mm.exe 第365次更新 3月14日第2次更新

显示全部楼层 · 发表于 2009-2-24 23:14:07

原帖由 sam.to 于 2009-2-24 21:37 发表
第320次更新

C:\Documents and Settings\GUNDAM\桌面\0224-2131mm.rar » RAR » 1.exe_ - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\GUNDAM\桌面\0224-2131mm.rar » RAR » mm.exe_ - probably a variant of Win32/AutoRun.Agent.IE worm
C:\Documents and Settings\GUNDAM\桌面\0224-2131mm.rar » RAR » x.gif_ » RAR » 照片 .exe - probably a variant of Win32/AutoRun.Agent.IE worm
C:\Documents and Settings\GUNDAM\桌面\0224-2131mm-c.rar » RAR » 0224-2131mm-c\wuauclt.e2xe - probably a variant of Win32/Genetik trojan

显示全部楼层 · 发表于 2009-2-24 23:21:10

All to VB

显示全部楼层 · 发表于 2009-2-25 13:34:29

第321次更新

显示全部楼层 · 发表于 2009-2-25 20:58:30

第322次更新

显示全部楼层 · 发表于 2009-2-25 21:04:22

Begin scan in 'D:\0225-2053mm.rar'
D:\0225-2053mm.rar
[0] Archive type: RAR
--> 9.exe2
   [DETECTION] Contains HEUR/Crypted suspicious code
   --> x.gif2
      [1] Archive type: RAR
      --> ￕￕￆﾬ                                                                                                          .exe
      [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
--> mm.exe2
   [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
   --> 1.exe2
      [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
[NOTE]    A backup was created as '49d741d8.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

Begin scan in 'D:\0225-2053mm-c.rar'
D:\0225-2053mm-c.rar
[0] Archive type: RAR
--> 0225-2053mm-c\aVj.pif
   [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
   --> 0225-2053mm-c\vvs.dll
      [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
   --> 0225-2053mm-c\wuauclt.exe
      [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
[NOTE]    A backup was created as '49d741fc.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

显示全部楼层 · 发表于 2009-2-25 21:45:34

321、322只查出4个，不报的to VB

显示全部楼层 · 发表于 2009-2-25 22:30:29

原帖由 sam.to 于 2009-2-25 13:34 发表
第321次更新

Eset 还是不认那个pif
C:\Documents and Settings\GUNDAM\桌面\0225-1333mm.rar » RAR » 9.exe0 - a variant of Win32/HackTool.Xarp trojan
C:\Documents and Settings\GUNDAM\桌面\0225-1333mm.rar » RAR » mm.exe2 - probably a variant of Win32/AutoRun.Agent.IE worm
C:\Documents and Settings\GUNDAM\桌面\0225-1333mm.rar » RAR » x.gif2 » RAR » 照片 .exe - probably a variant of Win32/AutoRun.Agent.IE worm
C:\Documents and Settings\GUNDAM\桌面\0225-1333mm.rar » RAR » 1.ex2e - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\GUNDAM\桌面\0225-1333mm-c.rar » RAR » 0225-1333mm-c\TIMPIatform.ex2e - a variant of Win32/Delf.NNM trojan
C:\Documents and Settings\GUNDAM\桌面\0225-1333mm-c.rar » RAR » 0225-1333mm-c\wuauclt.ex2e - probably a variant of Win32/Genetik trojan

显示全部楼层 · 发表于 2009-2-25 22:31:26

原帖由 sam.to 于 2009-2-25 20:58 发表
第322次更新

pif和dll不认
C:\Documents and Settings\GUNDAM\桌面\0225-2053mm.rar » RAR » 9.exe2 - a variant of Win32/HackTool.Xarp trojan
C:\Documents and Settings\GUNDAM\桌面\0225-2053mm.rar » RAR » x.gif2 » RAR » 照片 .exe - probably a variant of Win32/AutoRun.Agent.IE worm
C:\Documents and Settings\GUNDAM\桌面\0225-2053mm.rar » RAR » mm.exe2 - probably a variant of Win32/AutoRun.Agent.IE worm
C:\Documents and Settings\GUNDAM\桌面\0225-2053mm.rar » RAR » 1.exe2 - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\GUNDAM\桌面\0225-2053mm-c.rar » RAR » 0225-2053mm-c\wuauclt.exe - probably a variant of Win32/Genetik trojan

显示全部楼层 · 发表于 2009-2-26 11:31:28

第323次更新

显示全部楼层 · 发表于 2009-2-26 11:37:11

名称: Packed/NSPack
类型: Sequence

描述:

文件:
c:\users\administrator\desktop\9.ex2e

[病毒样本] mm.exe 第365次更新 3月14日第2次更新

回复 79楼 sam.to 的帖子

回复 84楼 sam.to 的帖子

回复 84楼 sam.to 的帖子

回复 89楼 sam.to 的帖子

浏览过的版块