两个小时前出炉的鸽子

troika

用记事本打开后里面有这么一句:"昨天是你的生日, 提示    远程管理软件灰鸽子服务端安装成功！"

KAO,你LP过生日就不让别人活了吗!?

[ 本帖最后由 troika 于 2007-4-3 20:48 编辑 ]

小邪邪

MCAFEE：2007-4-3        20:47:58       
已删除\rising2007\瑞星注册码生成器.exe       
BackDoor-AWQ (特洛伊)

my98948

我的avg查到了，卡巴查不到。

jlennon

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-4-1
Start time: 2007-4-3 20:50
Engine(s): KAV engine (AVK 17.3690), BD-Engine (BD 17.2421)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: 瑞星注册码生成器.exe
        In archive: C:\Documents and Settings\Administrator\桌面\rising2007.rar
        Status: Virus detected
        Virus: Generic.Graybird.5CB821B0 (BD-Engine)
Object: rising2007.rar
        Path: C:\Documents and Settings\Administrator\桌面
        Status: Move file into quarantine
        Virus: Generic.Graybird.5CB821B0 (BD-Engine)
Analysis complete: 2007-4-3 20:50
    1 files checked
    1 infected files detected
    0 suspected files detected

蓝色牛仔裤

rising2007.rar\瑞星注册码生成器.exe;C:\Documents and Settings\Administrator\桌面\rising2007.rar;BackDoor.Pigeon.672;;
rising2007.rar;C:\Documents and Settings\Administrator\桌面;Archive contains infected objects;;

solcroft

第一个动作便想在%windir%目录生成.exe文件，这只鸽子简直是自投罗网的
还有顺便问一下，LP是什么？

小邪邪

LP=老婆

promised

Scan performed at: 2007-4-3 21:03:22
Scanning Log
NOD32 version 2166 (20070403) NT
Command line: E:\rising2007.rar
Operating memory - is OK

Date: 3.4.2007  Time: 21:03:35
Anti-Stealth technology is enabled.
Scanned disks, folders and files: E:\rising2007.rar
E:\rising2007.rar ?RAR ?瑞星注册码生成器.exe - a variant of Win32/Hupigon trojan
Number of scanned files: 2
Number of threats found: 1
Number of active threats: 1
Time of completion: 21:03:38 Total scanning time: 3 sec (00:00:03)

蓝色牛仔裤

老婆的拼音, Lao Po

金剑

风暴胜者V2 测试版本(http://www.v0day.com)
_________您的安全是我们的责任_______________
载入病毒库…进行整理…分配内存…可以使用



===============================================
   ___________病毒查杀结果__________________


===============================================

2007年4月3日21时4分48秒 开始查杀C:\Documents and Settings\Administrator\桌面\新建文件夹\rising2007
C:\Documents and Settings\Administrator\桌面\新建文件夹\rising2007\瑞星注册码生成器.exe 发现未知可疑文件:Win32.NkHack.Preloc.A 操作:阻止运行
=========================================

_________文件性质分析结果________________
"带壳"仅指文件性质,仅供专业人员分析使用。


-----------------------------------------

2007年4月3日21时4分48秒收起线程…100% 查杀完毕！
扫描文件：1查杀病毒：1