老毒

显示全部楼层 · 发表于 2007-3-7 22:23:27

1010101

显示全部楼层 · 发表于 2007-3-7 22:24:44

又是好几个，敢情是闯进毒窝了？

闪。。

显示全部楼层 · 发表于 2007-3-7 22:24:56

Scan performed at: 2007-3-7 22:24:16
Scanning Log
NOD32 version 2100 (20070307) NT
Command line: C:\Documents and Settings\EQ2\桌面\DDIV.rar C:\Documents and Settings\EQ2\桌面\divv.rar C:\Documents and Settings\EQ2\桌面\aaaaa.rar C:\Documents and Settings\EQ2\桌面\Kunbang.rar
Operating memory - is OK

Date: 7.3.2007 Time: 22:24:24
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\DDIV.rar; C:\Documents and Settings\EQ2\桌面\divv.rar; C:\Documents and Settings\EQ2\桌面\aaaaa.rar; C:\Documents and Settings\EQ2\桌面\Kunbang.rar
C:\Documents and Settings\EQ2\桌面\DDIV.rar ?RAR ?DDIV.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\divv.rar ?RAR ?divv.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\aaaaa.rar ?RAR ?aaaaa.exe - Win32/TrojanDownloader.VB.APY trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\Kunbang.rar ?RAR ?Kunbang.exe - Incorrect file checksum (CRC), the file is probably password protected.
Number of scanned files: 7
Number of threats found: 3
Number of files cleaned: 3
Time of completion: 22:24:25 Total scanning time: 1 sec (00:00:01)

Notes:
[7] File is probably infected with an unknown virus.

显示全部楼层 · 发表于 2007-3-8 00:04:37

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\Kunbang'
C:\Documents and Settings\Administrator\My Documents\Kunbang\
  Kunbang.exe
   [DETECTION] Contains signature of the dropper DR/Dldr.NSIS.Agent.X
   [WARNING] The file was ignored!
Begin scan in 'C:\Documents and Settings\Administrator\My Documents\aaaaa.rar'
C:\Documents and Settings\Administrator\My Documents\
  aaaaa.rar
[0] Archive type: RAR
--> aaaaa.exe
      [DETECTION] Is the Trojan horse TR/Agent.5164
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!
Begin scan in 'C:\Documents and Settings\Administrator\My Documents\DDIV.rar'
C:\Documents and Settings\Administrator\My Documents\
  DDIV.rar
[0] Archive type: RAR
--> DDIV.exe
      [DETECTION] Is the Trojan horse TR/PSW.Nilage.aui.1
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!
Begin scan in 'C:\Documents and Settings\Administrator\My Documents\divv.rar'
C:\Documents and Settings\Administrator\My Documents\
  divv.rar
[0] Archive type: RAR
--> divv.exe
      [DETECTION] Is the Trojan horse TR/PSW.Nilage.aui.2
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

End of the scan: 2007年3月7日  08:04
Used time: 00:07 min

The scan has been done completely.

   1 Scanning directories
   7 Files were scanned
   4 viruses and/or unwanted programs were found
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   3 Files not concerned
   3 Archives were scanned
   7 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-3-8 08:09:56

Virus check with AntiVirusKit
Version 17.0.6282
Virus signatures of 3/6/2007
Start time: 3/8/2007 08:09
Engine(s): Engine A (AVK 17.3103), Engine B (BD 17.2113)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: aaaaa.exe
In archive: C:\Documents and Settings\Administrator\桌面\aaaaa.rar
Status: Virus detected
Virus: Trojan-Downloader.Win32.VB.apy (Engine A), GenPack:Generic.Malware.SBdld!.B9D27C05 (Engine B)
Object: aaaaa.rar
Path: C:\Documents and Settings\Administrator\桌面
Status: Move file into quarantine
Virus: Trojan-Downloader.Win32.VB.apy (Engine A), GenPack:Generic.Malware.SBdld!.B9D27C05 (Engine B)
Object: DDIV.exe
In archive: C:\Documents and Settings\Administrator\桌面\DDIV.rar
Status: Virus detected
Virus: Trojan.Win32.Agent.abs (Engine A), BehavesLike:Trojan.ShellStartup (Engine B)
Object: DDIV.rar
Path: C:\Documents and Settings\Administrator\桌面
Status: Move file into quarantine
Virus: Trojan.Win32.Agent.abs (Engine A), BehavesLike:Trojan.ShellStartup (Engine B)
Object: divv.exe
In archive: C:\Documents and Settings\Administrator\桌面\divv.rar
Status: Virus detected
Virus: Trojan.Win32.Agent.abs (Engine A), BehavesLike:Trojan.ShellStartup (Engine B)
Object: divv.rar
Path: C:\Documents and Settings\Administrator\桌面
Status: Move file into quarantine
Virus: Trojan.Win32.Agent.abs (Engine A), BehavesLike:Trojan.ShellStartup (Engine B)
Analysis complete: 3/8/2007 08:09
4 files checked
3 infected files detected
0 suspected files detected

显示全部楼层 · 发表于 2007-3-8 09:08:30

FS7.0
Result: 3 malware found
Trojan-Downloader.Win32.VB.apy (virus)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\aaaaa.rar\aaaaa.exe
Trojan.Win32.Agent.abs (virus)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\DDIV.rar\DDIV.exe
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\divv.rar\divv.exe

显示全部楼层 · 发表于 2007-3-8 09:53:13

微点
木马名称:Trojan-Downloader.Win32.Small.eqd

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TWIEX4\AAAAA.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan.Win32.Agent.aqe

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TWIEX5\DDIV.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

恶意程序名称:BadJoke.Win32.Reboot.a

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TWIEX6\DIVV.EXE
是恶意程序!
已成功阻止其运行,是否要删除此文件?

最后一个压缩包加密了未测。

显示全部楼层 · 发表于 2007-3-8 09:54:07

费尔

显示全部楼层 · 发表于 2007-3-8 10:38:34

照这样下去,我们论坛的样本区将会受到各大杀软厂商的光顾.

显示全部楼层 · 发表于 2007-3-8 12:33:43

第一个和第四个.驱逐舰都查不出来.郁闷

[病毒样本] 老毒

本帖子中包含更多资源

本帖子中包含更多资源