDOWS.rar<RAR>:Recycled.exe<RAR>:winhelps.exe <- Trojan.Vb.Bmd : No action
C:\Test\WINDOWS.rar<RAR>:Recycled.exe<RAR>:QQ .EXE <- Trojan.Psw.Qqpass.Anz : No action
C:\Test\WINDOWS.rar<RAR>:Recycled.exe<RAR>:QQ .EXE<DLLRES>:res0.exe <- Trojan.Autorun.Aja : No action

Scanned objects : 19

Infected objects : 5

显示全部楼层 · 发表于 2008-2-14 20:02:52

已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.QQPass.anz 檔案: C:\Documents and Settings\kato9096\桌面\202984.rar/jswj.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.QQPass.anz 檔案: C:\Documents and Settings\kato9096\桌面\202984.rar/Recycled.exe//data.rar/jswj.exe
已刪除: 特洛伊木馬程式 Trojan.Win32.VB.bmd 檔案: C:\Documents and Settings\kato9096\桌面\202984.rar/Recycled.exe//data.rar/winhelps.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.QQPass.anz 檔案: C:\Documents and Settings\kato9096\桌面\202984.rar/Recycled.exe//data.rar/QQ .EXE

沒有不报

显示全部楼层 · 发表于 2008-2-14 20:07:31

FS
结果: 发现2个恶意软件
Trojan-PSW.Win32.QQPass.anz (病毒)
C:\Documents and Settings\GUNDAM\桌面\WINDOWS.rar\jswj.exe
C:\Documents and Settings\GUNDAM\桌面\WINDOWS.rar\Recycled.exe

显示全部楼层 · 发表于 2008-2-14 20:57:35

楼主用的杀软确实杀毒能力不强

[病毒样本] 可怜的McAfee用户又中毒了

本帖子中包含更多资源

16/4