样本~~

显示全部楼层 · 发表于 2007-4-2 21:59:45

nod32 found nothing

显示全部楼层 · 发表于 2007-4-2 22:27:58

威金？

另外修改hosts

显示全部楼层 · 发表于 2007-4-2 22:30:08

mcafee：2007-4-2 22:34:48
已由访问保护规则禁止WinRAR.exe释放svchost.exe
防病毒标准保护:禁止伪装 Windows 进程
已阻止的操作: 创建

显示全部楼层 · 发表于 2007-4-2 22:33:27

启发式和主动防御的差别

显示全部楼层 · 发表于 2007-4-2 22:53:56

除了一个运行出错的红X提示框,再也没什么了.加壳加坏了吧?

显示全部楼层 · 发表于 2007-4-2 22:56:49

可怜的ie 我切

显示全部楼层 · 发表于 2007-4-2 23:01:31

-----------------------------SCAN REPORT-----------------------------
F-PROT Antivirus for Windows

Antivirus Scanning Engine version number: 4.3.1
Virus signature file from: 2007-3-30, 6:08

Scan name: [Custom Scan]
Path to scan: C:\Documents and Settings\Administrator\桌面\svchost.rar

Normal scan
Also scan: Inside subfolders, Compressed files, Streams

Scan started: 2007-4-2, 23:00:36
---------------------------------------------------------------------

[Found possible virus] <W32/PWStealer.gen1 (not disinfectable)> C:\Documents and Settings\Administrator\桌面\svchost.rar->svchost.exe
[Contains infected objects] C:\Documents and Settings\Administrator\桌面\svchost.rar
[Quarantined] C:\Documents and Settings\Administrator\桌面\svchost.rar->svchost.exe

---------------------------------------------------------------------
Scan ended: 2007-4-2, 23:00:38
Duration: 0:00:02

Scan result:

Scanned files:    1
Infected objects:    1
Disinfected objects:    0
Quarantined files:    1
---------------------------------------------------------------------

显示全部楼层 · 发表于 2007-4-2 23:01:58

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\svchost.rar'
C:\Documents and Settings\morgan\My Documents\
  svchost.rar
[0] Archive type: RAR
--> svchost.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-4-2 23:12:14

怎么我运行就没生成文件,难道认识虚拟机?

[病毒样本] 样本~~

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

回复 #7 Nblock 的帖子