6个`~~~

显示全部楼层 · 发表于 2008-6-16 19:56:37

清除病毒种类列表：
病毒： Trojan.DL.Script.VBS.Agent.xlq
病毒： Suspicious.Trojan.Script.JS.Obcode.b
病毒： Worm.Win32.Autorun.dle
病毒： Hack.Exploit.Script.Small.bb
病毒： Hack.Exploit.Script.Small.ba
病毒： Trojan.DL.Win32.Autorun.yyl

显示全部楼层 · 发表于 2008-6-16 20:00:11

MCAFEE8.7I报2个

[ 本帖最后由小邪邪于 2008-6-16 20:27 编辑 ]

显示全部楼层 · 发表于 2008-6-16 20:01:11

C:\Users\Administrator\Desktop\新建文件夹.rar » RAR » 新建文件夹\illyyva.exe - probably a variant of Win32/Delf.NDF worm
C:\Users\Administrator\Desktop\新建文件夹.rar » RAR » 新建文件夹\soS.Exe - probably a variant of Win32/Genetik trojan

显示全部楼层 · 发表于 2008-6-16 20:04:35

已刪除: 特洛伊木馬程式 Trojan-Downloader.JS.ActiveX.v 檔案: C:\Documents and Settings\kato9096\獢\?啣遣?辣憭鈾?啣遣?辣憭鈾銴ˊ -jh[1].htm3
已刪除: 特洛伊木馬程式 Exploit.JS.RealPlr.bk 檔案: C:\Documents and Settings\kato9096\獢\?啣遣?辣憭鈾?啣遣?辣憭鈾銴ˊ -rl[1].js3
已刪除: 病毒 Worm.Win32.AutoRun.bkv 檔案: C:\Documents and Settings\kato9096\獢\?啣遣?辣憭鈾?啣遣?辣憭鈾銴ˊ -soS.Exe3
已刪除: 特洛伊木馬程式 Trojan-Downloader.VBS.Psyme.lu 檔案: C:\Documents and Settings\kato9096\獢\?啣遣?辣憭鈾?啣遣?辣憭鈾銴ˊ -001[1].htm2
已刪除: 病毒 Virus.Win32.AutoRun.ww 檔案: C:\Documents and Settings\kato9096\獢\?啣遣?辣憭鈾?啣遣?辣憭鈾銴ˊ -illyyva.exe2//PE_Patch.MaskPE

上报1

The scan has been done completely.

   0 Scanning directories
   6 Files were scanned
   5 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   5 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   0 Archives were scanned
   0 Warnings
   5 Notes

上报1

显示全部楼层 · 发表于 2008-6-16 20:06:27

[Found downloader]    <VBS/Psyme.FG (exact, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\新建文件夹.rar->新建文件夹\001[1].htm
[Found security risk]    <W32/AutoRun.B.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\新建文件夹.rar->新建文件夹\illyyva.exe->(PE_Patch.MaskPE)
[Found exploit]    <JS/RealPlay.G (exact, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\新建文件夹.rar->新建文件夹\rl[1].js
[Found security risk]    <W32/AutoRun.B.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\新建文件夹.rar->新建文件夹\soS.Exe->(UPX)

---------------------------------------------------------------------
Scan ended: 2008-6-16, 20:06:50
Duration: 0:00:01

Scan result:

Scanned files:       6
Infected objects:    4
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

显示全部楼层 · 发表于 2008-6-16 20:07:15

[Scanning : C:\Documents and Settings\All Users\Documents\Test]

C:\Documents and Settings\All Users\Documents\Test\新建文件夹.rar<RAR>:illyyva.exe <- Trojan.Autorun.Ww : No action
C:\Documents and Settings\All Users\Documents\Test\新建文件夹.rar<RAR>:rl[1].js <- Trojan.Exploit.Js.realplr.bk : No action
C:\Documents and Settings\All Users\Documents\Test\新建文件夹.rar<RAR>:soS.Exe<UPX>:soS.Exe <- Worm.Autorun.Bex : No action

Scanned objects : 8

Infected objects : 3

[ 本帖最后由 allinwonderi 于 2008-6-16 20:08 编辑 ]

