3人组某捆绑生成物！主流认识的不多

tgzw1680

变态大a除外，哈哈

尤金卡巴斯基

To KL

浪滔天

Thunds.db 后缀名改为 exe 后可运行。在D盘生成 Thund.db 并启动，再由 Thund.db 在system32 下生成 360verify.dll 。

08红伞威点

End of the scan: 2009年1月15日  01:04
Used time: 00:05 Minute(s)

The scan has been done completely.

      1 Scanning directories
      3 Files were scanned
      2 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      3 files were deleted
      0 files were repaired
      3 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      0 Files not concerned
      0 Archives were scanned
      0 Warnings
      3 Notes---------------------------------------------------红伞S版(库V7.01.01.111)杀.
-----------------------------------------------------------------------------------------------------------------
"AUTOEXEC.BAT"启发报.

File ID  Filename Size (Byte) Result
25232222  AUTOEXEC.BAT  6.11 KB  UNDER ANALYSIS

to  Avira .

sam.to

你能否把这些文件放上來?

浪滔天

原帖由 sam.to 于 2009-1-15 01:16 发表
你能否把这些文件放上來?

360verify.dll 和楼主包里的是一样的。这个是在D盘生成的，后缀名改exe也可以运行，这个才是干事的正主。

solcroft

只报dll

C:\Documents and Settings\Limited User\Desktop\×ÀÃæ.rar » RAR » 360verify.dll - a variant of Win32/NetTool.ZXProxy.A potentially unsafe application

西风萧雨

lsyer

--> Thunds.db
      [DETECTION] Is the TR/Dropper.Gen Trojan
    --> 360verify.dll
      [DETECTION] Is the TR/Stealer.2ns1.A Trojan
      --> AUTOEXEC.BAT
          [DETECTION] Contains HEUR/Crypted suspicious code

xyao

avast!