第一次学抓了三个木马

龙井茶

在别人机子上拷点资料,拿回来红伞报杀,在隔离区我又把这几个毒放回去,再打包
做完后再看,居然忘了开影子系统,吓我一跳.还好机子没不良反应.

Begin scan in 'C:\Documents and Settings\Administrator\桌面\99999.rar'
C:\Documents and Settings\Administrator\桌面\99999.rar
  [0] Archive type: RAR
  --> fun.xls.exe
      [DETECTION] Is the Trojan horse TR/Agent.VB.AO
  --> WIn.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> autorun.inf
      [DETECTION] Is the Trojan horse TR/Agent.VB.AO.1
      [INFO]      A backup was created as '4631ba85.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!

[ 本帖最后由 龙井茶 于 2007-3-15 11:15 编辑 ]

allenhippo

solcroft

Cyberhawk报

The EQs

Scan performed at: 2007-3-15 11:11:44
Scanning Log
NOD32 version 2116 (20070314) NT
Command line: C:\Documents and Settings\EQ2\桌面\99999.rar
Operating memory - is OK

Date: 15.3.2007  Time: 11:11:48
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\99999.rar
C:\Documents and Settings\EQ2\桌面\99999.rar ?RAR ?fun.xls.exe - Win32/VB.EL worm - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\99999.rar ?RAR ?WIn.exe - probably a variant of Win32/PSW.QQPass.JF trojan
Number of scanned files: 4
Number of threats found: 2
Number of files cleaned: 1
Time of completion: 11:11:49 Total scanning time: 1 sec (00:00:01)

Anycall-D908

弱弱的请教下，我要是发现了病毒，怎么样才能把样本直接提取出来，而不需要把整个中毒文件带走呢？

hhj9920

楼上的问题我也想知道啊.请版主回答一下.谢谢

龙井茶

一般来说,把毒分离出来,那应该是杀软公司的分析师的事情吧,非专业人士恐怕有点困难,与中毒文件一起拿来一样的啊.
这类问题建议单独开个专贴问,这样问版主不一定看得到

loommool

刚刚解压缩微点就把它干了。。

鱼是一只我

驱逐舰
2007-3-15 12:21:04        fun.xls.exe        C:\99999        BackDoor.Generic.1480        10
2007-3-15 12:21:04        WIn.exe        C:\99999        Trojan.DownLoader.12765        10

jlennon

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-3-14
Start time: 2007-3-15 13:06
Engine(s): KAV engine (AVK 17.3277), BD-Engine (BD 17.2421)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: fun.xls.exe
        In archive: C:\Documents and Settings\Administrator\桌面\99999.rar
        Status: Virus detected
        Virus: Worm.Win32.VB.el (KAV engine), Trojan.Agent.VB.AO (BD-Engine)
Object: WIn.exe
        In archive: C:\Documents and Settings\Administrator\桌面\99999.rar
        Status: Virus detected
        Virus: Trojan-Downloader.Win32.Agent.aye (KAV engine), Trojan.Downloader.Delf.XU (BD-Engine)
Object: autorun.inf
        In archive: C:\Documents and Settings\Administrator\桌面\99999.rar
        Status: Virus detected
        Virus: Trojan.Agent.VB.AO (BD-Engine)
Object: 99999.rar
        Path: C:\Documents and Settings\Administrator\桌面
        Status: Move file into quarantine
        Virus: Worm.Win32.VB.el, Trojan-Downloader.Win32.Agent.aye (KAV engine), Trojan.Agent.VB.AO (2x), Trojan.Downloader.Delf.XU (BD-Engine)
Analysis complete: 2007-3-15 13:06
    1 files checked
    1 infected files detected
    0 suspected files detected