单位同事上网时中的，害我清了半个小时--一网页

显示全部楼层 · 发表于 2007-3-13 23:08:53

http://cngov168.cn/a/3752.htm

大概就是这个地址了......进机器后居然建立了过十个进程...

显示全部楼层 · 发表于 2007-3-13 23:37:11

我抓到了

显示全部楼层 · 发表于 2007-3-13 23:38:27

Scan performed at: 2007-3-13 23:38:27
Scanning Log
NOD32 version 2112 (20070313) NT
Command line: C:\Documents and Settings\EQ2\桌面\gz.rar
Operating memory - is OK

Date: 13.3.2007 Time: 23:38:31
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\gz.rar
C:\Documents and Settings\EQ2\桌面\gz.rar ?RAR ?gz.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\gz.rar ?RAR ?my.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\gz.rar ?RAR ?qq.exe - probably a variant of Win32/PSW.QQPass.VD trojan
Number of scanned files: 6
Number of threats found: 3
Number of files cleaned: 1
Time of completion: 23:38:31 Total scanning time: 0 sec (00:00:00)

Notes:
[7] File is probably infected with an unknown virus.

显示全部楼层 · 发表于 2007-3-13 23:41:35

费尔右键扫描报告为带壳程序

为什么要加壳

估计运行后会杀

显示全部楼层 · 发表于 2007-3-13 23:43:22

通杀

显示全部楼层 · 发表于 2007-3-13 23:43:25

难道费尔也不能脱壳？？？？无语了。。。。

显示全部楼层 · 发表于 2007-3-13 23:43:33

AVK报5个
=======================Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-3-13
Start time: 2007-3-13 23:42
Engine(s): KAV engine (AVK 17.3243), BD-Engine (BD 17.2404)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: my.exe
In archive: C:\Documents and Settings\Administrator\桌面\gz.rar
Status: Virus detected
Virus: Trojan-PSW.Win32.OnLineGames.ig (KAV engine)
Object: gz.exe
In archive: C:\Documents and Settings\Administrator\桌面\gz.rar
Status: Virus detected
Virus: MemScan:Trojan.Jvoncik.A (BD-Engine)
Object: mm[1].exe
In archive: C:\Documents and Settings\Administrator\桌面\gz.rar
Status: Virus detected
Virus: Generic.PWStealer.8C9C07DE (BD-Engine)
Object: qq.exe
In archive: C:\Documents and Settings\Administrator\桌面\gz.rar
Status: Virus detected
Virus: Generic.PWStealer.E20F3D72 (BD-Engine)
Object: zt.exe
In archive: C:\Documents and Settings\Administrator\桌面\gz.rar
Status: Suspected virus
Virus: Generic.Malware.Sdld!.C89D8643 (BD-Engine)
Object: gz.rar
Path: C:\Documents and Settings\Administrator\桌面
Status: Move file into quarantine
Virus: Trojan-PSW.Win32.OnLineGames.ig (KAV engine), MemScan:Trojan.Jvoncik.A, Generic.PWStealer.8C9C07DE, Generic.PWStealer.E20F3D72, Generic.Malware.Sdld!.C89D8643 (BD-Engine)
Analysis complete: 2007-3-13 23:42
1 files checked
1 infected files detected
0 suspected files detected

显示全部楼层 · 发表于 2007-3-13 23:44:20

进去后地址自动跳到这来了

显示全部楼层 · 发表于 2007-3-13 23:45:28

运行了一下。。。剩下两个OP杀了一个。。。。

显示全部楼层 · 发表于 2007-3-13 23:45:33

熊猫报2个，其余已上报

[病毒样本] 单位同事上网时中的，害我清了半个小时--一网页

本帖子中包含更多资源

nod32右键扫描报3个

本帖子中包含更多资源

回复 #4 aoyang 的帖子

本帖子中包含更多资源

本帖子中包含更多资源