网马

显示全部楼层 · 发表于 2008-5-18 12:59:31

来源http://www.pcsl.info/index.php?a=readmore&n=16

Log is generated by FreShow.

[wide]http://boadongo.org/
   [script]http://pagead2.googlesyndication.com/pagead/show_ads.js
   [frame]http://www.boadongo.org/vbshokmm/tmain.htm
      [frame]http://boadongo.org/vbshokmm/Ms06014.htm
      [ani]http://boadongo.org/vbshokmm/ani.c
      [frame]http://boadongo.org/vbshokmm/Yahoo.htm
            [object]http://boadongo.org/vbshokmm/xia.exe

显示全部楼层 · 发表于 2008-5-18 13:00:28

显示全部楼层 · 发表于 2008-5-18 13:00:52

Starting the file scan:

Begin scan in 'E:\AV\xia.zip'
E:\AV\xia.zip
  [0] Archive type: ZIP
  --> xia.exe
   [DETECTION] Is the Trojan horse TR/Hook.Shell.138
   [NOTE]    The file was deleted!

显示全部楼层 · 发表于 2008-5-18 13:03:58

Date,Virus Name,Virus Type,User,Filename,Scan Type
2008-5-18 13:03:41,Trojan.Agent.hd.vhec,木马,Administrator,C:\Documents and Settings\Administrator\桌面\xia.zip>>xia.exe,Manual scan

显示全部楼层 · 发表于 2008-5-18 13:23:52

显示全部楼层 · 发表于 2008-5-18 13:26:00

检测到：木马程序 Trojan-Downloader.Win32.Delf.dsz 文件: C:\Documents and Settings\Administrator\桌面\xia.zip/xia.exe

显示全部楼层 · 发表于 2008-5-18 13:28:14

老东西

BD砍已知

显示全部楼层 · 发表于 2008-5-18 20:19:23

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Win32.Agent.hd

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.44.62

显示全部楼层 · 发表于 2008-5-18 20:20:57

[Scanning : C:\Documents and Settings\All Users\Documents\Test]

C:\Documents and Settings\All Users\Documents\Test\xia.zip<ZIP>:xia.exe <- Trojan.Psw.Onlinegames.Mmp : No action

Scanned objects : 2

Infected objects : 1

显示全部楼层 · 发表于 2008-5-18 20:21:19

[Found downloader] <W32/Banload.B.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\xia.zip->xia.exe->(embedded)->(UPack)->(Klone.AF)

---------------------------------------------------------------------
Scan ended: 2008-5-18, 20:21:08
Duration: 0:00:01

Scan result:

Scanned files:    6
Infected objects:    1
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

[已鉴定] 网马

2/1

ArcaVir2008

F-Prot 6.0.9.0