瑞星报，NOD32挂

显示全部楼层 · 发表于 2007-4-2 20:56:36

卡巴不报警...

显示全部楼层 · 发表于 2007-4-2 21:21:04

这个毒好象是坏了,做工真烂.最后一步BAT没完成,出错推出了
rundll32.exe setupapi,InstallHinfSection DefaultInstall 128 %CD%\_wpcap_.inf
del _wpcap_.inf
copy npf.sys %SYSTEMROOT%\system32\drivers\
del npf.sys
del %0

显示全部楼层 · 发表于 2007-4-2 21:41:34

张飞杀岳飞~~~

显示全部楼层 · 发表于 2007-4-2 23:09:23

-----------------------------SCAN REPORT-----------------------------
F-PROT Antivirus for Windows

Antivirus Scanning Engine version number: 4.3.1
Virus signature file from: 2007-3-30, 6:08

Scan name: [Custom Scan]
Path to scan: C:\Documents and Settings\Administrator\桌面\qqwb.zip

Normal scan
Also scan: Inside subfolders, Compressed files, Streams

Scan started: 2007-4-2, 23:08:46
---------------------------------------------------------------------

[Found possible virus] <W32/PWStealer.gen1 (not disinfectable)> C:\Documents and Settings\Administrator\桌面\qqwb.zip->qqwb.exe
[Contains infected objects] C:\Documents and Settings\Administrator\桌面\qqwb.zip
[Quarantined] C:\Documents and Settings\Administrator\桌面\qqwb.zip->qqwb.exe

---------------------------------------------------------------------
Scan ended: 2007-4-2, 23:09:14
Duration: 0:00:28

Scan result:

Scanned files:    1
Infected objects:    1
Disinfected objects:    0
Quarantined files:    1
---------------------------------------------------------------------

显示全部楼层 · 发表于 2007-4-2 23:56:14

拦截了

显示全部楼层 · 发表于 2007-4-2 23:58:14

trojan.psw.poptang dr.web found it !

显示全部楼层 · 发表于 2007-4-3 01:08:49

avast报

显示全部楼层 · 发表于 2007-4-3 16:22:37

Starting the file scan:

Begin scan in 'C:\Documents and Settings\zxb\桌面\qqwb.zip'
C:\Documents and Settings\zxb\桌面\qqwb.zip
  [0] Archive type: ZIP
  --> qqwb.exe
   [DETECTION] Is the Trojan horse TR/Drop.Evial.1
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-4-3 16:37:46

没有解压，直接扫描的压缩包，江民没报

[病毒样本] 瑞星报，NOD32挂

本帖子中包含更多资源

本帖子中包含更多资源