主页老是被改，大家帮忙看看这些脚本

显示全部楼层 · 发表于 2009-6-14 20:19:36

bao888.exe也是一个...自解压程序...但是貌似变形过了...因此无法识别

显示全部楼层 · 发表于 2009-6-14 21:25:32

to McAfee

显示全部楼层 · 发表于 2009-6-14 21:31:44

样本解压之后文件给隐藏了，我想知道这个病毒是如何禁用了我查看隐藏属性文件的设置的？...忘了上图，微点MISS

[ 本帖最后由 Anycall-D908 于 2009-6-14 21:34 编辑 ]

显示全部楼层 · 发表于 2009-6-14 21:48:23

Hello,

1.vbs_,
12.reg_,
2.bat_,
spoolsv.vbs_,
sv.vbs_

No malicious code were found in these files.

win2.bat_ - Trojan-Downloader.BAT.Ftp.fo,

win20.bat_,
win21.bat_ - Trojan-Downloader.BAT.Ftp.fp

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.
The answer is relevant to the latest bases from update sources.

显示全部楼层 · 发表于 2009-6-14 21:50:35

原帖由 J-F-F 于 2009-6-14 18:30 发表
 ftp://xing885:zhenhao888@www.xing885.cn/wwwroot/8858.exe

B66F275B825FD15671AE0F84C557A5AB
to kl

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

[ 本帖最后由 sam.to 于 2009-6-14 23:25 编辑 ]

显示全部楼层 · 发表于 2009-6-14 23:38:18

nod
RAR > loty\1.vbs is OK
RAR > loty\12.reg is OK
RAR > loty\2.bat is OK
RAR > loty\8858.exe multiple threats
RAR > loty\8858.exe > RAR > bao888.exe Win32/PSW.Delf.NMX trojan
RAR > loty\8858.exe > RAR > setup_7.exe Win32/TrojanDownloader.Agent.PEL trojan
RAR > loty\spoolsv.vbs is OK
RAR > loty\win20.bat is OK
RAR > loty\win21.bat is OK

yyuhh文件夹MISS

RAR > bao888.exe Win32/PSW.Delf.NMX trojan
RAR > setup_7.exe Win32/TrojanDownloader.Agent.PEL trojan

显示全部楼层 · 发表于 2009-6-18 17:18:14

URL was added to the blacklist.

[可疑文件] 主页老是被改，大家帮忙看看这些脚本

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块