[病毒样本] 4

显示全部楼层 · 发表于 2008-9-7 17:04:07

文件夹图标

显示全部楼层 · 发表于 2008-9-7 17:28:14

已刪除: 特洛伊木馬程式 Trojan-GameThief.Win32.Magania.abwc 檔案: C:\Documents and Settings\kato9096\桌面\-3.rar/FolderIcon (1).exe
已刪除: 病毒 Email-Worm.Win32.Brontok.a 檔案: C:\Documents and Settings\kato9096\桌面\-3.rar/FolderIcon (2).exe//MewBundle//MEW
已刪除: 病毒 Worm.Win32.VB.vi 檔案: C:\Documents and Settings\kato9096\桌面\-3.rar/FolderIcon (3).exe//PE_Patch.PECompact//PecBundle//PECompact
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.VB.hir 檔案: C:\Documents and Settings\kato9096\桌面\-3.rar/FolderIcon (4).exe

报4个,沒有不报

显示全部楼层 · 发表于 2008-9-7 17:33:45

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.Win32.Undef.gtr
病毒： Worm.Mail.Brontok.ps
病毒： Trojan.Win32.Undef.pwy

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.60.61

显示全部楼层 · 发表于 2008-9-7 17:35:24

Begin scan in 'C:\Users\TOSHIBA\Downloads\3'
C:\Users\TOSHIBA\Downloads\3\FolderIcon (1).exe
[DETECTION] Is the TR/Rootkit.Gen Trojan
[NOTE]    A backup was created as '492fa0a0.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Downloads\3\FolderIcon (2).exe
[DETECTION] Contains recognition pattern of the WORM/Brontok.a worm
[NOTE]    A backup was created as '4b8ab2f9.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Downloads\3\FolderIcon (4).exe
[DETECTION] Is the TR/Dropper.Gen Trojan
[NOTE]    A backup was created as '4b5765a9.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

End of the scan: 2008年9月7日  17:34
Used time: 00:02 Minute(s)

The scan has been done completely.

   1 Scanning directories
   4 Files were scanned
   3 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   3 files were deleted
   0 files were repaired
   3 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   0 Archives were scanned
   0 Warnings
   3 Notes

显示全部楼层 · 发表于 2008-9-7 20:37:36

McAfee 报了2个。。

foldericon (1).exe generic backdoor.t
foldericon (2).exe w32/rontokbro.gen@mm
foldericon (3).exe no
foldericon (4).exe no

显示全部楼层 · 发表于 2008-9-7 20:56:25

在 C:\Documents and Settings\Administrator\桌面\3.rar->FolderIcon (2).exe 中发现 I-Worm/Brontok.b 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\3.rar->FolderIcon (4).exe 中发现 Trojan/Pakes.bdg 病毒, 已删除
正常结束。

显示全部楼层 · 发表于 2008-9-7 21:17:47

病毒 2008-09-07  21:17:32 C:\Documents and Settings\Administrator\桌面\3.rar\FolderIcon (4).exe Win32.TrojDownloader.VB.184320 清除成功
病毒 2008-09-07  21:17:31 C:\Documents and Settings\Administrator\桌面\3.rar\FolderIcon (3).exe Worm.VB.vi.253952 清除成功
病毒 2008-09-07  21:17:31 C:\Documents and Settings\Administrator\桌面\3.rar\FolderIcon (1).exe Win32.Hack.ReSSDT.c.113791 清除成功

显示全部楼层 · 发表于 2008-9-7 23:17:49

avast！ miss 1

显示全部楼层 · 发表于 2008-9-8 16:19:53

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\3\FOLDERICON (3).EXE
木马程序生成以下文件:
1) C:\WINDOWS\USERINIT.EXE
2) C:\WINDOWS\SYSTEM32\SYSTEM.EXE
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2008-9-8 16:25:08

