单位里抓到的2x

显示全部楼层 · 发表于 2009-2-10 09:12:03

今天看了下任务管理器，进程里两个很明显的东西

显示全部楼层 · 发表于 2009-2-10 09:19:14

貌似两个毒是一样的

显示全部楼层 · 发表于 2009-2-10 09:20:30

Begin scan in 'C:\Sandbox\Administrator\virus\drive\D\桌面'
C:\Sandbox\Administrator\virus\drive\D\桌面\78135D.EXE
[DETECTION] Is the TR/Dropper.Gen Trojan
[NOTE]    A backup was created as '49c1d675.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Sandbox\Administrator\virus\drive\D\桌面\NT-8AC9B795.EXE
[DETECTION] Is the TR/Dropper.Gen Trojan
[NOTE]    A backup was created as '49bdd691.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

显示全部楼层 · 发表于 2009-2-10 09:20:34

to kaba kill,waiting for reply。。。

Hello,

78135D.exe_ - Trojan.Win32.FlyStudio.gi

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

[ 本帖最后由 FLogo 于 2009-2-10 11:06 编辑 ]

显示全部楼层 · 发表于 2009-2-10 09:20:50

是一样的

https://www.virustotal.com/anali ... 43d37ec0e457a09fb25

显示全部楼层 · 发表于 2009-2-10 09:34:27

原帖由 FLogo 于 2009-2-10 09:20 发表
to kaba kill,waiting for reply。。。

回了信嗎?

显示全部楼层 · 发表于 2009-2-10 09:58:59

过MCAFEE8.7

显示全部楼层 · 发表于 2009-2-10 10:11:35

还没有呀，要是有回信的话，我会来更新我的帖子的！

[ 本帖最后由 FLogo 于 2009-2-10 11:06 编辑 ]

显示全部楼层 · 发表于 2009-2-10 10:15:37

Win32:Rootkit-gen [Rtk]

显示全部楼层 · 发表于 2009-2-10 11:07:29

程序：
C:\DOCUMENTS AND SETTINGS\ZDLZP\LOCAL SETTINGS\TEMP\RAR$EX01.777\78135D.EXE
木马程序生成以下文件：
1) C:\DOCUMENTS AND SETTINGS\\LOCAL SETTINGS\TEMP\E_N4\HTMLVIEW.FNE
2) C:\DOCUMENTS AND SETTINGS\LOCAL SETTINGS\TEMP\E_N4\INTERNET.FNE
3) C:\DOCUMENTS AND SETTINGS\LOCAL SETTINGS\TEMP\E_N4\EAPI.FNE
4) C:\DOCUMENTS AND SETTINGS\\LOCAL SETTINGS\TEMP\E_N4\SHELL.FNE
木马名称：未知木马

程序：
C:\DOCUMENTS AND SETTINGS\\LOCAL SETTINGS\TEMP\RAR$EX04.052\78135D.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

[病毒样本] 单位里抓到的2x

本帖子中包含更多资源

回复 6楼 sam.to 的帖子

浏览过的版块