又一个新样本

显示全部楼层 · 发表于 2007-4-3 10:56:17

又一个新样本

显示全部楼层 · 发表于 2007-4-3 11:06:33

过AVK，红伞杀

显示全部楼层 · 发表于 2007-4-3 11:41:08

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\svchost.rar'
C:\Documents and Settings\morgan\My Documents\
  svchost.rar
[0] Archive type: RAR
--> svchost.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-4-3 11:42:09

File: svchost.rar
Status: INFECTED/MALWARE
MD5 bc41abf78575a3bcc9e986a5ac6981d9
Packers detected: -

Scanner results
Scan taken on 03 Apr 2007 03:40:25 (GMT)
AntiVir Found TR/Crypt.NSPM.Gen
ArcaVir Found nothing
Avast Found Win32:Tibs-ADO
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found Possibly a new variant of W32/PWStealer.gen1
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Rising Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found Trojan-PSW.Win32.Nilage.ara

显示全部楼层 · 发表于 2007-4-3 11:53:51

这个就是微点牛x 的地方
C:\WINNT\RICHDLL.DLL I:\TEST\070403\6\SVCHOST\SVCHOST.EXE
C:\WINNT\UNINSTALL\RUNDL132.EXE I:\TEST\070403\6\SVCHOST\SVCHOST.EXE

HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ LOAD C:\WINNT\UNINSTALL\RUNDL132.EXE I:\TEST\070403\6\SVCHOST\SVCHOST.EXE

显示全部楼层 · 发表于 2007-4-3 12:02:40

是过kav, bd ...过不了avast...

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-4-2
Start time: 2007-4-3 11:59
Engine(s): KAV engine (KAV 17.3704), AVAST-Engine (AVAST 17.189)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: svchost.exe
In archive: C:\Documents and Settings\Administrator\桌面\svchost.rar
Status: Virus detected
Virus: Win32:Tibs-ADO [Trj] (AVAST-Engine)
Object: svchost.rar
Path: C:\Documents and Settings\Administrator\桌面
Status: Virus detected
Virus: Win32:Tibs-ADO [Trj] (AVAST-Engine)
Analysis complete: 2007-4-3 11:59
1 files checked
1 infected files detected
0 suspected files detected

显示全部楼层 · 发表于 2007-4-3 12:04:09

beta蜘蛛比多引擎里面的正式版强哦~~

svchost.rar\svchost.exe;C:\Documents and Settings\Administrator\桌面\svchost.rar;Win32.HLLW.Gavir.54;;
svchost.rar;C:\Documents and Settings\Administrator\桌面;Archive contains infected objects;;

显示全部楼层 · 发表于 2007-4-3 12:33:46

禁止svchost.exe
防病毒标准保护:禁止伪装 Windows 进程
已阻止的操作: 创建

显示全部楼层 · 发表于 2007-4-3 12:43:33

原帖由 小邪邪 于 2007-4-3 12:33 发表
禁止svchost.exe
防病毒标准保护:禁止伪装 Windows 进程
已阻止的操作: 创建

不要不给病毒任何的机会~！

[ 本帖最后由 Nblock 于 2007-4-3 12:49 编辑 ]

显示全部楼层 · 发表于 2007-4-3 15:41:18

有时候我也会给它们一点点机会的
详细情形见:http://bbs.kafan.cn/viewthread.php?tid=62695&highlight=2007

但从防毒的角度来讲不给他们任何的机会就是最好的防护

[病毒样本] 又一个新样本

本帖子中包含更多资源

本帖子中包含更多资源

再新微点也能拦

本帖子中包含更多资源

回复 #2 cs18dch 的帖子

MCAFEE

本帖子中包含更多资源

回复 #9 Nblock 的帖子