两个sys 一个dll

显示全部楼层 · 发表于 2008-7-30 12:04:39

Scan Log
Version of virus signature database: 3308 (20080729)
Date: 2008-7-30 Time: 12:04:32
Scanned disks, folders and files: G:\v\v.rar
G:\v\v.rar » RAR » cdt1v65b8.sys - probably a variant of Win32/Rootkit.Agent.NBQ trojan - was a part of the deleted object
G:\v\v.rar » RAR » riemst94j.dll - a variant of Win32/BHO.NDW trojan - was a part of the deleted object
G:\v\v.rar » RAR » ywlyrb.sys - a variant of Win32/Rootkit.Agent.NGD trojan - was a part of the deleted object
Number of scanned objects: 3
Number of threats found: 3
Number of cleaned objects: 3
Time of completion: 12:04:32 Total scanning time: 0 sec (00:00:00)

显示全部楼层 · 发表于 2008-7-30 12:05:23

Begin scan in 'C:\Documents and Settings\Administrator\桌面\v.rar'
C:\Documents and Settings\Administrator\桌面\v.rar
[0] Archive type: RAR
--> cdt1v65b8.sys
   [DETECTION] Is the TR/Rootkit.Gen Trojan
--> riemst94j.dll
   [DETECTION] Is the TR/Spy.Gen Trojan
--> ywlyrb.sys
   [DETECTION] Is the TR/Rootkit.Gen Trojan
[NOTE]    A backup was created as '4901e899.qua'  ( QUARANTINE )
[NOTE]    Attempting to perform action using the ARK lib.
[NOTE]    A backup was created as '4b8eb022.qua'  ( QUARANTINE )

显示全部楼层 · 发表于 2008-7-30 12:05:54

C:\Documents and Settings\Administrator\桌面\v.rar > RAR > cdt1v65b8.sys - 可能是 Win32/Rootkit.Agent.NBQ 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\v.rar > RAR > riemst94j.dll - Win32/BHO.NDW 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\v.rar > RAR > ywlyrb.sys - Win32/Rootkit.Agent.NGD 特洛伊木马的变种

显示全部楼层 · 发表于 2008-7-30 12:06:10

对象: cdt1v65b8.sys
在压缩档案里: E:\virus\vir\v.rar
Status: 已发现病毒
病毒: Backdoor.Farfli.AB (BD 引擎)

显示全部楼层 · 发表于 2008-7-30 12:08:10

卡巴的新引擎还不错。。
启发1 SYS

显示全部楼层 · 发表于 2008-7-30 12:10:29

kv 不认识

显示全部楼层 · 发表于 2008-7-30 12:24:06

金山全飘

显示全部楼层 · 发表于 2008-7-30 12:25:33

rs 0

显示全部楼层 · 发表于 2008-7-30 20:28:51

McAfee miss

[病毒样本] 两个sys 一个dll