2008-9-8 16:24:33 http://bbs.kafan.cn/attachment.p ... 0862043//FolderIcon (1).exe ThunderS Module 拒绝: Trojan-GameThief.Win32.Magania.abwc
2008-9-8 16:24:33 http://bbs.kafan.cn/attachment.p ... 0862043//FolderIcon (1).exe ThunderS Module 已检测到: Trojan-GameThief.Win32.Magania.abwc
2008-9-8 16:24:27 http://bbs.kafan.cn/attachment.p ... 0862043//FolderIcon (1).exe ThunderS Module 拒绝: Trojan-GameThief.Win32.Magania.abwc
2008-9-8 16:24:27 http://bbs.kafan.cn/attachment.p ... 0862043//FolderIcon (1).exe ThunderS Module 已检测到: Trojan-GameThief.Win32.Magania.abwc
2008-9-8 16:24:25 http://bbs.kafan.cn/attachment.p ... 0862043//FolderIcon (1).exe ThunderS Module 拒绝: Trojan-GameThief.Win32.Magania.abwc
2008-9-8 16:24:25 http://bbs.kafan.cn/attachment.p ... 0862043//FolderIcon (1).exe ThunderS Module 已检测到: Trojan-GameThief.Win32.Magania.abwc
2008-9-8 16:24:25 http://bbs.kafan.cn/attachment.p ... 0862043//FolderIcon (1).exe ThunderS Module 拒绝: Trojan-GameThief.Win32.Magania.abwc
2008-9-8 16:24:25 http://bbs.kafan.cn/attachment.p ... 0862043//FolderIcon (1).exe ThunderS Module 已检测到: Trojan-GameThief.Win32.Magania.abwc
2008-9-8 16:24:25 http://bbs.kafan.cn/attachment.p ... 0862043//FolderIcon (1).exe ThunderS Module 拒绝: Trojan-GameThief.Win32.Magania.abwc
2008-9-8 16:24:25 http://bbs.kafan.cn/attachment.p ... 0862043//FolderIcon (1).exe ThunderS Module 已检测到: Trojan-GameThief.Win32.Magania.abwc
2008-9-8 16:24:25 http://bbs.kafan.cn/attachment.p ... 0862043//FolderIcon (1).exe ThunderS Module 拒绝: Trojan-GameThief.Win32.Magania.abwc
2008-9-8 16:24:25 http://bbs.kafan.cn/attachment.p ... 0862043//FolderIcon (1).exe ThunderS Module 已检测到: Trojan-GameThief.Win32.Magania.abwc
2008-9-8 16:24:25 http://bbs.kafan.cn/attachment.p ... 0862043//FolderIcon (1).exe ThunderS Module 拒绝: Trojan-GameThief.Win32.Magania.abwc
2008-9-8 16:24:25 http://bbs.kafan.cn/attachment.p ... 0862043//FolderIcon (1).exe ThunderS Module 已检测到: Trojan-GameThief.Win32.Magania.abwc
2008-9-8 16:24:25 http://bbs.kafan.cn/attachment.p ... 0862043//FolderIcon (1).exe ThunderS Module 拒绝: Trojan-GameThief.Win32.Magania.abwc
2008-9-8 16:24:25 http://bbs.kafan.cn/attachment.p ... 0862043//FolderIcon (1).exe ThunderS Module 已检测到: Trojan-GameThief.Win32.Magania.abwc
2008-9-8 16:24:24 http://bbs.kafan.cn/attachment.p ... 0862043//FolderIcon (1).exe ThunderS Module 拒绝: Trojan-GameThief.Win32.Magania.abwc
2008-9-8 16:24:24 http://bbs.kafan.cn/attachment.p ... 0862043//FolderIcon (1).exe ThunderS Module 已检测到: Trojan-GameThief.Win32.Magania.abwc
2008-9-8 16:24:23 http://bbs.kafan.cn/attachment.p ... 0862043//FolderIcon (1).exe Internet Explorer 拒绝: Trojan-GameThief.Win32.Magania.abwc
2008-9-8 16:24:23 http://bbs.kafan.cn/attachment.p ... 0862043//FolderIcon (1).exe Internet Explorer 已检测到: Trojan-GameThief.Win32.Magania.abwc

[病毒样本] 4

7/3