rootkit

显示全部楼层 · 发表于 2007-4-1 11:31:12

Scan performed at: 2007-4-1 11:30:09
Scanning Log
NOD32 version 2160 (20070331) NT
Command line: C:\Documents and Settings\EQ2\桌面\soundwav_1173317664
Operating memory - is OK
Date: 1.4.2007 Time: 11:30:14
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\soundwav_1173317664\
C:\Documents and Settings\EQ2\桌面\soundwav_1173317664\soundwav.sys - Win32/Rootkit.Agent.DK trojan - quarantined - unable to clean - deleted
Number of scanned files: 1
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 11:30:14 Total scanning time: 0 sec (00:00:00)

显示全部楼层 · 发表于 2007-4-1 11:32:35

驱逐舰没反应

显示全部楼层 · 发表于 2007-4-1 11:45:30

黑黑黑，报了。

显示全部楼层 · 发表于 2007-4-1 11:53:23

扫描报告
2007年4月1日 11:53:08 - 11:53:10
计算机名称: 0553A719C5644CE
扫描类型: 扫描目标
目标: C:\Documents and Settings\Administrator\桌面\soundwav_1173317664.rar

--------------------------------------------------------------------------------

结果: 发现 1 恶意软件
Rootkit.Win32.Agent.dk (病毒)
C:\Documents and Settings\Administrator\桌面\soundwav_1173317664.rar\soundwav_1173317664\soundwav.sys

--------------------------------------------------------------------------------

统计信息
已扫描:
文件: 2
尚未扫描: 0
结果:
病毒: 1
间谍软件: 0
可疑项目: 0
危险软件: 0
操作:
已杀毒: 0
已重命名: 0
已删除邮件: 0
已隔离: 0
失败: 0
启动扇区:
已扫描: 0
已感染: 0
可疑项目: 0
已杀毒: 0

--------------------------------------------------------------------------------

选项
定义版本:
病毒: 2007-03-31_02
间谍软件: 2007-03-31_02
扫描引擎:
F-Secure AVP: 7.00.171, 2007-03-31
F-Secure Libra: 2.04.01, 2007-03-30
F-Secure Orion: 1.02.37, 2007-03-30
F-Secure Draco: 1.00.35, 2007-03-26
扫描选项:
扫描定义的文件: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ANI AVB BAT CEO CMD LSP MAP MHT MIF PHP POT WMF NWS TAR TGZ ZIP JAR ARJ LZH TAR TGZ GZ CAB RAR BZ2 HQX
扫描内部存档
操作:
病毒: 扫描后询问
间谍软件: 扫描后询问

--------------------------------------------------------------------------------

版权 © 1998-2007 产品支持 | 发送病毒样本到 F-Secure

显示全部楼层 · 发表于 2007-4-1 11:55:20

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-3-25
Start time: 2007-4-1 11:55
Engine(s): KAV engine (AVK 17.3527), BD-Engine (BD 17.2421)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: soundwav_1173317664 soundwav.sys
In archive: C:\Documents and Settings\Administrator\桌面\soundwav_1173317664.rar
Status: Virus detected
Virus: Rootkit.Win32.Agent.dk (KAV engine)
Object: soundwav_1173317664\soundwav.sys
In archive: C:\Documents and Settings\Administrator\桌面\soundwav_1173317664.rar
Status: Virus detected
Virus: Trojan.Rootkit.Agent.DK (BD-Engine)
Object: soundwav_1173317664.rar
Path: C:\Documents and Settings\Administrator\桌面
Status: Move file into quarantine
Virus: Rootkit.Win32.Agent.dk (KAV engine), Trojan.Rootkit.Agent.DK (BD-Engine)
Analysis complete: 2007-4-1 11:55
1 files checked
1 infected files detected
0 suspected files detected

显示全部楼层 · 发表于 2007-4-1 12:08:48

红伞干掉了！

显示全部楼层 · 发表于 2007-4-1 12:13:17

2007-4-1 12:18:32
已删除E:\Downloads\soundwav_1173317664\soundwav_1173317664\soundwav.sys
ProcKill-EA (特洛伊)

显示全部楼层 · 发表于 2007-4-1 12:15:05

McAfee 已自動封鎖並移除特洛伊病毒。

詳細資料
偵測: ProcKill-EA (特洛伊病毒), ProcKill-EA (特洛伊病毒)
檔案路徑: C:\Documents and Settings\all.HOME-\桌面\soundwav_1173317664\soundwav.sys

显示全部楼层 · 发表于 2007-4-1 12:18:47

咖啡8.5
D:\Program Files\WinRAR\WinRAR.exe G:\样本\soundwav_1173317664\soundwav.sys ProcKill-EA (特洛伊)

显示全部楼层 · 发表于 2007-4-1 12:19:00

2007-4-1 12:17:14 Safe'n'Sec Scan report

2007-4-1 12:17:14 Scan start time: 2007-4-1 12:17:14

2007-4-1 12:17:14 Action applied to detected malware:
2007-4-1 12:17:14 Scan level: Full

2007-4-1 12:17:18 D:\soundwav_1173317664.rar Infected Trojan.Win32.Rootkit.Agent.DK Moved to quarantine
2007-4-1 12:17:18 Scan area:

2007-4-1 12:17:18 D:\soundwav_1173317664.rar
2007-4-1 12:17:18
2007-4-1 12:17:18 Objects scanned: 1
2007-4-1 12:17:18 Malicious objects detected: 1
2007-4-1 12:17:18 Malicious objects deleted / removed: 1

2007-4-1 12:17:18 Scan completion time: 2007-4-1 12:17:18

[病毒样本] rootkit

本帖子中包含更多资源

本帖子中包含更多资源

MCAFEE