发到KEY区的一个帖子附件被会员举报带毒，多谢帮忙分析一下。

显示全部楼层 · 发表于 2008-6-29 13:21:30

R毒

显示全部楼层 · 发表于 2008-6-29 13:24:54

的确有木马！

显示全部楼层 · 发表于 2008-6-29 13:26:08

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\virus.rar'
C:\Documents and Settings\morgan\My Documents\
  virus.rar
[0] Archive type: RAR
   --> setups.exe
      [1] Archive type: Runtime Packed
      --> Object
      [2] Archive type: RSRC
      --> Object
         [3] Archive type: Runtime Packed
         --> Object
      --> Object
   --> ﾲﾹﾶﾡ.exe
      [1] Archive type: Runtime Packed
      --> Object
      [2] Archive type: RSRC
      --> Object
         [3] Archive type: Runtime Packed
         --> Object
      --> Object
   [NOTE]    The file was deleted!

End of the scan: 2008年6月28日  22:25
Used time: 00:03 min

The scan has been done completely.

   0 Scanning directories
   3 Files were scanned
   2 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   0 Warnings
   1 Notes

显示全部楼层 · 发表于 2008-6-29 13:31:55

显示全部楼层 · 发表于 2008-6-29 13:32:30

TR/Crypt.FKM.Gen X2

显示全部楼层 · 发表于 2008-6-29 13:33:58

右键扫描没发现，
可以解压吗？

显示全部楼层 · 发表于 2008-6-29 13:34:00

D:\病毒测试\临时解压\virus.exe:\setups.exe
D:\病毒测试\临时解压\virus.exe:\补丁.exe - 特征码 'Email-Worm.Win32.Zwur.b' 被发现
D:\病毒测试\临时解压\virus.exe

3 文件被扫描
(1 压缩档 2 文件)
1 特征码被侦测
0 可疑代码段被发现
耗时: 0:00.370

显示全部楼层 · 发表于 2008-6-29 13:39:08

单纯扫描
费尔，nod32
MISS

显示全部楼层 · 发表于 2008-6-29 13:41:10

要不要解压测试呀？直接右键测被过。

显示全部楼层 · 发表于 2008-6-29 14:05:33

多谢几位的分析

[病毒样本] 发到KEY区的一个帖子附件被会员举报带毒，多谢帮忙分析一下。

本帖子中包含更多资源

本帖子中包含更多资源

评分

本帖子中包含更多资源