来两个大家玩玩

pamier2001

对象: ~tmp9085.exe
        病毒: Worm.Win32.Viking.ff (KAV 引擎), BehavesLike:Win32.ExplorerHijack (BD 引擎)
对象: ThankYou.exe
        病毒: Worm.Win32.Viking.du (KAV 引擎), Win32.Worm.Viking.CU (BD 引擎)
桌面里面的东西

The EQs

第一个2.rar无语了。。。加了3次UPX？？？

jlennon

-----------------------------SCAN REPORT-----------------------------
F-PROT Antivirus for Windows

Antivirus Scanning Engine version number: 4.3.1
Virus signature file from: 2007-3-27, 3:05

Scan name: [Custom Scan]
Path to scan: C:\Documents and Settings\Administrator\桌面\桌面.rar|C:\Documents and Settings\Administrator\桌面\2.rar

Normal scan
Also scan: Inside subfolders, Compressed files, Streams

Scan started: 2007-3-27, 14:48:43
---------------------------------------------------------------------

[Found possible virus]         <W32/PWStealer.gen1 (not disinfectable)>        C:\Documents and Settings\Administrator\桌面\桌面.rar->ThankYou.exe
[Contains infected objects]        C:\Documents and Settings\Administrator\桌面\桌面.rar
[Quarantined]        C:\Documents and Settings\Administrator\桌面\桌面.rar->ThankYou.exe

---------------------------------------------------------------------
Scan ended:        2007-3-27, 14:48:51
Duration:        0:00:08

Scan result:

Scanned files:                 2
Infected objects:         1
Disinfected objects:         0
Quarantined files:         1
---------------------------------------------------------------------

icka

后面的病毒会感染EXE文件。

同时还是下载型病毒。 结束金山服务，

从
[url=http://down.97725.com/downma1.exe][/rl]

……

……
[url=http://down.97725.com/downma11.exe][/rl]


然后让我停止了，没再继续等

[ 本帖最后由 icka 于 2007-3-27 14:55 编辑 ]

jlennon

删了， 我怎么重复了

[ 本帖最后由 jlennon 于 2007-3-28 08:16 编辑 ]

bridgewr

第一个运行后调用arp，然后就退出了，第二个里面微点都杀

soul20010

FS7.0
Result: 2 malware found
Worm.Win32.Viking.ff (virus)
C:\Documents and Settings\&Eacute;&Ugrave;&Aacute;&Ouml;\×&Agrave;&Atilde;&aelig;\1.rar\~tmp9085.exe
Worm.Win32.Viking.du (virus)
C:\Documents and Settings\&Eacute;&Ugrave;&Aacute;&Ouml;\×&Agrave;&Atilde;&aelig;\1.rar\ThankYou.exe

gggh

卡巴不报警...