未知病毒样本

显示全部楼层 · 发表于 2007-3-24 11:03:02

2007年3月24日11时1分47秒开始查杀C:\Downloads\样本\888
C:\Downloads\样本\888\888.exe 发现可疑文件:Win32.NkHack.Preloc.A 操作:阻止运行
=========================================
_________文件性质分析结果________________
"带壳"仅指文件性质,仅供专业人员分析使用。

C:\Downloads\样本\888\888.exe 变形的Upx
--------------------------------------------------------------
2007年3月24日11时1分47秒收起线程…100% 查杀完毕！
扫描文件：1查杀病毒：1

显示全部楼层 · 发表于 2007-3-24 11:04:02

源文件找不到了……
残余……

显示全部楼层 · 发表于 2007-3-24 11:06:31

Scan performed at: 2007-3-24 11:05:58
Scanning Log
NOD32 version 2141 (20070324) NT
Command line: C:\Documents and Settings\user\桌面\888.rar
E:\Program Files\Eset\nod32.exe - is OK
Operating memory - is OK

Date: 24.3.2007 Time: 11:06:07
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\user\桌面\888.rar
C:\Documents and Settings\user\桌面\888.rar ?RAR ?888\888.exe.Vir - probably a variant of Win32/TrojanDropper.ErPack trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 11:06:08 Total scanning time: 1 sec (00:00:01)

显示全部楼层 · 发表于 2007-3-24 11:11:29

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-3-22
Start time: 2007-3-24 11:10
Engine(s): KAV engine (AVK 17.3463), BD-Engine (BD 17.5838)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: 888 888.exe.Vir
In archive: D:\掃描\888.rar
Status: Virus detected
Virus: Trojan-Dropper.Win32.Delf.pz (KAV engine)
Object: 888\888.exe.Vir
In archive: D:\掃描\888.rar
Status: Virus detected
Virus: Trojan.Dropper.Delf.PZ (BD-Engine)
Object: 888.rar
Path: D:\掃描
Status: Virus detected
Virus: Trojan-Dropper.Win32.Delf.pz (KAV engine), Trojan.Dropper.Delf.PZ (BD-Engine)
Analysis complete: 2007-3-24 11:10
1 files checked
1 infected files detected
0 suspected files detected

显示全部楼层 · 发表于 2007-3-24 11:13:27

蜘蛛杀.......

显示全部楼层 · 发表于 2007-3-24 11:15:54

再来一個杀.......

[ 本帖最后由蓝色牛仔裤于 2007-3-24 11:18 编辑 ]

显示全部楼层 · 发表于 2007-3-24 11:16:12

Scan performed at: 2007-3-24 11:16:23
Scanning Log
NOD32 version 2141 (20070324) NT
Command line: C:\Documents and Settings\EQ2\桌面\888.rar
Operating memory - is OK

Date: 24.3.2007 Time: 11:16:28
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\888.rar
C:\Documents and Settings\EQ2\桌面\888.rar ?RAR ?888\888.exe.Vir - probably a variant of Win32/TrojanDropper.ErPack trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 11:16:28 Total scanning time: 0 sec (00:00:00)

显示全部楼层 · 发表于 2007-3-24 11:19:09

已检测到: 木马程序 Trojan-Dropper.Win32.Delf.pz URL: http://bbs.kafan.cn/attachment.php?aid=46855/888/888.exe.Vir

显示全部楼层 · 发表于 2007-3-24 11:19:54

Starting the file scan:

Begin scan in 'D:\掃描\888.rar'
D:\掃描\888.rar
  [0] Archive type: RAR
  --> 888\888.exe.Vir
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [WARNING] The file was ignored!

閃人, 去吃飯...

显示全部楼层 · 发表于 2007-3-24 11:20:43

再次被偶猜中。。。看看加了什么壳。。。。等会去给正常文件加壳看看。。。

[病毒样本] 未知病毒样本

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源