一包病毒

显示全部楼层 · 发表于 2008-10-15 09:16:43

里面发现有rootkit

显示全部楼层 · 发表于 2008-10-15 09:19:59

"Infections"
"File";"Infection";"Result"
"C:\Documents and Settings\Yuwei\Desktop\$SYSDIR.zip";"Trojan horse Downloader.Generic3.SZP";"Infected"
"C:\Documents and Settings\Yuwei\Desktop\$SYSDIR.zip:\$SYSDIR\mco2\ADI5MDi2.exe";"Trojan horse Downloader.Generic3.SZP";"Infected"
"C:\Documents and Settings\Yuwei\Desktop\$SYSDIR.zip:\$SYSDIR\pi\NTc326i.exe";"Trojan horse Downloader.Small.61.AA";"Infected"

"Spyware"
"File";"Infection";"Result"
"C:\Documents and Settings\Yuwei\Desktop\$SYSDIR.zip:\$SYSDIR\sys3\ZPU560I\webhdll.dll";"Adware Generic3.OFV";"Potentially dangerous object"
"C:\Documents and Settings\Yuwei\Desktop\$SYSDIR.zip:\$SYSDIR\sys3\ZPU560I\whAgent.exe";"Adware Generic3.EYS";"Potentially dangerous object"
"C:\Documents and Settings\Yuwei\Desktop\$SYSDIR.zip:\$SYSDIR\sys3\ZPU560I\whiehlpr.dll";"Adware Generic3.OEV";"Potentially dangerous object"

显示全部楼层 · 发表于 2008-10-15 09:23:42

卡巴，NOD32各报了6个！

[ 本帖最后由北山精灵于 2008-10-15 15:59 编辑 ]

显示全部楼层 · 发表于 2008-10-15 09:32:43

什么东西

C:\Documents and Settings\Limited User\Desktop\$SYSDIR\mco2\ADI5MDi2.exe [L] Win32:Trojano-2873 [Trj] (0)
File was successfully deleted...
C:\Documents and Settings\Limited User\Desktop\$SYSDIR\pi\NTc326i.exe [L] Win32:Trojan-gen {Other} (0)
File was successfully deleted...
C:\Documents and Settings\Limited User\Desktop\$SYSDIR\sys3\ZPU560I\webhdll.dll [L] Win32:Adware-gen [Adw] (0)
File was successfully deleted...
C:\Documents and Settings\Limited User\Desktop\$SYSDIR\sys3\ZPU560I\whAgent.exe [L] Win32:Neptunia-YO [Trj] (0)
File was successfully deleted...
C:\Documents and Settings\Limited User\Desktop\$SYSDIR\sys3\ZPU560I\whiehlpr.dll [L] Win32:Dialer-567 [Trj] (0)
File was successfully deleted...
Infected files: 5

显示全部楼层 · 发表于 2008-10-15 09:41:47

f:\$SYSDIR\mco2\ADI5MDi2.exe - 特征码 'Trojan-Downloader.Win32.Small.BUY' 被发现
f:\$SYSDIR\pi\NTc326i.exe - 特征码 'Trojan.Win32.Agent.lom' 被发现
f:\$SYSDIR\sys3\ZPU560I\license.txt - 特征码 'not-a-virus:AdWare.Win32.WebHancer.390' 被发现
f:\$SYSDIR\sys3\ZPU560I\readme.txt - 特征码 'not-a-virus:AdWare.Win32.WebHancer.390' 被发现
f:\$SYSDIR\sys3\ZPU560I\Sporder.dll
f:\$SYSDIR\sys3\ZPU560I\webhdll.dll - 特征码 'not-a-virus:AdWare.Win32.WebHancer.390' 被发现
f:\$SYSDIR\sys3\ZPU560I\whAgent.exe - 特征码 'Win32.SuspectCrc' 被发现
f:\$SYSDIR\sys3\ZPU560I\whAgent.ini
f:\$SYSDIR\sys3\ZPU560I\whiehlpr.dll - 特征码 'Virus.Win32.Dialer.567' 被发现
f:\$SYSDIR\sys3\ZPU560I\whInstaller.exe - 特征码 'Win32.SuspectCrc' 被发现

显示全部楼层 · 发表于 2008-10-15 09:50:06

楼主可不可以说明一下有多少个东东啊

显示全部楼层 · 发表于 2008-10-15 10:10:20

NIS2009
已扫描项目总数：11
检测到的安全风险总数：6

显示全部楼层 · 发表于 2008-10-15 10:28:27

D:\My Documents\$SYSDIR.zip > ZIP > $SYSDIR/mco2/ADI5MDi2.exe - Win32/TrojanDownloader.Small.BUY 特洛伊木马
D:\My Documents\$SYSDIR.zip > ZIP > $SYSDIR/pi/NTc326i.exe - Win32/Rootkit.TniDrive.B 特洛伊木马
D:\My Documents\$SYSDIR.zip > ZIP > $SYSDIR/sys3/ZPU560I/webhdll.dll - Win32/Adware.Webhancer.390 应用程序
D:\My Documents\$SYSDIR.zip > ZIP > $SYSDIR/sys3/ZPU560I/whAgent.exe - Win32/Adware.Webhancer.A 应用程序
D:\My Documents\$SYSDIR.zip > ZIP > $SYSDIR/sys3/ZPU560I/whiehlpr.dll - Win32/Adware.Webhancer 应用程序
D:\My Documents\$SYSDIR.zip > ZIP > $SYSDIR/sys3/ZPU560I/whInstaller.exe - Win32/Adware.Webhancer.390 应用程序

显示全部楼层 · 发表于 2008-10-15 10:33:47

NIS2009也报了6个。。。。。

显示全部楼层 · 发表于 2008-10-15 10:51:17

2008/10/15 10:50:07 1224039007 Silhouette 3792 Sign of "Win32:Trojano-2873 [Trj]" has been found in "C:\Users\Silhouette\Desktop\$SYSDIR.zip\$SYSDIR\mco2\ADI5MDi2.exe" file.
2008/10/15 10:50:11 1224039011 Silhouette 3792 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Users\Silhouette\Desktop\$SYSDIR.zip\$SYSDIR\pi\NTc326i.exe" file.
2008/10/15 10:50:11 1224039011 Silhouette 3792 Sign of "Win32:Adware-gen [Adw]" has been found in "C:\Users\Silhouette\Desktop\$SYSDIR.zip\$SYSDIR\sys3\ZPU560I\webhdll.dll" file.
2008/10/15 10:50:11 1224039011 Silhouette 3792 Sign of "Win32:Neptunia-YO [Trj]" has been found in "C:\Users\Silhouette\Desktop\$SYSDIR.zip\$SYSDIR\sys3\ZPU560I\whAgent.exe" file.
2008/10/15 10:50:11 1224039011 Silhouette 3792 Sign of "Win32:Dialer-567 [Trj]" has been found in "C:\Users\Silhouette\Desktop\$SYSDIR.zip\$SYSDIR\sys3\ZPU560I\whiehlpr.dll" file.

[病毒样本] 一包病毒

本帖子中包含更多资源

AVG

本帖子中包含更多资源