过大多数+1。。。。

显示全部楼层 · 发表于 2008-5-1 10:40:52

红伞同学报了

[ 本帖最后由流清泉于 2008-5-1 13:55 编辑 ]

显示全部楼层 · 发表于 2008-5-1 10:51:08

RS20.42.22未杀！

显示全部楼层 · 发表于 2008-5-1 10:51:27

xx[1].zip\xx[1].exe;C:\Documents and Settings\Administrator\桌面\xx[1].zip;可能 DLOADER.Trojan;;
xx[1].zip;C:\Documents and Settings\Administrator\桌面;发现压缩文件中有被感染的对象;;

显示全部楼层 · 发表于 2008-5-1 10:51:38

木马名称:Trojan-Downloader.Win32.Agent.skx

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.KAFAN\LOCAL SETTINGS\TEMP\DATE.TMP
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.KAFAN\桌面\XX[1].EXE
是可疑程序!
试图修改关键系统文件!
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.KAFAN\桌面\XX[1].EXE
病毒程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.KAFAN\LOCAL SETTINGS\TEMP\DATD.TMP
是否删除病毒程序及其衍生物?

显示全部楼层 · 发表于 2008-5-1 10:55:40

KIS2009 PASS

显示全部楼层 · 发表于 2008-5-1 10:59:37

TrojanDownloader.Agent.nsq.dzbv 木马费尔

显示全部楼层 · 发表于 2008-5-1 11:12:53

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\xx[1].zip'
C:\Documents and Settings\Administrator\My Documents\
  xx[1].zip
[0] Archive type: ZIP
   --> xx[1].exe
      [1] Archive type: Runtime Packed
      --> Object
      [2] Archive type: RSRC
      --> Object
         [3] Archive type: Runtime Packed
         --> Object
            [4] Archive type: RSRC
            --> Object
               [DETECTION] Is the Trojan horse TR/Dldr.Agent.nsq
               [WARNING] Infected files in archives cannot be repaired!
   [NOTE]    The file was deleted!

显示全部楼层 · 发表于 2008-5-1 11:19:56

TO KL

运行后自动死亡
2008-5-1 JAY11:16:21 xx[1].exe Process exit C:\Documents and Settings\Owner\桌面\xx[1].exe
2008-5-1 JAY11:16:21 xx[1].exe Denied: KLPrivateData/KLPrivateUserFiles/ Create C:\Documents and Settings\Owner\桌面\xx[1].exe
2008-5-1 JAY11:16:21 xx[1].exe : KLPrivateData/KLPrivateUserFiles/ Read C:\WINDOWS\system32\avgrsstx.dll.2.Config
2008-5-1 JAY11:16:21 xx[1].exe : KLPrivateData/KLPrivateUserFiles/ Read C:\WINDOWS\system32\avgrsstx.dll.2.Manifest
2008-5-1 JAY11:16:21 xx[1].exe : KLPrivateData/KLPrivateUserFiles/ Read C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll.2.Config
2008-5-1 JAY11:16:21 xx[1].exe : KLPrivateData/KLPrivateUserFiles/ Read C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll.2.Manifest
2008-5-1 JAY11:16:21 xx[1].exe : KLPrivateData/KLPrivateUserFiles/ Read C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll.2.Config
2008-5-1 JAY11:16:21 xx[1].exe : KLPrivateData/KLPrivateUserFiles/ Read C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll.2.Manifest
2008-5-1 JAY11:16:21 xx[1].exe Process start C:\Documents and Settings\Owner\桌面\xx[1].exe

显示全部楼层 · 发表于 2008-5-1 11:25:26

BD过

显示全部楼层 · 发表于 2008-5-1 11:28:57

EAV
D:\病毒样本\xx[1].zip > ZIP > xx[1].exe - 可能是 Win32/Genetik 特洛伊木马的变种

[病毒样本] 过大多数+1。。。。

本帖子中包含更多资源

6/0

本帖子中包含更多资源