微点报毒

显示全部楼层 · 发表于 2008-6-9 17:31:41

卡巴杀

已删除：木马程序 Trojan-Downloader.Win32.Agent.sjd 文件　: D:\软件\其它\v\k\ok.rar/ok.exe//PE_Patch.UPX//UPX

显示全部楼层 · 发表于 2008-6-9 17:34:01

4561.swf和4562.swf卡巴都MISS，TO KL，而且请冷冷来分析下面都挂了些什么。

显示全部楼层 · 发表于 2008-6-9 17:38:40

http://bbs.kafan.cn/viewthread.p ... p;page=1#pid3741468
shery 已经解出来啦

显示全部楼层 · 发表于 2008-6-9 17:39:41

360查不出来

显示全部楼层 · 发表于 2008-6-9 18:24:51

Begin scan in 'C:\Documents and Settings\haha\桌面\ok.rar'
C:\Documents and Settings\haha\桌面\ok.rar
  [0] Archive type: RAR
--> ok.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    A backup was created as '487b054e.qua'  ( QUARANTINE )

显示全部楼层 · 发表于 2008-6-9 18:38:34

原帖由 spiha 于 2008-6-9 17:00 发表
D:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
。。。
把IE杀了！＝＝

话说杀父进程的功力已经到了这样了么。。

你确定？

时间处理结果木马名称 木马进程名 木马文件创建者
2008-06-09 16:41:58 处理成功 Trojan-Downloader.Win32.Agent.xlv D:\DOCUMENTS AND SETTINGS\CX\LOCAL SETTINGS\TEMP\ORZ.EXE D:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
2008-06-09 16:41:55 延时删除 Trojan-Downloader.Win32.Agent.xlv E:\INTERNET 临时文件\CONTENT.IE5\4UN3ERS5\OK[1].EXE D:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

木马名称:Trojan-Downloader.Win32.Agent.xlv
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TEMPORARY INTERNET FILES\CONTENT.IE5\WNNRYKHH\OK[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2008-6-9 18:46:26

[:1:]

显示全部楼层 · 发表于 2008-6-9 20:00:18

Hello,

4561.swf - Trojan-Downloader.SWF.Small.bu,
4562.swf - Trojan-Downloader.SWF.Small.bv

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

显示全部楼层 · 发表于 2008-6-9 20:02:01

[Found possible security risk] <W32/Heuristic-KPP!Eldorado (not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\ok.rar->ok.exe->(UPX)

---------------------------------------------------------------------
Scan ended: 2008-6-9, 20:01:43
Duration: 0:00:00

Scan result:

Scanned files:    6
Infected objects:    1
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

显示全部楼层 · 发表于 2008-6-9 21:37:40

ACCESS DENIED
The requested URL could not be retrieved

--------------------------------------------------------------------------------

While trying to retrieve the URL: http://bbs.kafan.cn/attachment.p ... d1&t=1213018608

The folowing error was encountered:

The requested object is INFECTED. The following viruses Trojan-Downloader.Win32.Agent.sjd were found

Please contact your service provider if you feel this is incorrect.

--------------------------------------------------------------------------------

Generated Mon Jun 09 21:37:09 2008 by Kaspersky Anti-Virus 7.0

[已鉴定] 微点报毒

回复 12楼 sbbdms 的帖子

F-Prot 4.4.4