BLOGCN新鲜样本

欠妳緈諨

NOD32杀了4个

欠妳緈諨

蜘蛛报了一大堆,删除后余2个

taihuxian

Begin scan in 'C:\Documents and Settings\user\桌面\rav.rar'
C:\Documents and Settings\user\桌面\rav.rar
  [0] Archive type: RAR
  --> rav.com
      [DETECTION] Contains suspicious code HEUR/Crypted
      [INFO]      A backup was created as '46a77b76.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!

无影一线

kv2007飘过了

jlennon

evilcat

现在已经没有什么真正意义上的“良好的上网习惯”了

allenhippo

C:\=>Master Boot Record OK
C:\=>Primary partition 1 (Active) OK
Z:\My_Documents\1[3].gif OK
Z:\My_Documents\1[3].gif=>(CAB Sfx r) OK
Z:\My_Documents\1[3].gif=>(CAB Sfx r)=>sb.exe OK
Z:\My_Documents\1[3].gif=>(CAB Sfx r)=>svchost.exe OK
Z:\My_Documents\1[3].gif=>(CAB Sfx r)=>svchost.exe=>(CAB Sfx r) OK
Z:\My_Documents\1[3].gif=>(CAB Sfx r)=>svchost.exe=>(CAB Sfx r)=>ri.exe Suspect Generic.Malware.Fdld.A0F68938
Z:\My_Documents\1[3].gif=>(CAB Sfx r)=>svchost.exe=>(CAB Sfx r)=>new.exe Infected Trojan.PWS.OnLineGames.ARI
Z:\My_Documents\DATA0000.EXE OK
Z:\My_Documents\DATA0000.EXE=>(RAR Sfx o) OK
Z:\My_Documents\DATA0000.EXE=>(RAR Sfx o)=>Packet.dll OK
Z:\My_Documents\DATA0000.EXE=>(RAR Sfx o)=>drivers\npf.sys OK
Z:\My_Documents\DATA0000.EXE=>(RAR Sfx o)=>drivers\smss.exe OK
Z:\My_Documents\DATA0000.EXE=>(RAR Sfx o)=>WanPacket.dll OK
Z:\My_Documents\DATA0000.EXE=>(RAR Sfx o)=>wpcap.dll OK
Z:\My_Documents\DATA0001.EXE OK
Z:\My_Documents\mppds.dll Infected Generic.Malware.PWS.07791E14
Z:\My_Documents\mppds.exe Infected Trojan.PWS.OnLineGames.ARI
Z:\My_Documents\new.exe Infected Trojan.PWS.OnLineGames.ARI
Z:\My_Documents\npf.sys OK
Z:\My_Documents\ri.exe Suspect Generic.Malware.Fdld.A0F68938
Z:\My_Documents\rundl32.exe OK
Z:\My_Documents\rundl32.exe=>(CAB Sfx r) OK
Z:\My_Documents\rundl32.exe=>(CAB Sfx r)=>sb.exe OK
Z:\My_Documents\rundl32.exe=>(CAB Sfx r)=>svchost.exe OK
Z:\My_Documents\rundl32.exe=>(CAB Sfx r)=>svchost.exe=>(CAB Sfx r) OK
Z:\My_Documents\rundl32.exe=>(CAB Sfx r)=>svchost.exe=>(CAB Sfx r)=>ri.exe Suspect Generic.Malware.Fdld.A0F68938
Z:\My_Documents\rundl32.exe=>(CAB Sfx r)=>svchost.exe=>(CAB Sfx r)=>new.exe Infected Trojan.PWS.OnLineGames.ARI
Z:\My_Documents\sb.exe OK
Z:\My_Documents\smss.exe OK
Z:\My_Documents\svchost.exe OK
Z:\My_Documents\svchost.exe=>(CAB Sfx r) OK
Z:\My_Documents\svchost.exe=>(CAB Sfx r)=>ri.exe Suspect Generic.Malware.Fdld.A0F68938
Z:\My_Documents\svchost.exe=>(CAB Sfx r)=>new.exe Infected Trojan.PWS.OnLineGames.ARI

dreamsfar

运行时微点提示kav.com要访问网络，目标地址是上海。不敢放行，阻止之后就没下文了。
查看日志，无程序生成，无其他进程启动，无注册表变更。

蓝色牛仔裤

beta蜘蛛也是一样, 打成平手了, 呵呵~~

fireworld

不杀 duba