疑似中华吸血鬼的新生成物

hahacomcn

Virus or unwanted program 'TR/Rootkit.Gen [trojan]' detected in file 'C:\Documents and Settings\haha\Local Settings\Temp\Rar$DR00.047\20080626killbase\hathfeufj8.sys. Action performed: Delete file Virus or unwanted program 'TR/Spy.Gen [trojan]' detected in file 'C:\Documents and Settings\haha\Local Settings\Temp\Rar$DR00.047\20080626killbase\58gvniz7.dll. Action performed: Delete file

再次解压时，出错。。。

dollsgame

喔!搞错啦



附上4个病毒文件报告

解压后红伞很嘈

http://www.virustotal.com/analis ... 7d955f6bc649710d080

http://www.virustotal.com/analis ... 39df59784ded903f4bc

http://www.virustotal.com/analisis/3936fe2be3720e6ca7caa7ffa8ed97f1

http://www.virustotal.com/analis ... 5a848d632aeabab6eb7

[ 本帖最后由 dollsgame 于 2008-6-26 14:51 编辑 ]

qigang

RS20.50.32未杀！

上报了就没有意思了。能杀了就不足为奇了。

hum

the file is probably password protected.

好猛的名字
直接扔带密码的包上去的吧

28654621

2008-6-27 9:00:12        文件系统实时防护        文件        C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$DR00.250\20080626killbase\d1xar8lt.sys        可能是 Win32/Rootkit.Agent.NBQ 特洛伊木马 的变种        通过删除清除 - 已隔离        NT AUTHORITY\SYSTEM        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2008-6-27 9:00:11        文件系统实时防护        文件        C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$DR00.250\20080626killbase\58gvniz7.dll        Win32/BHO.NDW 特洛伊木马 的变种        通过删除清除 - 已隔离        NT AUTHORITY\SYSTEM        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.

Killer_cg

红伞PASS了

kkgh

费尔杀

IllusionWing

UG Linux 版本全杀...但是咋WIN版一个也不认识...

1. 
   
2. UGuard Linux Edition Beta 1
   
3. License: Linux Test
   
4. 
   
5. * Private Virus Database: LNX.rlb
   
6. * Win32 Virus Database: HEUR.rlb, HC0.rlb, FN0.rlb, STML.rlb, STMT.rlb
   
7. * Windows Mobile Virus Database: WMB.rlb
   
8. * White-List: USR0.rlb, USRZ.rlb, USRL.rlb
   
9. * Plugins: ZLib Uncompress Module
   
10. 
    
11. Start scanning on '/Virtual/VMHostShareDevices/Disk0/20080626killbase.rar'
    
12. 
    
13. 20080626killbase.rar/[NTFSSettings] : [SmartSearch] This SFX file may contains suspicious data.
    
14. 20080626killbase.rar/20080626killbase/58gvniz7.dll : [SmartSearch] 'Behav.Downloader' was found.
    
15. 20080626killbase.rar/20080626killbase/arps.com : [nFile] 'Generic.nFile' was found.
    
16. 20080626killbase.rar/20080626killbase/d1xar8lt.sys : [SmartSearch] 'Heur.Rootkit.FileSystemHooker.Gen' was found.
    
17. 20080626killbase.rar/20080626killbase/hathfeufj8.sys : [ARS] This file is similar with 'd1xar8lt.sys', maybe it's a malware.
    

复制代码

[ 本帖最后由 gankeyu 于 2008-6-27 15:44 编辑 ]

Evercy

金山没有 反映 。、。。。

markrhy

红伞不报