两样本~~~

显示全部楼层 · 发表于 2007-3-25 16:31:07

第二个被咖啡直接妙了，第一个运行后

2007-3-25 1:28:56 已由访问保护规则禁止 MT-16D974393A12\wynn C:\Documents and Settings\wynn\My Documents\0[1].exe C:\WINDOWS\system32\drivers\etc\hosts 通用标准保护:保护网络设置已阻止的操作: 写入
2007-3-25 1:28:57 已由访问保护规则禁止 MT-16D974393A12\wynn C:\Documents and Settings\wynn\My Documents\0[1].exe C:\WINDOWS\uninstall\rundl132.exe 通用最大保护:禁止在 Windows 文件夹中创建新的可执行文件已阻止的操作: 创建
2007-3-25 1:28:59 已由访问保护规则禁止 MT-16D974393A12\wynn C:\Documents and Settings\wynn\My Documents\0[1].exe C:\WINDOWS\RichDll.dll 通用最大保护:禁止在 Windows 文件夹中创建新的可执行文件已阻止的操作: 创建
2007-3-25 1:28:59 已由访问保护规则禁止 MT-16D974393A12\wynn C:\Documents and Settings\wynn\My Documents\0[1].exe C:\WINDOWS\system32\drivers\etc\hosts 通用标准保护:保护网络设置已阻止的操作: 写入

可惜啊，全部作废了

显示全部楼层 · 发表于 2007-3-25 16:34:13

咖啡miss一個

McAfee 已自動封鎖並移除特洛伊病毒。

詳細資料
偵測: PWS-Gamania.dr (特洛伊病毒), PWS-Gamania.dr (特洛伊病毒)
檔案路徑: C:\Documents and Settings\all.HOME-\桌面\install[1].exe

显示全部楼层 · 发表于 2007-3-25 16:34:24

nod32运行杀掉生成物，右键扫描报一个
Scan performed at: 2007-3-25 16:34:22
Scanning Log
NOD32 version 2143 (20070325) NT
Command line: C:\Documents and Settings\EQ2\桌面\0[1].rar
Operating memory - is OK

Date: 25.3.2007 Time: 16:34:26
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\0[1].rar
C:\Documents and Settings\EQ2\桌面\0[1].rar ?RAR ?0[1].exe - Win32/Pacex.Gen virus
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 16:34:26 Total scanning time: 0 sec (00:00:00)

显示全部楼层 · 发表于 2007-3-25 16:34:51

卡巴不杀了

显示全部楼层 · 发表于 2007-3-25 16:43:43

通杀

显示全部楼层 · 发表于 2007-3-25 16:44:35

pcc
第一个报
第二个过

显示全部楼层 · 发表于 2007-3-25 16:46:14

大蜘蛛二个通杀

显示全部楼层 · 发表于 2007-3-25 16:54:16

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\install[1].rar'
C:\Documents and Settings\morgan\My Documents\
  install[1].rar
[0] Archive type: RAR
--> install[1].exe
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!
Begin scan in 'C:\Documents and Settings\morgan\My Documents\0[1].rar'
C:\Documents and Settings\morgan\My Documents\
  0[1].rar
[0] Archive type: RAR
--> 0[1].exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-3-25 17:00:16

Time Module Object Name Threat Action User Information
2007-3-25 17:00:08 IMON file http://www.bluell.cn/wow.exe Win32/Pacex.Gen virus KASPERSK-70947A\EQ2
2007-3-25 17:00:06 IMON file http://www.bluell.cn/wow.exe Win32/Pacex.Gen virus KASPERSK-70947A\EQ2
2007-3-25 16:59:58 IMON file http://www.bluell.cn/wow.exe Win32/Pacex.Gen virus KASPERSK-70947A\EQ2
2007-3-25 16:59:51 IMON file http://www.bluell.cn/wow.exe Win32/Pacex.Gen virus KASPERSK-70947A\EQ2
2007-3-25 16:59:46 IMON file http://www.bluell.cn/wow.exe Win32/Pacex.Gen virus KASPERSK-70947A\EQ2
2007-3-25 16:59:39 IMON file http://www.bluell.cn/wow.exe Win32/Pacex.Gen virus KASPERSK-70947A\EQ2
2007-3-25 16:59:33 IMON file http://www.bluell.cn/wow.exe Win32/Pacex.Gen virus KASPERSK-70947A\EQ2
2007-3-25 16:59:28 IMON file http://www.bluell.cn/wow.exe Win32/Pacex.Gen virus KASPERSK-70947A\EQ2
2007-3-25 16:59:25 IMON file http://www.bluell.cn/wow.exe Win32/Pacex.Gen virus KASPERSK-70947A\EQ2
2007-3-25 16:58:56 IMON file http://www.bluell.cn/wow.exe Win32/Pacex.Gen virus KASPERSK-70947A\EQ2

[病毒样本] 两样本~~~

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源