样本来了

显示全部楼层 · 发表于 2008-6-17 22:07:18

扫扫看是什么东西？结果说一下

显示全部楼层 · 发表于 2008-6-17 22:08:10

还生成驱动的呢..
还好沙盘拦截驱动..
生成物：

[ 本帖最后由 aarwwefdds 于 2008-6-17 22:13 编辑 ]

显示全部楼层 · 发表于 2008-6-17 22:13:15

Win32:Baidubar-B [Trj]

显示全部楼层 · 发表于 2008-6-17 22:14:08

Win32:Hmir-F [Trj]

显示全部楼层 · 发表于 2008-6-17 22:14:18

好像不只是百度工具条吧
这个东西阴险得很

显示全部楼层 · 发表于 2008-6-17 22:16:00

生成物扫描：

Begin scan in 'C:\Documents and Settings\***.18F12FE200FB45E\桌面\桌面.rar'
C:\Documents and Settings\***.18F12FE200FB45E\桌面\桌面.rar
  [0] Archive type: RAR
  --> WINDOWS\system32\drivers\dl7kvn.sys
   [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> WINDOWS\system32\wlq3gq.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> WINDOWS\tempaq
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> WINDOWS\Thunder5.dll
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Thunder.A
  --> windoxp32.dll
   [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
   [WARNING] The file was ignored!

End of the scan: 2008年6月17日  22:15
Used time: 00:09 min

The scan has been done completely.

   0 Scanning directories
   7 Files were scanned
   5 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   1 Archives were scanned
   1 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-6-17 22:30:45

RS20.49.12未杀！

显示全部楼层 · 发表于 2008-6-17 23:26:44

Warning: A virus or unwanted program has been found in the HTTP Data.

Requested URL: http://bbs.kafan.cn/attachment.p ... 1d&t=1213716201
Information: Is the Trojan horse TR/Agent.311808.A
Generated by AntiVir WebGuard 8.0.13.0, AVE 8.1.0.55, VDF 7.0.4.210

显示全部楼层 · 发表于 2008-6-18 09:38:08

扫描开始于 2008-6-18 9:37:36。引擎版本: 31.6.0。特征码版本: 5881。特征码日期: 2008-6-17。ArcLib 版本: 7.3.0.9。
C:\Documents and Settings\lan\My Documents\3218.rar <3218.exe> - Win32/Dlqqhelp!generic 特洛伊木马。已隔离。
C:\Documents and Settings\lan\My Documents\3218.rar - 无法打开该文件。

已扫描的文件数: 2
受感染的文件数: 1

显示全部楼层 · 发表于 2008-6-18 10:45:29

2008-6-18 10:43:51 http://bbs.kafan.cn/attachment.p ... //PE_Patch.UPX//UPX Opera Internet Browser 已被检测到: Trojan-Downloader.Win32.Ieser.cn

[病毒样本] 样本来了

本帖子中包含更多资源

本帖子中包含更多资源

回复 3楼 aaad2008 的帖子

9/0

ca