再来几个新发现的，md5命名...

显示全部楼层 · 发表于 2008-5-5 12:47:10

Starting the file scan:

Begin scan in 'E:\AV\13.rar'
E:\AV\13.rar
  [0] Archive type: RAR
  --> 1B804D3A0A39B592BF0ECC4E8CA3F298(1b804d3a0a39b592bf0ecc4e8ca3f298.bin)
   [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> A1EBAD78B1389A70A6AD04D790CDCB38(a1ebad78b1389a70a6ad04d790cdcb38.bin)
   [DETECTION] Contains detection pattern of the worm WORM/Rbot.50176.5
  --> DDC2799F7D6442C6DB318D0F742FED6C(ddc2799f7d6442c6db318d0f742fed6c.bin)
   [DETECTION] Contains detection pattern of the worm WORM/Rbot.50176.5
  --> FBEE42DB1864892EA987AA12CFC17450(fbee42db1864892ea987aa12cfc17450.bin)
   [DETECTION] Contains suspicious code HEUR/Malware
  --> DE5B03DBC9AB603BC4C6E4249A6624AF(de5b03dbc9ab603bc4c6e4249a6624af.bin)
   [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
   [NOTE]    The file was deleted!

显示全部楼层 · 发表于 2008-5-5 12:50:08

25010939  0E31DF8B74000D73...3b.bin)  12 KB  UNDER ANALYSIS
208479  B1AD588C36FFEBC7...e7.bin)  9.77 KB  FALSE POSITIVE
25010940  9DC618EBF51A58EA...93.bin)  13.48 KB  UNDER ANALYSIS
25010941  9E06DB8C9DFA2FE6...a4.bin)  9.43 KB  UNDER ANALYSIS
25010942  570FC9E77A04BA76...2f.bin)  12.46 KB  UNDER ANALYSIS
25010943  D41202F2B16B1E56...c4.bin)  14.5 KB  UNDER ANALYSIS
25010944  DF7620212458163B...ba.bin)  22.5 KB  UNDER ANALYSIS
25010948  FBEE42DB1864892E...50.bin)  24 KB  UNDER ANALYSIS
208479  9B3E7BA74C6E76E3...f1.bin)  9.77 KB  FALSE POSITIVE

[ 本帖最后由 Exia 于 2008-5-5 12:58 编辑 ]

显示全部楼层 · 发表于 2008-5-5 12:50:16

信息       2008-05-05  12:49:43       您此次查毒有2次操作失败
信息       2008-05-05  12:49:43       您此次查毒清除了2个病毒
信息       2008-05-05  12:49:43       您此次查毒共查出4个病毒以及危险代码
病毒       2008-05-05  12:49:43       C:\Documents and Settings\Administrator\桌面\13.rar\DE5B03DBC9AB603BC4C6E4249A6624AF(de5b03dbc9ab603bc4c6e4249a6624af.bin)       Win32.Hack.RCryptor.a.10301       清除成功
病毒       2008-05-05  12:49:43       C:\Documents and Settings\Administrator\桌面\13.rar\DDC2799F7D6442C6DB318D0F742FED6C(ddc2799f7d6442c6db318d0f742fed6c.bin)       Win32.Virut.F.152576       操作失败
病毒       2008-05-05  12:49:43       C:\Documents and Settings\Administrator\桌面\13.rar\A1EBAD78B1389A70A6AD04D790CDCB38(a1ebad78b1389a70a6ad04d790cdcb38.bin)       Win32.Virut.F.121344       操作失败
病毒       2008-05-05  12:49:42       C:\Documents and Settings\Administrator\桌面\13.rar\1B804D3A0A39B592BF0ECC4E8CA3F298(1b804d3a0a39b592bf0ecc4e8ca3f298.bin)       Win32.Troj.AgentT.nb.29632       清除成功
有两个操作失败。但是可以进行隔离。

[ 本帖最后由 yunhan123 于 2008-5-5 12:51 编辑 ]

