[病毒样本] 1

显示全部楼层 · 发表于 2008-5-9 00:27:05

已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Small.iyh 檔案: C:\Documents and Settings\kato9096\桌面\複製 -样本.rar/config.exe

显示全部楼层 · 发表于 2008-5-9 00:34:26

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\1.RAR'
C:\Documents and Settings\Administrator\桌面\1.RAR
  [0] Archive type: RAR
  --> config.exe2
   [DETECTION] Contains suspicious code HEUR/Malware
   [NOTE]    The file was deleted!

显示全部楼层 · 发表于 2008-5-9 22:16:14

RS20.43.42未杀！

显示全部楼层 · 发表于 2008-5-10 00:10:24

信息 2008-05-10  00:10:15 您此次查毒清除了1个病毒
信息 2008-05-10  00:10:15 您此次查毒共查出1个病毒以及危险代码
信息 2008-05-10  00:10:15 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件2个
信息 2008-05-10  00:10:15 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
病毒 2008-05-10  00:10:15 D:\Desktop\1.RAR\config.exe2 Win32.Troj.AgentT.de.49152 清除成功

显示全部楼层 · 发表于 2008-5-10 00:38:15

Kaspersky
Internet Security 2009
Access denied
The requested URL could not be retrieved

While trying to retrieve the URL:

http://bbs.kafan.cn/attachment.php?aid=
260053&k=7df5d1014442b0e51b721ba30389047
5&t=1210351064

The following error was encountered:

The requested object is INFECTED with the following viruses: Trojan-Downloader.Win32.Small.iyh

Please contact your service provider if you consider it incorrect.
Generated:
Sat May 10 00:38:19 2008
Kaspersky Internet Security 2009

显示全部楼层 · 发表于 2008-5-10 07:00:07

The file 'config.exe2' has been determined to be 'MALWARE'. Our analysts named the threat TR/Dldr.Small.iyh.4. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.00.04.19. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Malware.

显示全部楼层 · 发表于 2008-5-10 08:39:05

C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.KAFAN\桌面\CONFIG.EXE
协议类型:UDP
本地地址:0.0.0.0
本地端口:1368
远端地址:61.152.82.18(上海)
远端端口:53
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.KAFAN\桌面\CONFIG.EXE
病毒程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\2EXTRAKG97WU.EXE
2) C:\WINDOWS\SYSTEM32\JBWNO3X4I0O.EXE
3) C:\WINDOWS\SYSTEM32\VPPT07LQK2.COM
4) C:\DOCUMENTS AND SETTINGS\ALL USERS\「开始」菜单\程序\启动\DRMXP1XMGBLB.EXE
是否删除病毒程序及其衍生物?

显示全部楼层 · 发表于 2008-5-10 21:04:09

McAfee MISS

显示全部楼层 · 发表于 2008-5-10 21:07:32

FP 蜘蛛都死了！~

显示全部楼层 · 发表于 2008-5-11 00:23:48

Starting the file scan:

Begin scan in 'C:\Documents and Settings\kato9096\桌面\1.RAR'
C:\Documents and Settings\kato9096\桌面\1.RAR
  [0] Archive type: RAR
  --> config.exe2
   [DETECTION] Is the Trojan horse TR/Dldr.Small.iyh.4
   [NOTE]    The file was renamed to '1.RAR.VIR'!

[病毒样本] 1

本帖子中包含更多资源

2/0

回复 1楼 kato9096 的帖子