试病毒，不知哪里来的

显示全部楼层 · 发表于 2008-8-27 23:58:34

来两个包，卡巴斯基都扫描不到
to kl

显示全部楼层 · 发表于 2008-8-28 00:00:02

Begin scan in 'C:\Documents and Settings\Administrator\桌面\TEMP'
C:\Documents and Settings\Administrator\桌面\TEMP\Pandrv.sys
[DETECTION] Is the TR/Rootkit.Gen Trojan
[NOTE]    A backup was created as '49237a96.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\TEMP\Pandrv.sys.sys
[DETECTION] Is the TR/Rootkit.Gen Trojan
[NOTE]    A backup was created as '488fd1ff.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

Requested URL:       http://bbs.kafan.cn/attachment.p ... f92013&t=1219852762
Information:       Is the TR/Agent.klt.126976 Trojan

Generated by AntiVir WebGuard 8.0.15.0, AVE 8.1.1.23, VDF 7.0.6.75

[ 本帖最后由 Kitman 于 2008-8-28 00:01 编辑 ]

显示全部楼层 · 发表于 2008-8-28 01:48:55

同样过NIS2008

显示全部楼层 · 发表于 2008-8-28 01:51:59

D:\Documents and Settings\Administrator.WWW-461FC2525A6\桌面\NETWORK.EXE,36,启发识别：Heur/Susp.Trojan-Downloader.Dropper.0001F000，风险36%,1

显示全部楼层 · 发表于 2008-8-28 08:31:47

还是不敢试了

显示全部楼层 · 发表于 2008-8-28 09:12:53

第一个附件有毒
第二个附件应该无毒

显示全部楼层 · 发表于 2008-8-28 09:58:57

红伞第一个包
Access to the data has been denied!
Warning: A virus or unwanted program has been found in the HTTP Data.

Information: Is the TR/Rootkit.Gen Trojan

第二个包
Access to the data has been denied!
Warning: A virus or unwanted program has been found in the HTTP Data.

Information: Is the TR/Agent.klt.126976 Trojan

显示全部楼层 · 发表于 2008-8-28 10:37:50

第一包是两个驱动文件

第二包运行后程序立即退出,啥都没做.

显示全部楼层 · 发表于 2008-8-28 11:05:07

有两个的那包NOD搞定!一个那包没反应!!解压出来后自动隐藏!被我删除了!

显示全部楼层 · 发表于 2008-8-28 12:36:11

D:\download\TEMP.rar>>Pandrv.sys RootKit.Undef.nn.yqlw.dll 木马还未处理

[病毒样本] 试病毒，不知哪里来的

浏览过的版块