一个表,共5个

显示全部楼层 · 发表于 2008-8-31 17:12:48

http://qq-new.cn/wm001.exe
http://qq-new.cn/wm002.exe
http://qq-new.cn/wm003.exe
http://qq-new.cn/wm004.exe
http://qq-new.cn/wm005.exe

fd1c1fc717004317f6e40b7d87be87c1  wm005.exe1
f60a6dd92e82edc73386f20d7834bf15  wm001.exe4
02bfced93eea1f3ab8f63764114c2f79  wm002.exe3
f963543f65ecd047ab7e427bfb0db79e  wm003.exe1
ac5e225ac274487d4169c244d380f2dc  wm004.exe1

已上报卡巴和PCSL

Hello,

wm001.exe_, wm002.exe_ - Trojan.Win32.KillAV.alr,
wm003.exe_, wm004.exe_, wm005.exe_ - Trojan-Spy.Win32.Pophot.cek

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Andrey Bezborodov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

[ 本帖最后由 kato9096 于 2008-9-1 19:34 编辑 ]

显示全部楼层 · 发表于 2008-8-31 17:15:52

病毒 2008-08-31  17:15:34 C:\Documents and Settings\Administrator\桌面\5 Tr.rar\wm004.exe1 Win32.Troj.PopHot.c.176128 清除成功
病毒 2008-08-31  17:15:34 C:\Documents and Settings\Administrator\桌面\5 Tr.rar\wm003.exe1 Win32.Troj.PopHot.c.176128 清除成功
病毒 2008-08-31  17:15:33 C:\Documents and Settings\Administrator\桌面\5 Tr.rar\wm005.exe1 Win32.Troj.PopHot.c.176128 清除成功

显示全部楼层 · 发表于 2008-8-31 17:32:08

--> wm005.exe1
   [DETECTION] Is the TR/Dropper.Gen Trojan
--> wm001.exe4
   [DETECTION] Is the TR/Dropper.Gen Trojan
--> wm002.exe3
   [DETECTION] Is the TR/Dropper.Gen Trojan
--> wm003.exe1
   [DETECTION] Is the TR/Dropper.Gen Trojan
--> wm004.exe1
   [DETECTION] Is the TR/Dropper.Gen Trojan

显示全部楼层 · 发表于 2008-8-31 17:36:47

哦也，红伞全部查出

显示全部楼层 · 发表于 2008-8-31 18:44:11

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Clicker.Win32.PopHot.edw

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.59.62

显示全部楼层 · 发表于 2008-8-31 19:40:28

高启发
2008/8/31 19:40:00       已隔离       木马程序 Heur.AntiAV       G:\Temp\Virus\5_Tr.rar/wm005.exe1
2008/8/31 19:40:01       已隔离       木马程序 Heur.AntiAV       G:\Temp\Virus\5_Tr.rar/wm004.exe1
2008/8/31 19:40:01       已隔离       木马程序 Heur.AntiAV       G:\Temp\Virus\5_Tr.rar/wm003.exe1
2008/8/31 19:40:00       已隔离       木马程序 Heur.AntiAV       G:\Temp\Virus\5_Tr.rar/wm002.exe3
2008/8/31 19:40:00       已隔离       木马程序 Heur.AntiAV       G:\Temp\Virus\5_Tr.rar/wm001.exe4

显示全部楼层 · 发表于 2008-8-31 19:40:59

不是入库，是启发

显示全部楼层 · 发表于 2008-8-31 19:42:22

D:\download\5 Tr.rar>>wm001.exe4 Heuri.Suspicious.ERNM 启发式扫描还未处理
D:\download\5 Tr.rar>>wm002.exe3 Heuri.Suspicious.ERNM 启发式扫描还未处理
D:\download\5 Tr.rar>>wm003.exe1 Trojan.Cap882818.yamq 木马还未处理
D:\download\5 Tr.rar>>wm004.exe1 Trojan.Cap882818.yamq 木马还未处理
D:\download\5 Tr.rar>>wm005.exe1 Trojan.Cap882818.yamq 木马还未处理

显示全部楼层 · 发表于 2008-9-1 19:34:09

Hello,

wm001.exe_, wm002.exe_ - Trojan.Win32.KillAV.alr,
wm003.exe_, wm004.exe_, wm005.exe_ - Trojan-Spy.Win32.Pophot.cek

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Andrey Bezborodov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

[病毒样本] 一个表,共5个

16/2

浏览过的版块