扫(转sebo)

显示全部楼层 · 发表于 2007-3-19 04:13:58

123，修改了，重传

[ 本帖最后由 jlennon 于 2007-3-19 08:13 编辑 ]

显示全部楼层 · 发表于 2007-3-19 06:20:11

Hosts里面的代码

127.0.0.1 localhost
127.0.0.1 test.nicemm.cn
127.0.0.1 new3.etsoft.com.cn
127.0.0.1 www.djdj110.com
127.0.0.1 www.gaodumm.com
127.0.0.1 www.88cc8.com
127.0.0.1 wg770.com
127.0.0.1 www.y988.com
127.0.0.1 ads.9168a.com
127.0.0.1 www.flashsky.com
127.0.0.1 www.123ye.com

显示全部楼层 · 发表于 2007-3-19 06:27:34

同时执行之后没有任何效果

显示全部楼层 · 发表于 2007-3-19 08:41:56

卡巴报

已检测到: 木马程序 Trojan-PSW.Win32.OnLineGames.es URL: http://bbs.kafan.cn/attachment.php?aid=44808/新建文件夹/jh.exe

显示全部楼层 · 发表于 2007-3-19 08:49:37

Scan performed at: 2007-3-19 8:49:40
Scanning Log
NOD32 version 2125 (20070318) NT
Command line: C:\Documents and Settings\EQ2\桌面\新建文件夹.rar
Operating memory - is OK

Date: 19.3.2007 Time: 08:49:47
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\新建文件夹.rar
C:\Documents and Settings\EQ2\桌面\新建文件夹.rar ?RAR ?新建文件夹\jh.exe - Win32/PSW.Agent.NCC trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\新建文件夹.rar ?RAR ?新建文件夹\mplay.com - probably a variant of Win32/Spy.Delf.NDZ trojan
Number of scanned files: 12
Number of threats found: 2
Number of files cleaned: 1
Time of completion: 08:49:48 Total scanning time: 1 sec (00:00:01)

显示全部楼层 · 发表于 2007-3-19 09:26:12

Begin scan in 'C:\Documents and Settings\Administrator\桌面\新建文件夹.rar'
C:\Documents and Settings\Administrator\桌面\新建文件夹.rar
  [0] Archive type: RAR
  --> ÐÂ½¨ÎÄ¼þ¼Ð\jh.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> ÐÂ½¨ÎÄ¼þ¼Ð\Kernel32.exe
   [DETECTION] Contains suspicious code HEUR/Crypted
  --> ÐÂ½¨ÎÄ¼þ¼Ð\mh.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSAnti.Gen
  --> ÐÂ½¨ÎÄ¼þ¼Ð\ms.exe
   [DETECTION] Contains suspicious code HEUR/Crypted
  --> ÐÂ½¨ÎÄ¼þ¼Ð\my.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSAnti.Gen
  --> ÐÂ½¨ÎÄ¼þ¼Ð\wl.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSAnti.Gen
  --> ÐÂ½¨ÎÄ¼þ¼Ð\mplay.com
   [DETECTION] Is the Trojan horse TR/Spy.Agent.PN.183
   [INFO]    A backup was created as 'ab8545af.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-3-19 09:30:18

根据virusbuster来看又是NSPM

显示全部楼层 · 发表于 2007-3-19 09:50:44

原帖由 EQ2 于 2007-3-19 09:30 发表
根据virusbuster来看又是NSPM

这下惨了，怎么卡巴和NOD32也来报毒了，难道也只是在报壳

显示全部楼层 · 发表于 2007-3-19 09:56:41

不是的。。。这个毒加了UPX和另外一个壳。。。。

显示全部楼层 · 发表于 2007-3-19 10:03:16

原帖由 EQ2 于 2007-3-19 09:56 发表
不是的。。。这个毒加了UPX和另外一个壳。。。。

也不是一样报了吗？

怎么只有红伞报毒时，EQ2兄才来说报壳呢？

[病毒样本] 扫(转sebo)

本帖子中包含更多资源

回复 #8 solcroft 的帖子