在来几个

显示全部楼层 · 发表于 2007-4-29 11:36:14

在来几个

显示全部楼层 · 发表于 2007-4-29 11:39:51

KIS621拦截：

显示全部楼层 · 发表于 2007-4-29 11:40:17

这个包好像以前发过

显示全部楼层 · 发表于 2007-4-29 11:40:33

原帖由 红心王子 于 2007-4-28 22:39 发表
KIS621拦截：

下
不运行没事

显示全部楼层 · 发表于 2007-4-29 11:52:32

对，只要不去运行病毒就没问题，况且还有主动防御呢

显示全部楼层 · 发表于 2007-4-29 11:57:44

1035.exe
是原来下的
其余
知珠没报

显示全部楼层 · 发表于 2007-4-29 12:06:43

这就是卡巴7.0启发的威力

剩下两个没报的EXE和几个DLL已经上报了

deleted: Trojan program Trojan-PSW.Win32.QQPass.wc File: C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\1.rar/1.EXE
deleted: virus Trojan.Generic (modification) File: C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\010\1035.exe
deleted: Trojan program Trojan-Downloader.Win32.Delf.bho File: C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\010\kehu0743.exe//UPack
deleted: Trojan program Trojan-Downloader.Win32.Agent.bmo File: C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\010\svchost.exe
deleted: virus Trojan.Generic (modification) File: C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\010.part1.rar/1035.exe
deleted: Trojan program Trojan-Downloader.Win32.Delf.bho File: C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\010.part1.rar/kehu0743.exe//UPack
deleted: Trojan program Trojan-Downloader.Win32.Agent.bmo File: C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\010.part1.rar/svchost.exe
deleted: adware not-a-virus:AdWare.Win32.Boran.z File: C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\010.part1.rar/gao.exe//stream//data0001//stream//data0001
deleted: Trojan program Trojan-Downloader.Win32.Adload.jm File: C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\010.part1.rar/gao.exe//stream//data0003
deleted: virus Downloader (modification) File: C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\010.part1.rar/gao.exe//stream//data0004//NSPack
deleted: adware not-a-virus:AdWare.Win32.Agent.bz File: C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\010.part1.rar/gao.exe//stream//data0005
deleted: adware not-a-virus:AdWare.Win32.Boran.z File: C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\010.part3.rar/gao.exe//stream//data0001//stream//data0001
deleted: Trojan program Trojan-Downloader.Win32.Adload.jm File: C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\010.part3.rar/gao.exe//stream//data0003
deleted: virus Downloader (modification) File: C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\010.part3.rar/gao.exe//stream//data0004//NSPack
deleted: adware not-a-virus:AdWare.Win32.Agent.bz File: C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\010.part3.rar/gao.exe//stream//data0005
deleted: adware not-a-virus:AdWare.Win32.Boran.z File: C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\010\gao.exe//stream//data0001//stream//data0001
deleted: Trojan program Trojan-Downloader.Win32.Adload.jm File: C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\010\gao.exe//stream//data0003
deleted: virus Downloader (modification) File: C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\010\gao.exe//stream//data0004//NSPack
deleted: adware not-a-virus:AdWare.Win32.Agent.bz File: C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\010\gao.exe//stream//data0005

显示全部楼层 · 发表于 2007-4-29 12:37:26

这是卡巴的回复。。。。真快啊

Hello.
No malicious software was found in the attached file.

-----------------
Regards, Yury Nesmachny
Virus Analyst, Kaspersky Lab.

Ph.: +7(495) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com http://www.viruslist.com

> Attachment: 010.rar

> password: virus

显示全部楼层 · 发表于 2007-4-29 12:56:28

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\010'
C:\Documents and Settings\morgan\My Documents\010\
  1035.exe
   [DETECTION] Contains suspicious code HEUR/Crypted
   [INFO]    The file was moved to '4667259c.qua'!
  clientStat.dll
   [DETECTION] Contains signature of the Ad- or Spyware ADSPY/ZboxDll
   [INFO]    The file was moved to '469d25d8.qua'!
  DownloadLib.dll
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    The file was moved to '46ab25db.qua'!
  gao.exe
  IssueDown.dll
   [DETECTION] Is the Trojan horse TR/Zbox.210241.C
   [INFO]    The file was moved to '46a725df.qua'!
  kehu0743.exe
   [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
   [INFO]    The file was moved to '469c25d2.qua'!
  svchost.exe
   [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
   [INFO]    The file was moved to '469725e3.qua'!
  upstate.exe
   [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
   [INFO]    The file was moved to '46a725dd.qua'!
  zbox2.exe
  zboxdll.dll

End of the scan: 2007年4月28日  21:56
Used time: 00:11 min

The scan has been done completely.

   1 Scanning directories
   10 Files were scanned
   7 viruses and/or unwanted programs were found
   2 classified as suspicious:
   0 files were deleted
   0 files were repaired
   7 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   0 Archives were scanned
   0 Warnings
   0 Notes
   0 Hidden objects were found

显示全部楼层 · 发表于 2007-4-29 12:58:06

Thank you for your submission. Below you can see the current status of the uploaded files.

We received the following archive files:File ID    Filename    Size (Byte) Result
530128    010.rar 1.54 MB OK

A listing of files contained inside archives alongside their results can be found below:File ID    Filename    Size (Byte) Result
530129    gao.exe    915.59 KB    UNDER ANALYSIS
252380    zbox2.exe    653 KB    CLEAN
252381    zboxdll.dll    64.5 KB    CLEAN

Please find a detailed report concerning each individual sample below: Filename Result
gao.exe    UNDER ANALYSIS

The file 'gao.exe' has been determined to be 'UNDER ANALYSIS'.
Filename Result
zbox2.exe    CLEAN

The file 'zbox2.exe' has been determined to be 'CLEAN'.
Filename Result
zboxdll.dll    CLEAN

The file 'zboxdll.dll' has been determined to be 'CLEAN'.

Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.

[病毒样本] 在来几个

本帖子中包含更多资源

本帖子中包含更多资源