可能.part01.

显示全部楼层 · 发表于 2007-4-21 20:57:25

可能.part01.

显示全部楼层 · 发表于 2007-4-21 21:01:29

原帖由 qqq000@qq.com 于 2007-4-21 20:57 发表
可能.part01.

...太多了

显示全部楼层 · 发表于 2007-4-21 21:02:31

*.exe.rar
不是rar

显示全部楼层 · 发表于 2007-4-21 21:03:13

都是大蜘蛛(Dr.Web)不收的

显示全部楼层 · 发表于 2007-4-21 22:01:10

开着微点解压缩后，剩21个扣掉dll加sys8个，其他的等会上测试结果

显示全部楼层 · 发表于 2007-4-21 22:07:47

那么多只有3个可以运行

显示全部楼层 · 发表于 2007-4-22 02:47:40

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\��'
C:\Documents and Settings\morgan\My Documents\��\可能\
  00.exe
   [DETECTION] Is the Trojan horse TR/PSW.QQPass.RE.29
   [INFO]    The file was deleted!
  43.exe
   [DETECTION] Is the Trojan horse TR/SPY.Age.411182.A
   [INFO]    The file was deleted!
  57296.sys
   [DETECTION] Is the Trojan horse TR/Rootkit.GDT
   [INFO]    The file was deleted!
  adx.exe
   [DETECTION] Contains signature of the Ad- or Spyware ADSPY/Agent.28672.B
   [INFO]    The file was deleted!
  barsetup.exe-
   [DETECTION] Is the Trojan horse TR/Dldr.QQhelpe.C.1
   [INFO]    The file was deleted!
  ee.exe-
   [DETECTION] Contains signature of the dropper DR/Hijack.Expl.1875
   [INFO]    The file was deleted!
  ialmkchw.sys
  ialmsbw.sys
  ncio.sys
   [DETECTION] Is the Trojan horse TR/Rootkit.Gen
   [INFO]    The file was deleted!
  ncph.ehuupdate.exe
   [DETECTION] Contains signature of the dropper DR/Agent.UT.4.A
   [INFO]    The file was deleted!
  pif.exe-灰鸽子
  QKiller.exe
   [DETECTION] Contains signature of the worm WORM/Agobot.ahi
   [INFO]    The file was deleted!
  QKiller.rar
[0] Archive type: RAR
--> QKiller.exe
      [DETECTION] Contains signature of the worm WORM/Agobot.ahi
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    The file was deleted!
  rsm.exe
  svchost[1].exe-
   [DETECTION] Is the Trojan horse TR/Dldr.VB.agz.1
   [INFO]    The file was deleted!
  upx.exe
  windowss.exe
   [DETECTION] Is the Trojan horse TR/Dldr.EJ
   [INFO]    The file was deleted!
  zaq3.exe-
   [DETECTION] Is the Trojan horse TR/Drop.Agent.GM.3
   [INFO]    The file was deleted!
  关机木马.exe
   [DETECTION] Is the Trojan horse TR/Shutdowner.K
   [INFO]    The file was deleted!
  鸽子.exe
   [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Bifrose.KT.280 Backdoor server programs
   [INFO]    The file was deleted!
C:\Documents and Settings\morgan\My Documents\��\可能\可能是[Trojan-PSW.Win32.OnLineGames.hu]\
  1.exe(1)_
   [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.1
   [INFO]    The file was deleted!
  12.exe(1)_
   [DETECTION] Is the Trojan horse TR/Proxy.Delf.CA
   [INFO]    The file was deleted!
  daemon_mgm.exe.rar
  ghook.dll
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    The file was moved to '46995cb1.qua'!
  logo_1.exe.rar
   [DETECTION] Is the Trojan horse TR/Agent.15620
   [INFO]    The file was deleted!
  mciwace.drv
  netmoninstaller.exe.rar
  npf_mgm.exe(1)_
  packet.dll
  pthreadvc.dll
  rpcapd.exe(1)_
  svchost.exe.rar
   [DETECTION] Is the Trojan horse TR/PSW.Onlinegames.EU.4
   [INFO]    The file was deleted!
  wanpacket.dll
  wpcap.dll

End of the scan: 2007年4月21日  11:47
Used time: 00:13 min

The scan has been done completely.

   3 Scanning directories
   35 Files were scanned
   20 viruses and/or unwanted programs were found
   1 classified as suspicious:
   19 files were deleted
   0 files were repaired
   1 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   14 Files not concerned
   1 Archives were scanned
   1 Warnings
   0 Notes
   0 Hidden objects were found

显示全部楼层 · 发表于 2007-4-22 03:18:08

晕四了，发那么多一次，我用HIPS怎么跑啊

会累死我滴

显示全部楼层 · 发表于 2007-4-22 07:49:50

风暴胜者V2 测试版本(http://www.v0day.com)
_________您的安全是我们的责任_______________
载入病毒库…进行整理…分配内存…可以使用

===============================================
___________病毒查杀结果__________________

===============================================

2007年4月22日7时49分34秒开始查杀C:\Documents and Settings\Administrator\桌面\新建文件夹\可能\可能
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\可能\可能\ncph.ehuupdate.exe
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\新建文件夹\可能\可能\ncph.ehuupdate.exe 操作:阻止运行
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\可能\可能\adx.exe
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\可能\可能\鸽子.exe
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\新建文件夹\可能\可能\鸽子.exe 操作:阻止运行
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\可能\可能\windowss.exe
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\新建文件夹\可能\可能\windowss.exe 操作:阻止运行
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\可能\可能\关机木马.exe
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\可能\可能\barsetup.exe
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\可能\可能\pif.exe
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\可能\可能\zaq3.exe
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\新建文件夹\可能\可能\zaq3.exe 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\新建文件夹\可能\可能\可能是[Trojan-PSW.Win32.OnLineGames.hu]\12.exe(1)_ 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\新建文件夹\可能\可能\可能是[Trojan-PSW.Win32.OnLineGames.hu]\1.exe(1)_ 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\新建文件夹\可能\可能\可能是[Trojan-PSW.Win32.OnLineGames.hu]\logo_1.exe 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\新建文件夹\可能\可能\可能是[Trojan-PSW.Win32.OnLineGames.hu]\svchost.exe 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\新建文件夹\可能\可能\可能是[Trojan-PSW.Win32.OnLineGames.hu]\ghook.dll 操作:阻止运行
=========================================

_________文件性质分析结果________________
"带壳"仅指文件性质,仅供专业人员分析使用。

-----------------------------------------

2007年4月22日7时49分43秒收起线程…100% 查杀完毕！
扫描文件：22查杀病毒：17

[病毒样本] 可能.part01.

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源