5个样本,beta蜘蛛全灭...

显示全部楼层 · 发表于 2007-4-5 14:14:12

RT.. 5个样本全杀...论坛怎么这么不稳定啊, 刚才又断了....上课去了~~

Temp.rar\Temp\mhso.exe;C:\Documents and Settings\Administrator\桌面\Temp.rar;Trojan.PWS.Wsgame;;
Temp.rar\Temp\mhso0.dll;C:\Documents and Settings\Administrator\桌面\Temp.rar;Trojan.PWS.Wsgame;;
Temp.rar\Temp\wgs0.dll;C:\Documents and Settings\Administrator\桌面\Temp.rar;Trojan.PWS.Wsgame;;
Temp.rar\Temp\wgs1.dll;C:\Documents and Settings\Administrator\桌面\Temp.rar;Trojan.PWS.Wsgame;;
Temp.rar\Temp\yqr.exe;C:\Documents and Settings\Administrator\桌面\Temp.rar;Trojan.PWS.Poptang;;
Temp.rar;C:\Documents and Settings\Administrator\桌面;Archive contains infected objects;;

显示全部楼层 · 发表于 2007-4-5 14:14:52

偶也快要上课了。。。。

显示全部楼层 · 发表于 2007-4-5 14:15:15

nod32还是found nothing

显示全部楼层 · 发表于 2007-4-5 14:18:28

TrendMicro PC-cillin 2007.............OK

显示全部楼层 · 发表于 2007-4-5 14:20:28

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\Temp.rar'
C:\Documents and Settings\morgan\My Documents\
  Temp.rar
[0] Archive type: RAR
--> Temp\mhso.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> Temp\mhso0.dll
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> Temp\wgs0.dll
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> Temp\wgs1.dll
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> Temp\yqr.exe
      [DETECTION] Is the Trojan horse TR/Agent.ahi.11
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-4-5 14:28:42

木马名称:Trojan-PSW.Win32.GamePass.wt
程序:
E:\SOFT_KILLER\TEMP\TEMP\MHSO.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan.Win32.Agent.env
程序:
E:\SOFT_KILLER\TEMP\TEMP\YQR.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2007-4-5 15:21:30

KAV发现两只

显示全部楼层 · 发表于 2007-4-5 15:24:16

风暴胜者V2 测试版本(http://www.v0day.com)
_________您的安全是我们的责任_______________
载入病毒库…进行整理…分配内存…可以使用

===============================================
___________病毒查杀结果__________________

===============================================

2007年4月5日15时24分10秒开始查杀C:\Documents and Settings\Administrator\桌面\新建文件夹\Tem88p
C:\Documents and Settings\Administrator\桌面\新建文件夹\Tem88p\Temp\mhso.exe 发现未知可疑文件:Win32.Nop ic7yd4 操作:阻止运行
C:\Documents and Settings\Administrator\桌面\新建文件夹\Tem88p\Temp\mhso0.dll 发现未知可疑文件:Win32.Nop 69mw47z 操作:阻止运行
C:\Documents and Settings\Administrator\桌面\新建文件夹\Tem88p\Temp\wgs0.dll 发现未知可疑文件:Win32.Nop 9mmx 操作:阻止运行
C:\Documents and Settings\Administrator\桌面\新建文件夹\Tem88p\Temp\wgs1.dll 发现未知可疑文件:Win32.Nop 9mmx 操作:阻止运行
=========================================

_________文件性质分析结果________________
"带壳"仅指文件性质,仅供专业人员分析使用。

C:\Documents and Settings\Administrator\桌面\新建文件夹\Tem88p\Temp\mhso.exe 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\新建文件夹\Tem88p\Temp\mhso0.dll 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\新建文件夹\Tem88p\Temp\wgs0.dll 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\新建文件夹\Tem88p\Temp\wgs1.dll 带壳文件:UPX加壳
-----------------------------------------

2007年4月5日15时24分11秒收起线程…100% 查杀完毕！
扫描文件：5查杀病毒：4

显示全部楼层 · 发表于 2007-4-5 15:54:55

红伞全灭了

Starting the file scan:

Begin scan in 'C:\Documents and Settings\FEAR\My Documents\Temp.rar'
C:\Documents and Settings\FEAR\My Documents\Temp.rar
  [0] Archive type: RAR
  --> Temp\mhso.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> Temp\mhso0.dll
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> Temp\wgs0.dll
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> Temp\wgs1.dll
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> Temp\yqr.exe
   [DETECTION] Is the Trojan horse TR/Agent.ahi.11
   [INFO]    The file was moved to '4681aba6.qua'!

显示全部楼层 · 发表于 2007-4-5 17:26:41

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-4-4
Start time: 2007-4-5 17:26
Engine(s): KAV engine (AVK 17.3765), BD-Engine (BD 17.2421)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: Temp mhso0.dll
In archive: C:\Documents and Settings\Administrator\桌面\Temp.rar
Status: Virus detected
Virus: Trojan-PSW.Win32.Nilage.ara (KAV engine)
Object: Temp yqr.exe
In archive: C:\Documents and Settings\Administrator\桌面\Temp.rar
Status: Virus detected
Virus: Trojan.Win32.Agent.ahi (KAV engine)
Object: Temp\yqr.exe
In archive: C:\Documents and Settings\Administrator\桌面\Temp.rar
Status: Virus detected
Virus: Trojan.Agent.AHI (BD-Engine)
Object: Temp.rar
Path: C:\Documents and Settings\Administrator\桌面
Status: Move file into quarantine
Virus: Trojan-PSW.Win32.Nilage.ara, Trojan.Win32.Agent.ahi (KAV engine), Trojan.Agent.AHI (BD-Engine)
Analysis complete: 2007-4-5 17:26
1 files checked
1 infected files detected
0 suspected files detected

[病毒样本] 5个样本,beta蜘蛛全灭...

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源