显示全部楼层 · 发表于 2008-5-5 13:04:04

难得看到操作失败

标记一下

信息 2008-05-05  13:03:37 您此次查毒有2次操作失败
信息 2008-05-05  13:03:37 您此次查毒清除了2个病毒
信息 2008-05-05  13:03:37 您此次查毒共查出4个病毒以及危险代码
信息 2008-05-05  13:03:37 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件16个
信息 2008-05-05  13:03:37 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
病毒 2008-05-05  13:03:37 D:\Desktop\13.rar\DE5B03DBC9AB603BC4C6E4249A6624AF(de5b03dbc9ab603bc4c6e4249a6624af.bin) Win32.Hack.RCryptor.a.10301 清除成功
病毒 2008-05-05  13:03:37 D:\Desktop\13.rar\DDC2799F7D6442C6DB318D0F742FED6C(ddc2799f7d6442c6db318d0f742fed6c.bin) Win32.Virut.F.152576 操作失败
病毒 2008-05-05  13:03:37 D:\Desktop\13.rar\A1EBAD78B1389A70A6AD04D790CDCB38(a1ebad78b1389a70a6ad04d790cdcb38.bin) Win32.Virut.F.121344 操作失败
病毒 2008-05-05  13:03:37 D:\Desktop\13.rar\1B804D3A0A39B592BF0ECC4E8CA3F298(1b804d3a0a39b592bf0ecc4e8ca3f298.bin) Win32.Troj.AgentT.nb.29632 清除成功

显示全部楼层 · 发表于 2008-5-5 13:36:51

*PE Win GUI *flags* ?? ................ 0E31DF~1.BIN .....12288 2008-04-24
*PE Native ............................ 1B804D~1.BIN .....28608 2008-04-17

显示全部楼层 · 发表于 2008-5-5 13:43:36

日期： 5.5.2008 时间：13:41:38
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\Administrator\桌面\13.rar
C:\Documents and Settings\Administrator\桌面\13.rar >>RAR >>1B804D3A0A39B592BF0ECC4E8CA3F298(1b804d3a0a39b592bf0ecc4e8ca3f298.bin) - Win32/Rootkit.Agent.NBQ 木马的变种
C:\Documents and Settings\Administrator\桌面\13.rar >>RAR >>FBEE42DB1864892EA987AA12CFC17450(fbee42db1864892ea987aa12cfc17450.bin) - 未查明的 NewHeur_PE 病毒 [7]
C:\Documents and Settings\Administrator\桌面\13.rar >>RAR >>DE5B03DBC9AB603BC4C6E4249A6624AF(de5b03dbc9ab603bc4c6e4249a6624af.bin) - Win32/Ceckno.DL 木马
已扫描的文件数目：13
已发现的病毒数目：3
完成时间： 13:41:41 总扫描时间：3 秒 (00:00:03)

显示全部楼层 · 发表于 2008-5-5 13:45:06

E:\VIRUS\13(2)\0E31DF8B74000D73B8D78BF8EB37643B(0e31df8b74000d73b8d78bf8eb37643b.bin): PUA.Packed.UPack-2 FOUND
E:\VIRUS\13(2)\A1EBAD78B1389A70A6AD04D790CDCB38(a1ebad78b1389a70a6ad04d790cdcb38.bin): Worm.Allaple-2 FOUND
E:\VIRUS\13(2)\D41202F2B16B1E56A0AAD21EBBBB33C4(d41202f2b16b1e56a0aad21ebbbb33c4.bin): PUA.Packed.UPack-2 FOUND
E:\VIRUS\13(2)\DDC2799F7D6442C6DB318D0F742FED6C(ddc2799f7d6442c6db318d0f742fed6c.bin): Worm.Allaple-2 FOUND
E:\VIRUS\13(2)\DE5B03DBC9AB603BC4C6E4249A6624AF(de5b03dbc9ab603bc4c6e4249a6624af.bin): PUA.Packed.NPack-2 FOUND
----------- SCAN SUMMARY -----------
Known viruses: 275845
Engine version: 0.93
Scanned directories: 1
Scanned files: 13
Infected files: 5

显示全部楼层 · 发表于 2008-5-5 13:54:24

时间处理结果木马名称木马进程名木马文件创建者
2008-05-05 13:53:41 处理成功 Trojan.Win32.Ceckno.ac C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\DE5B03DBC9AB603BC4C6E4249A6624AF(DE5B03DBC9AB603BC4C6E4249A6624AF.BIN) C:\PROGRAM FILES\WINRAR\WINRAR.EXE

显示全部楼层 · 发表于 2008-5-5 14:26:20

AVG报其中两只

[病毒样本] 再来几个新发现的，md5命名...

本帖子中包含更多资源

CLAMWIN