第536次更新orz下载器，见1887楼.（过主流高品质）

显示全部楼层 · 发表于 2009-1-18 16:41:15

------------------------
检查 : 57
重复(被删除) : 26
开始时间 : 2009-1-18 16:37:34 中止时间 : 2009-1-18 16:37:34
耗费 : 0s
------------------------

剩余的31个：
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 01/18/2009 at 04:38 PM

Application Version : 4.24.1004

Core Rules Database Version : 3705
Trace Rules Database Version: 1689

Scan type    : Custom Scan
Total Scan Time : 00:00:08

Memory items scanned    : 0
Memory threats detected : 0
Registry items scanned : 0
Registry threats detected : 0
File items scanned       : 31
File threats detected    : 7

Trojan.Unknown Origin
C:\TEST\0901\18\TO_KL\TO KL\7863830
C:\TEST\0901\18\TO_KL\TO KL\7925554
C:\TEST\0901\18\TO_KL\TO KL\7956401
C:\TEST\0901\18\TO_KL\TO KL\7987185
C:\TEST\0901\18\TO_KL\TO KL\8070162

Trojan.Tencent/Variant
C:\TEST\0901\18\TO_KL\TO KL\8101650
C:\TEST\0901\18\TO_KL\TO KL\UZSKTNT.ZS3

显示全部楼层 · 发表于 2009-1-18 17:17:54

费尔剩下两个

显示全部楼层 · 发表于 2009-1-18 17:20:28

The scan has been done completely.

   2 Scanning directories
   57 Files were scanned
   55 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   55 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   0 Archives were scanned
   0 Warnings
   55 Notes

显示全部楼层 · 发表于 2009-1-18 17:56:12

Hello,

77cafe.dll

No malicious code was found in this file.

7884394 - Trojan-Downloader.Win32.Agent.bdsy,
7894630 - Trojan-PSW.Win32.Agent.lqp,
UnxxZun.Zmp - Trojan-PSW.Win32.Agent.lqo

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

显示全部楼层 · 发表于 2009-1-19 21:27:39

以将PE处理...
TO KL

显示全部楼层 · 发表于 2009-1-19 21:31:19

Access to the data has been denied!
Warning: A virus or unwanted program has been found in the HTTP Data.

Requested URL: http://bbs.kafan.cn/attachment.p ... 69&t=1232371809
Information: Contains HEUR/Crypted suspicious code

Generated by AntiVir WebGuard 8.0.15.0, AVE 8.2.0.57, VDF 7.1.1.139

显示全部楼层 · 发表于 2009-1-19 21:32:55

orz.rar\orz.exe\0rz.exe: 沙盘无法运行

虚拟机：
---------------------------
ExeGuarder
---------------------------
This file is encrypted by Unregistered Exe Guarder!
http://www.exeicon.com/exeguarder/
---------------------------
确定
---------------------------

显示全部楼层 · 发表于 2009-1-21 11:58:16

这次没处理...
To KL

显示全部楼层 · 发表于 2009-1-21 12:04:17

免红伞，期待免微点
程序：
C:\DOCUMENTS AND SETTINGS\\桌面\ORZ.EXE
木马程序生成以下文件：
1) C:\DOCUMENTS AND SETTINGS\\LOCAL SETTINGS\APPLICATION DATA\CLIPSRV.EXE
2) C:\WINDOWS\RSVP.EXE
3) C:\DOCUMENTS AND SETTINGS\\LOCAL SETTINGS\TEMP\CLIPSRV.EXE
是否删除木马程序及其衍生物?

[病毒样本] 第536次更新orz下载器，见1887楼.（过主流高品质）

本帖子中包含更多资源

本帖子中包含更多资源

回复 316楼 935623508 的帖子

本帖子中包含更多资源

回复 318楼 qianwenxiang 的帖子

本帖子中包含更多资源

回复 319楼 935623508 的帖子