送上2个样本.

显示全部楼层 · 发表于 2009-7-17 01:36:29

hXXp://zhong288.com/svchost.exe
hXXp://fewwe322.cn/csrss.exe

显示全部楼层 · 发表于 2009-7-17 02:56:19

IKARUS - T3SCAN V1.32.10.0 (WIN32)
      T3 V1.01.64
      Copyright (c) 2006 - 2009 by Ikarus Software.
      All rights reserved.

Signature-database from 16.7.2009 16:01:29 (Build: 73047)

E:\2.zip:csrss.exe - Signature 'Trojan-Downloader.Win32.Geral' found
E:\2.zip:svchost.exe - Signature 'Trojan-Dropper.Agent' found
E:\2.zip - Signature 'Trojan-Dropper.Agent' found

      3 Files scanned
      (1 Archiv with 2 files)
      3 Signatures found
      0 Suspect code-parts found
      Used time: 0:00.063

显示全部楼层 · 发表于 2009-7-17 03:50:43

C:\Documents and Settings\Administrator\桌面\2.zip > ZIP > svchost.exe - 可能是 Win32/AutoRun.KillAV.A 蠕虫的变种

Begin scan in 'C:\Documents and Settings\Administrator\桌面\2.zip'
C:\Documents and Settings\Administrator\桌面\2.zip
  [0] Archive type: ZIP
--> csrss.exe
   [DETECTION] Contains a recognition pattern of the (harmful) BDS/Backdoor.Gen back-door program
--> svchost.exe
   [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
[NOTE]    The file was deleted!

[ 本帖最后由 nosferatu 于 2009-7-17 03:52 编辑 ]

显示全部楼层 · 发表于 2009-7-17 07:15:07

avast全杀

显示全部楼层 · 发表于 2009-7-17 07:38:38

病毒 2009-07-17 07:38:20 病毒在文件C:\DOCUME~1\ADMINI~1\LOCALS~1\TEMP\KAV1445.TMP中 Win32.Troj.DownBMW.102400(木马程序) 拦截成功（重启之后删除）

显示全部楼层 · 发表于 2009-7-17 08:02:30

Trojan.Win32.Generic.11EAC1C

Trojan.Win32.Generic.11EAD02

显示全部楼层 · 发表于 2009-7-17 08:44:45

E:\2.zip > ZIP > svchost.exe - 可能是 Win32/AutoRun.KillAV.A 蠕虫的变种

显示全部楼层 · 发表于 2009-7-17 09:29:47

瑞星2010
Trojan.Win32.Generic.11EAC1CD
Trojan.Win32.Generic.11EAD02B

显示全部楼层 · 发表于 2009-7-17 09:45:36

C:\Documents and Settings\Administrator\桌面\2.zip > ZIP > csrss.exe > UPX v12_m2 - 正常
C:\Documents and Settings\Administrator\桌面\2.zip > ZIP > svchost.exe - 可能是 Win32/AutoRun.KillAV.A 蠕虫的变种

显示全部楼层 · 发表于 2009-7-17 09:55:13

norton

trojan.dropper

trojan.killav

[病毒样本] 送上2个样本.

本帖子中包含更多资源

浏览过的版块