[病毒样本] 2X

显示全部楼层 · 发表于 2009-3-3 20:06:16

E:\DownLoad\123\123.exe
   [DETECTION] Is the TR/ATRAPS.Gen Trojan
[NOTE]    A backup was created as '49e01c54.qua'  ( QUARANTINE )
E:\DownLoad\9\123.exe
   [DETECTION] Is the TR/ATRAPS.Gen Trojan
[NOTE]    A backup was created as '49e01cf4.qua'  ( QUARANTINE )
E:\DownLoad\9\9.exe
   [DETECTION] Is the TR/ATRAPS.Gen Trojan
[NOTE]    A backup was created as '4a121cf3.qua'  ( QUARANTINE )

MISS 20005.EXE TO AVIRA

显示全部楼层 · 发表于 2009-3-3 20:08:44

AVIRA
File ID Filename Size (Byte) Result
1301980 20005.exe 36 KB FALSE POSITIVE

显示全部楼层 · 发表于 2009-3-3 20:32:20

C:\Documents and Settings\Administrator\桌面\文件\123.rar > RAR > 123.exe - Win32/PSW.Delf.NMX 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\文件\9.rar > RAR > 9.exe - Win32/PSW.Delf.NMX 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\文件\9.rar > RAR > 123.exe - Win32/PSW.Delf.NMX 特洛伊木马的变种

显示全部楼层 · 发表于 2009-3-3 20:33:00

貌似不是很新的

显示全部楼层 · 发表于 2009-3-3 20:35:04

名称: Packed/Upack
类型: Sequence

描述:

文件:
c:\users\administrator\desktop\123.exe

名称: Adware.Alibabar.H
类型: Trojan

描述:

文件:
c:\users\administrator\desktop\20005.exe

名称: Packed/Upack
类型: Sequence

描述:

文件:
c:\users\administrator\desktop\123.exe

名称: Packed/Upack
类型: Sequence

描述:

文件:
c:\users\administrator\desktop\9.exe

显示全部楼层 · 发表于 2009-3-3 20:38:32

Hello,

123.exe_ - Trojan-PSW.Win32.QQPass.gih

This file is already detected. Please update your antivirus bases.

9.exe_ - Trojan-PSW.Win32.QQPass.giv

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.
The answer is relevant to the latest bases from update sources.

显示全部楼层 · 发表于 2009-3-3 20:43:30

to rs

ka

显示全部楼层 · 发表于 2009-3-4 00:13:20

2009-03-04 00:12:59 创建文件    操作:阻止
进程路径:E:\virus\123.exe
文件路径:C:\tmpqq10000.tmp
触发规则:所有程序规则->03-禁止创建文件的目录（黑名单）->%SystemDrive%\*

2009-03-04 00:12:59 创建文件    操作:阻止
进程路径:E:\virus\123.exe
文件路径:C:\tmpqq10000.tmp
触发规则:所有程序规则->03-禁止创建文件的目录（黑名单）->%SystemDrive%\*

2009-03-04 00:13:29 创建注册表值    操作:阻止
进程路径:E:\virus\123.exe
注册表路径:HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run
注册表名称:[Key]
触发规则:所有程序规则->02-注册表启动项保护（黑名单）增强，多谢zhia->*\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

2009-03-04 00:13:29 创建注册表值    操作:阻止
进程路径:E:\virus\123.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run
注册表名称:[Key]
触发规则:所有程序规则->02-注册表启动项保护（黑名单）增强，多谢zhia->*\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

显示全部楼层 · 发表于 2009-3-4 08:46:18

过咖啡8.7i

[病毒样本] 2X

本帖子中包含更多资源