4个

显示全部楼层 · 发表于 2008-2-27 11:07:01

．．．．．．．．．

[ 本帖最后由 csscz.love 于 2008-2-27 11:54 编辑 ]

显示全部楼层 · 发表于 2008-2-27 11:08:50

D:\download\10.rar>>101\C\WINDOWS\SYSTEM32\SNPMW.DLL Trojan.Trandnum.DF.pcna.arc.dll 木马还未处理
D:\download\10.rar>>101\C\WINDOWS\SYSTEM32\WMPNS.DLL TrojanDownloader.Agent.bkj.dpp.arc.dll 木马还未处理
D:\download\d.rar>>du\C\WINDOWS\TEMP\RUNASSRV.EXE TrojanZlob.Gen.39.cjmq 木马还未处理

显示全部楼层 · 发表于 2008-2-27 11:17:17

微点砍掉

显示全部楼层 · 发表于 2008-2-27 11:17:21

卡巴一个都不报，上报

显示全部楼层 · 发表于 2008-2-27 11:22:19

antivir就是所谓的一脱吓死人呀。。。
我到宁可他不脱壳了，log都不好看了。。

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\10.rar'
C:\Documents and Settings\Administrator\My Documents\
  10.rar
[0] Archive type: RAR
   --> 101\C\WINDOWS\SYSTEM32\SNPMW.DLL
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/ZSKiller.B
         [WARNING] Infected files in archives cannot be repaired!
      --> Object
         [DETECTION] Is the Trojan horse TR/ZSKiller.C.1
         [WARNING] Infected files in archives cannot be repaired!
      --> Object
      [2] Archive type: RSRC
      --> Object
            [DETECTION] Is the Trojan horse TR/ZSKiller.C.1
            [WARNING] Infected files in archives cannot be repaired!
      --> Object
         [DETECTION] Is the Trojan horse TR/Dldr.Agent.aqt
         [WARNING] Infected files in archives cannot be repaired!
      --> Object
         [DETECTION] Is the Trojan horse TR/Drop.ZSKiller.2
         [WARNING] Infected files in archives cannot be repaired!
--> 101\C\WINDOWS\SYSTEM32\WMPNS.DLL
      [DETECTION] Is the Trojan horse TR/Dldr.ZSKiller.2
      [WARNING] Infected files in archives cannot be repaired!
--> 101\ArFile.log
   [INFO]    The file was deleted!
Begin scan in 'C:\Documents and Settings\Administrator\My Documents\d.rar'
C:\Documents and Settings\Administrator\My Documents\
  d.rar
[0] Archive type: RAR
--> du\C\WINDOWS\TEMP\RUNASSRV.EXE
      [DETECTION] Is the Trojan horse TR/Zlob.Gen.39
      [WARNING] Infected files in archives cannot be repaired!
--> du\ArFile.log
   [INFO]    The file was deleted!

End of the scan: 2008年2月26日  19:21
Used time: 00:07 min

The scan has been done completely.

   0 Scanning directories
   7 Files were scanned
   7 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   2 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   0 Files not concerned
   2 Archives were scanned
   7 Warnings
   0 Notes

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\Drive.rar'
C:\Documents and Settings\Administrator\My Documents\
  Drive.rar
[0] Archive type: RAR
--> Drive.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
Begin scan in 'C:\Documents and Settings\Administrator\My Documents\TIMPlatform.rar'
C:\Documents and Settings\Administrator\My Documents\
  TIMPlatform.rar
[0] Archive type: RAR
--> TIMPlatform.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!

[ 本帖最后由 mofunzone 于 2008-2-26 22:16 编辑 ]

显示全部楼层 · 发表于 2008-2-27 11:30:36

AVAST！杀了

显示全部楼层 · 发表于 2008-2-27 11:43:03

eset 1
C:\Documents and Settings\软件学院\桌面\10.rar>RAR>101\C\WINDOWS\SYSTEM32\WMPNS.DLL - 可能是 Win32/Agent 特洛伊木马的变种

显示全部楼层 · 发表于 2008-2-27 11:47:43

Hello.
No malicious software was found in the attached file.

Please quote all when answering. Do not forget to include you registration data.
-----------------
Regards, Vyacheslav Zakorzhevsky
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com http://www.viruslist.com

显示全部楼层 · 发表于 2008-2-27 12:04:18

IK
I:\virus\February\27\10.rar:\101\C\WINDOWS\SYSTEM32\SNPMW.DLL - Signature 'Virus.Win32.Trojano.DF' found
I:\virus\February\27\10.rar:\101\C\WINDOWS\SYSTEM32\WMPNS.DLL - Signature 'Trojan-Dropper.Zskiller.C' found
I:\virus\February\27\10.rar:\101\ArFile.log
I:\virus\February\27\10.rar
I:\virus\February\27\d.rar:\du\C\WINDOWS\TEMP\RUNASSRV.EXE - Signature 'Trojan.Zlob.1' found
I:\virus\February\27\d.rar:\du\ArFile.log
I:\virus\February\27\d.rar
I:\virus\February\27\Drive.rar:\Drive.exe - Signature 'Worm.Win32.AutoRun.brs' found
I:\virus\February\27\Drive.rar
I:\virus\February\27\TIMPlatform.rar:\TIMPlatform.exe - Signature 'Worm.Win32.AutoRun.brs' found
I:\virus\February\27\TIMPlatform.rar

11 Files scanned
(4 Archives with 7 files)
5 Signatures found
0 Suspect code-parts found
Used time: 0:00.922

IK误报

显示全部楼层 · 发表于 2008-2-27 12:34:56

蠕虫名称:Worm.Win32.AutoRun.aqt

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.407\DRIVE.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?

蠕虫名称:Worm.Win32.AutoRun.aqt

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.218\TIMPLATFORM.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?

[病毒样本] 4个

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块