卡吧3.5报木马

显示全部楼层 · 发表于 2007-5-20 12:20:21

Starting the file scan:

Begin scan in 'F:\样本\shot.rar'
F:\样本\shot.rar
  [0] Archive type: RAR
  --> shot.exe
   [DETECTION] Contains suspicious code HEUR/Crypted
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-5-20 12:21:35

lz越用越回去。。

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\shot.rar'
C:\Documents and Settings\morgan\My Documents\
  shot.rar
[0] Archive type: RAR
--> shot.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-5-20 12:22:16

AVAST MISS

显示全部楼层 · 发表于 2007-5-20 12:26:05

谁能找到这个样本中的病毒部分？
我找不到，这个是清除病毒之后的东西。。
但是看不见病毒文件。。

显示全部楼层 · 发表于 2007-5-20 16:41:46

Scan performed at: 2007-5-20 16:41:52
Scanning Log
NOD32 version 2277 (20070518) NT
Command line: C:\Documents and Settings\EQ2\桌面\shot.rar
Operating memory - is OK

Date: 20.5.2007 Time: 16:41:56
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\shot.rar
C:\Documents and Settings\EQ2\桌面\shot.rar ?RAR ?shot.exe - a variant of Win32/TrojanDropper.Small.APR trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 16:41:56 Total scanning time: 0 sec (00:00:00)

显示全部楼层 · 发表于 2007-5-20 16:50:54

已删除: 木马程序 Trojan-Dropper.Win32.Small.apr 文件: C:\Documents and Settings\Administrator\桌面\shot.rar/shot.exe//PE_Patch.MaskPE
这一局avast！失守，卡巴胜kis621宰了

显示全部楼层 · 发表于 2007-5-20 18:05:48

3.5？这还是多少年前的版本呀？这想证明什么？

显示全部楼层 · 发表于 2007-5-20 21:13:39

显示全部楼层 · 发表于 2007-5-20 23:51:51

F:\bnupdate.rar ?RAR ?bnupdate.exe<病毒 - Win32/PSW.WOW.JE 木马变种>

[病毒样本] 卡吧3.5报木马

本帖子中包含更多资源

本帖子中包含更多资源

回复 #5 mofunzone 的帖子

本帖子中包含更多资源

回复 #9 physir 的帖子