显示全部楼层 · 发表于 2008-6-16 20:15:03

卡巴和紅傘都不报的:

http://www.virustotal.com/analis ... 806779a6627ea6cc92c

Antivirus Version Last Update Result
AhnLab-V3 2008.6.13.1 2008.06.16 -
AntiVir 7.8.0.55 2008.06.16 -
Authentium 5.1.0.4 2008.06.16 -
Avast 4.8.1195.0 2008.06.15 -
AVG 7.5.0.516 2008.06.16 -
BitDefender 7.2 2008.06.16 -
CAT-QuickHeal 9.50 2008.06.14 -
ClamAV 0.93.1 2008.06.16 PUA.JS.Packed
DrWeb 4.44.0.09170 2008.06.16 -
eSafe 7.0.15.0 2008.06.15 -
eTrust-Vet 31.6.5878 2008.06.16 -
Ewido 4.0 2008.06.16 -
F-Prot 4.4.4.56 2008.06.12 -
F-Secure 6.70.13260.0 2008.06.16 -
Fortinet 3.14.0.0 2008.06.16 -
GData 2.0.7306.1023 2008.06.16 -
Ikarus T3.1.1.26.0 2008.06.16 -
Kaspersky 7.0.0.125 2008.06.16 -
McAfee 5317 2008.06.13 -
Microsoft 1.3604 2008.06.16 -
NOD32v2 3190 2008.06.16 -
Norman 5.80.02 2008.06.16 -
Panda 9.0.0.4 2008.06.15 -
Prevx1 V2 2008.06.16 -
Rising 20.49.00.00 2008.06.16 -
Sophos 4.30.0 2008.06.16 -
Sunbelt 3.0.1153.1 2008.06.15 -
Symantec 10 2008.06.16 -
TheHacker 6.2.92.351 2008.06.16 -
TrendMicro 8.700.0.1004 2008.06.16 -
VBA32 3.12.6.7 2008.06.16 -
VirusBuster 4.3.26:9 2008.06.12 -
Webwasher-Gateway 6.6.2 2008.06.16 -

显示全部楼层 · 发表于 2008-6-16 20:18:09

D:\download\新建文件夹.rar>>新建文件夹\001[1].htm Script.HttpDownloader.i 病毒还未处理
D:\download\新建文件夹.rar>>新建文件夹\illyyva.exe VirTool.MaskPE.f.fael 黑客工具还未处理
D:\download\新建文件夹.rar>>新建文件夹\jh[1].htm JS.Decoder.ai 病毒还未处理
D:\download\新建文件夹.rar>>新建文件夹\rl[1].js JS.Decoder.ae 病毒还未处理
D:\download\新建文件夹.rar>>新建文件夹\soS.Exe W32.SillyDC.nvdl 病毒还未处理

显示全部楼层 · 发表于 2008-6-16 20:20:57

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.DL.Script.VBS.Agent.xlq
病毒： Suspicious.Trojan.Script.JS.Obcode.b
病毒： Worm.Win32.Autorun.dle
病毒： Hack.Exploit.Script.Small.bb
病毒： Hack.Exploit.Script.Small.ba
病毒： Trojan.DL.Win32.Autorun.yyl

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.49.02

显示全部楼层 · 发表于 2008-6-16 21:22:47

D:\firefox download\新建文件夹.rar » RAR » 新建文件夹\001[1].htm - is OK
D:\firefox download\新建文件夹.rar » RAR » 新建文件夹\clickeye[1].js - is OK
D:\firefox download\新建文件夹.rar » RAR » 新建文件夹\illyyva.exe - probably a variant of Win32/Delf.NDF worm
D:\firefox download\新建文件夹.rar » RAR » 新建文件夹\jh[1].htm - is OK
D:\firefox download\新建文件夹.rar » RAR » 新建文件夹\rl[1].js - is OK
D:\firefox download\新建文件夹.rar » RAR » 新建文件夹\soS.Exe - probably a variant of Win32/Genetik trojan

[病毒样本] 6个`~~~

本帖子中包含更多资源

本帖子中包含更多资源

杀了exe

F-Prot 4.4.4

ArcaVir2008

回复 4楼 kato9096 的帖子

8/6