[病毒样本] v2

显示全部楼层 · 发表于 2008-10-14 23:57:07

2004-10-14 JAY23:56:47 Untreated Virus Worm.Win32.AutoRun.qpc High Exact C:\Documents and Settings\Owner\桌面\1a.rar/usf.exe/UPack Postponed
2004-10-14 JAY23:56:47 Untreated Trojan program Heur.Trojan.Generic High Probably C:\Documents and Settings\Owner\桌面\1a.rar/kingdee.exe Postponed
2004-10-14 JAY23:56:47 Untreated Trojan program Heur.Downloader High Heuristic analysis C:\Documents and Settings\Owner\桌面\1a.rar/27.exe/FSG Postponed
2004-10-14 JAY23:56:46 Untreated Trojan program Trojan.Win32.VB.fmn High Exact C:\Documents and Settings\Owner\桌面\1a.rar/26.exe/FSG Postponed
2004-10-14 JAY23:56:44 Untreated Virus Worm.Win32.AutoRun.qpm High Exact C:\Documents and Settings\Owner\桌面\1a.rar/sasi.exe/PE_Patch/UPack Postponed
2004-10-14 JAY23:56:44 Untreated Virus Worm.Win32.AutoRun.qpm High Exact C:\Documents and Settings\Owner\桌面\2a.rar/oks.exe/PE_Patch/UPack Postponed
2004-10-14 JAY23:56:44 Untreated Virus Worm.Win32.AutoRun.qpm High Exact C:\Documents and Settings\Owner\桌面\2a.rar/safe.exe Postponed

显示全部楼层 · 发表于 2008-10-15 00:07:48

Begin scan in 'C:\Users\TOSHIBA\Downloads\1a'
C:\Users\TOSHIBA\Downloads\1a\26.exe
   [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE]    A backup was created as '4922c3d4.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Downloads\1a\27.exe
[DETECTION] Contains HEUR/Malware suspicious code
[NOTE]    The detection was classified as suspicious.
[NOTE]    A backup was created as '4922c3d6.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Downloads\1a\kingdee.exe
[DETECTION] Is the TR/Spy.Gen Trojan
[NOTE]    A backup was created as '4962c408.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Downloads\1a\sasi.exe
[DETECTION] Is the TR/Dropper.Gen Trojan
[NOTE]    A backup was created as '4967c400.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Downloads\1a\usf.exe
   [DETECTION] Is the TR/Drop.Cattivo.A Trojan
[NOTE]    A backup was created as '495ac412.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Downloads\1a\w2.exe
[DETECTION] Is the TR/Dropper.Gen Trojan
[NOTE]    A backup was created as '4922c3d1.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
Begin scan in 'C:\Users\TOSHIBA\Downloads\2a'
C:\Users\TOSHIBA\Downloads\2a\oks.exe
[DETECTION] Is the TR/Dropper.Gen Trojan
[NOTE]    A backup was created as '4967c40a.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Downloads\2a\safe.exe
[0] Archive type: RSRC
--> Object
   [DETECTION] Is the TR/Spy.Gen Trojan
[NOTE]    A backup was created as '495ac400.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

End of the scan: 2008年10月15日  00:06
Used time: 00:06 Minute(s)

The scan has been done completely.

   2 Scanning directories
   8 Files were scanned
   7 viruses and/or unwanted programs were found
   1 Files were classified as suspicious:
   8 files were deleted
   0 files were repaired
   8 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   0 Files not concerned
   0 Archives were scanned
   0 Warnings
   8 Notes

显示全部楼层 · 发表于 2008-10-15 00:09:35

avg如下！

显示全部楼层 · 发表于 2008-10-15 00:17:16

D:\病毒测试\临时解压\26.exe - 特征码 'Trojan.Crypt.XPACK' 被发现
D:\病毒测试\临时解压\27.exe - 特征码 'Trojan-Downloader.Win32.Banload.khp' 被发现
D:\病毒测试\临时解压\kingdee.exe - 特征码 'Virus.Win32.Agent.UWD' 被发现
D:\病毒测试\临时解压\oks.exe - 特征码 'Trojan-Spy.Win32.Hitpop.C' 被发现
D:\病毒测试\临时解压\safe.exe - 特征码 'Virus.Win32.Pophot.J' 被发现
D:\病毒测试\临时解压\sasi.exe - 特征码 'Trojan-Spy.Win32.Hitpop.C' 被发现
D:\病毒测试\临时解压\usf.exe - 特征码 'Trojan-Spy.Win32.Banker.anv' 被发现
D:\病毒测试\临时解压\w2.exe - 特征码 'Trojan-Spy.Win32.Hitpop.C' 被发现

8 文件被扫描
(0 压缩档 0 文件)
8 特征码被侦测
0 可疑代码段被发现
耗时: 0:00.130

显示全部楼层 · 发表于 2008-10-15 18:50:03

病毒 2008-10-15  18:49:58 C:\Documents and Settings\Administrator\桌面\1a\w2.exe Win32.Troj.PopHotT.nx.299008 清除成功
病毒 2008-10-15  18:49:57 C:\Documents and Settings\Administrator\桌面\1a\sasi.exe Win32.Troj.StringT.rv.204800 清除成功
病毒 2008-10-15  18:49:55 C:\Documents and Settings\Administrator\桌面\1a\safe.exe Win32.Troj.StringT.rv.204800 清除成功
病毒 2008-10-15  18:49:53 C:\Documents and Settings\Administrator\桌面\1a\oks.exe Win32.Troj.StringT.rv.204800 清除成功
病毒 2008-10-15  18:49:51 C:\Documents and Settings\Administrator\桌面\1a\26.exe Win32.Troj.VB.401408 清除成功

显示全部楼层 · 发表于 2008-10-15 21:07:43

McAfee miss

显示全部楼层 · 发表于 2008-10-15 21:11:27

原帖由 BING126 于 2008-10-15 21:07 发表
McAfee miss

8个全灭了

显示全部楼层 · 发表于 2008-10-15 21:53:35

Access to the data has been denied!
Warning: A virus or unwanted program has been found in the HTTP Data.

Requested URL:  http://bbs.kafan.cn/attachment.p ... 03&t=1224078733
Information:  Is the TR/Dropper.Gen Trojan

--------------------------------------------------------------------------------
Generated by AntiVir WebGuard 8.0.15.0, AVE 8.2.0.4, VDF 7.0.7.44

Access to the data has been denied!
Warning: A virus or unwanted program has been found in the HTTP Data.

Requested URL:  http://bbs.kafan.cn/attachment.p ... 0e&t=1224078733
Information:  Is the TR/Spy.Gen Trojan

--------------------------------------------------------------------------------
Generated by AntiVir WebGuard 8.0.15.0, AVE 8.2.0.4, VDF 7.0.7.44

[病毒样本] v2

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块