11pcs

显示全部楼层 · 发表于 2008-3-31 18:22:07

网络问题，抱歉。

[ 本帖最后由自由于 2008-3-31 18:39 编辑 ]

显示全部楼层 · 发表于 2008-3-31 18:24:31

？样本。。

显示全部楼层 · 发表于 2008-3-31 18:32:40

avast 080329-0, 2008-03-29

Win32:Trojan-gen {VC}
Win32:Agent-BQC [Trj] x 3

[ 本帖最后由 qianwenxiang 于 2008-3-31 19:13 编辑 ]

显示全部楼层 · 发表于 2008-3-31 18:43:29

到底是多少个...

显示全部楼层 · 发表于 2008-3-31 18:45:55

Starting the file scan:

Begin scan in 'D:\11.rar'
D:\11.rar
  [0] Archive type: RAR
  --> zt.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 3.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 9.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 29(1).exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> 27.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 9(1).exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 5(1).exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.637
  --> 25.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> 34.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> t.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 23.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [INFO]    The file was deleted!

End of the scan: 2008年3月31日  18:47
Used time: 00:26 min

The scan has been done completely.

   0 Scanning directories
   12 Files were scanned
   9 viruses and/or unwanted programs were found
   2 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   3 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-3-31 18:49:35

2008-3-26 18:16:36 AMON 文件 C:\DOCUME~1\ADMINI~1\LOCALS~1\temp\Rar$EX00.828\auto.exe 可能是 Win32/Genetik 木马的一个变种已隔离 - 已删除程序新建文件时发生事件： C:\Program Files\WinRAR\WinRAR.exe. 文件已被移入隔离区。您可以关闭本窗口。
2008-3-26 15:11:52 AMON 文件 C:\DOCUME~1\ADMINI~1\LOCALS~1\temp\Rar$DI00.500\svcos2.ex2e Win32/TrojanDropper.Agent.NJA 木马已隔离 - 已删除程序新建文件时发生事件： C:\Program Files\WinRAR\WinRAR.exe. 文件已被移入隔离区。您可以关闭本窗口。
2008-3-26 15:03:30 AMON 文件 C:\DOCUME~1\ADMINI~1\LOCALS~1\temp\Rar$EX00.532\SoundMan.exe Win32/VB.NME 木马已隔离 - 已删除 COMPUTER\Administrator 程序新建文件时发生事件： C:\Program Files\WinRAR\WinRAR.exe. 文件已被移入隔离区。您可以关闭本窗口。
2008-3-26 15:02:43 AMON 文件 C:\DOCUME~1\ADMINI~1\LOCALS~1\temp\Rar$EX00.359\explorer.exe 可能是 Win32/Genetik 木马的一个变种已隔离 - 已删除程序新建文件时发生事件： C:\Program Files\WinRAR\WinRAR.exe. 文件已被移入隔离区。您可以关闭本窗口。

显示全部楼层 · 发表于 2008-3-31 18:59:41

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.GameOL.GEN
病毒： Trojan.PSW.Win32.SO2Online.br
病毒： RootKit.Win32.Undef.ec
病毒： RootKit.Win32.Undef.ec
病毒： Trojan.PSW.Win32.SunOnline.nh

MAC 地址：00:17:31:40:A3:57

用户来源：局域网

软件版本：20.38.01

显示全部楼层 · 发表于 2008-3-31 19:00:41

[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\11\zt.exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\11\3.exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\11\9.exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\11\27.exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\11\9(1).exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\11\5(1).exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\11\25.exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\11\34.exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\11\23.exe->exefile->(UPack)

显示全部楼层 · 发表于 2008-3-31 19:06:14

C:\Documents and Settings\Administrator\桌面\11.rar>>23.exe W32.Warezov.p 病毒还未处理
C:\Documents and Settings\Administrator\桌面\11.rar>>25.exe TrojanPSW.OnLineGames.rri.fccq 木马还未处理
C:\Documents and Settings\Administrator\桌面\11.rar>>27.exe W32.Viking.k 病毒还未处理
C:\Documents and Settings\Administrator\桌面\11.rar>>29(1).exe W32.Generic.worm.ycve 病毒还未处理
C:\Documents and Settings\Administrator\桌面\11.rar>>3.exe W32.Viking.k 病毒还未处理
C:\Documents and Settings\Administrator\桌面\11.rar>>34.exe TrojanPSW.OnLineGames.rri.fccq 木马还未处理
C:\Documents and Settings\Administrator\桌面\11.rar>>5(1).exe W32.Viking.k 病毒还未处理
C:\Documents and Settings\Administrator\桌面\11.rar>>9(1).exe TrojanPSW.OnLineGames.rri.fccq 木马还未处理
C:\Documents and Settings\Administrator\桌面\11.rar>>9.exe W32.Viking.k 病毒还未处理
C:\Documents and Settings\Administrator\桌面\11.rar>>t.exe Heuri.Possible/Packed 启发式扫描还未处理
C:\Documents and Settings\Administrator\桌面\11.rar>>zt.exe W32.Viking.k 病毒还未处理

显示全部楼层 · 发表于 2008-3-31 19:07:43

上几张图~

[病毒样本] 11pcs

本帖子中包含更多资源

本帖子中包含更多资源

11

36/8

9

11个

剩下的都运行了一下~全部截住了~

本帖子中包含更多资源