http://222.180.36.174/setup.exe

显示全部楼层 · 发表于 2008-4-23 20:37:49

Begin scan in 'C:\Documents and Settings\haha\桌面\setup.exe'
C:\Documents and Settings\haha\桌面\setup.exe
  [0] Archive type: OVL
  --> Object
   [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
   [NOTE]    A backup was created as '48832df1.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!

显示全部楼层 · 发表于 2008-4-23 21:09:50

卡巴现在报了，4个。

显示全部楼层 · 发表于 2008-4-23 22:36:35

金山 0

显示全部楼层 · 发表于 2008-4-23 22:50:32

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\wm[1].zip'
C:\Documents and Settings\Administrator\My Documents\
  wm[1].zip
[0] Archive type: ZIP
--> wm[1].exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [NOTE]    The file was deleted!

显示全部楼层 · 发表于 2008-4-24 00:05:38

Hello.
New malicious software was found in the attached file.
It's detection will be included in the next update. Thank you for your help.
-----------------
Regards, Namestnikov Yury
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com http://www.viruslist.com

显示全部楼层 · 发表于 2008-4-24 10:14:12

Starting the file scan:

Begin scan in 'E:\新建文件夹 (2)\SGASPF080423.rar'
E:\新建文件夹 (2)\SGASPF080423.rar
  [0] Archive type: RAR
  --> SGASPF080423.EXE
   [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
   [NOTE]    The file was deleted!

显示全部楼层 · 发表于 2008-4-24 10:16:04

Starting the file scan:

Begin scan in 'E:\新建文件夹 (2)\setup.exe'
E:\新建文件夹 (2)\setup.exe
[DETECTION] Is the Trojan horse TR/Dropper.743002
[NOTE] The file was deleted!

显示全部楼层 · 发表于 2008-4-24 10:16:28

2008-4-24 10:14:26 恶意HTTP对象 <http://222.180.36.174/setup.exe//PE_Patch//UPack>：检测到：木马程序 'Trojan-Spy.Win32.Pophot.arl'。　

显示全部楼层 · 发表于 2008-4-24 10:21:25

原帖由 挪威的冬天 于 2008-4-23 22:36 发表
金山 0

试试行为拦截。。。

显示全部楼层 · 发表于 2008-4-24 15:26:47

The file 'LWIAS16_080423.DLL' has been determined to be 'MALWARE'. Our analysts named the threat TR/Spy.Pophot.arl. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.

[病毒样本] http://222.180.36.174/setup.exe

回复 9楼 Nblock 的帖子