系统里面突然多了个驱动

显示全部楼层 · 发表于 2008-10-2 22:47:57

大家来看看

显示全部楼层 · 发表于 2008-10-2 22:48:40

TO KL

显示全部楼层 · 发表于 2008-10-2 22:49:40

http://bbs.ikaka.com/showtopic-8297359.aspx
应该是病毒吧

显示全部楼层 · 发表于 2008-10-2 22:57:30

File:	oreans32.sys
Status:	OK
MD5:	21dc5b289dce2d32a32baab7bcf29a6a
Packers detected:	-

Scanner results
Scan taken on 02 Oct 2008 14:54:48 (GMT)
A-Squared	Found nothing
AntiVir	Found nothing
ArcaVir	Found nothing
Avast	Found nothing
AVG Antivirus	Found nothing
BitDefender	Found nothing
ClamAV	Found nothing
CPsecure	Found nothing
Dr.Web	Found nothing
F-Prot Antivirus	Found nothing
F-Secure Anti-Virus	Found nothing
G DATA	Found nothing
Ikarus	Found nothing
Kaspersky Anti-Virus	Found nothing
NOD32	Found nothing
Norman Virus Control	Found nothing
Panda Antivirus	Found nothing
Sophos Antivirus	Found nothing
VirusBuster	Found nothing
VBA32	Found nothing

显示全部楼层 · 发表于 2008-10-2 23:03:42

回報紅傘

显示全部楼层 · 发表于 2008-10-2 23:07:50

fei er 0

显示全部楼层 · 发表于 2008-10-3 00:45:19

Number of Imported Modules = 3 (decimal)
Import Module 001: NTOSKRNL.EXE
Import Module 002: ntoskrnl.exe
Import Module 003: HAL.dll

Import Module 001: NTOSKRNL.EXE
Addr:00008186 hint(003F) Name: IoDeleteDevice
Addr:00008198 hint(003D) Name: IoCreateSymbolicLink
Addr:000081B0 hint(0040) Name: IoDeleteSymbolicLink
Addr:00008174 hint(003A) Name: IoCreateDevice
Addr:000081C8 hint(0070) Name: IofCompleteRequest
Addr:000081DE hint(00ED) Name: RtlZeroMemory
Addr:0000815C hint(00DE) Name: RtlInitUnicodeString
Addr:00008150 hint(0001) Name: DbgPrint
Import Module 002: ntoskrnl.exe
Addr:00008218 hint(01F5) Name: KeServiceDescriptorTable
Addr:000081FC hint(0232) Name: MmAllocateNonCachedMemory
Addr:00008234 hint(0245) Name: MmIsAddressValid
Import Module 003: HAL.dll
Addr:00008264 hint(0041) Name: KeLowerIrql
Addr:00008256 hint(0043) Name: KeRaiseIrql

貌似孤立文件，关联发作。。。。。。。。。。

显示全部楼层 · 发表于 2008-10-3 20:21:53

不是病毒？

AhnLab-V3 2008.10.3.1 2008.10.03 -
AntiVir 7.8.1.34 2008.10.02 -
Authentium 5.1.0.4 2008.10.02 -
Avast 4.8.1248.0 2008.10.03 -
AVG 8.0.0.161 2008.10.03 -
BitDefender 7.2 2008.10.03 -
CAT-QuickHeal 9.50 2008.10.03 -
ClamAV 0.93.1 2008.10.02 -
DrWeb 4.44.0.09170 2008.10.03 -
eSafe 7.0.17.0 2008.10.02 -
eTrust-Vet 31.6.6127 2008.10.03 -
Ewido 4.0 2008.10.03 -
F-Prot 4.4.4.56 2008.09.30 -
F-Secure 8.0.14332.0 2008.10.03 -
Fortinet 3.113.0.0 2008.10.03 -
GData 19 2008.10.03 -
Ikarus T3.1.1.34.0 2008.10.03 -
K7AntiVirus 7.10.481 2008.10.02 -
Kaspersky 7.0.0.125 2008.10.03 -
McAfee 5397 2008.10.02 -
Microsoft 1.4005 2008.10.03 -
NOD32 3492 2008.10.03 -
Norman 5.80.02 2008.10.02 -
Panda 9.0.0.4 2008.10.03 -
PCTools 4.4.2.0 2008.10.02 -
Prevx1 V2 2008.10.03 -
Rising 20.63.62.00 2008.09.28 -
SecureWeb-Gateway 6.7.6 2008.10.03 -
Sophos 4.34.0 2008.10.03 -
Sunbelt 3.1.1675.1 2008.09.27 -
Symantec 10 2008.10.03 -
TheHacker 6.3.1.0.099 2008.10.03 -
TrendMicro 8.700.0.1004 2008.10.03 -
VBA32 3.12.8.6 2008.10.02 -
ViRobot 2008.10.3.1405 2008.10.03 -
VirusBuster 4.5.11.0 2008.10.02 -

显示全部楼层 · 发表于 2008-10-3 20:33:43

上报BD实验室

显示全部楼层 · 发表于 2008-10-3 20:40:57

不是病毒，是Themida/WinLicense的保护驱动

[可疑文件] 系统里面突然多了个驱动

本帖子中包含更多资源