包(已上传)

显示全部楼层 · 发表于 2007-5-21 10:35:25

[ 本帖最后由 tonger2003 于 2007-5-21 10:41 编辑 ]

显示全部楼层 · 发表于 2007-5-21 10:37:03

哪呢?

显示全部楼层 · 发表于 2007-5-21 10:37:35

传了半天就是传不上来~~~~~

显示全部楼层 · 发表于 2007-5-21 10:38:13

是吗你用的什么杀软如果用的卡吧7 把卡7关掉传样本

显示全部楼层 · 发表于 2007-5-21 10:42:16

Kaspersky Internet Security 7.0 Beta
The requested URL http://bbs.kafan.cn/attachment.php?aid=73677 is infected with Trojan-PSW.Win32.OnLineGames.nw virus

显示全部楼层 · 发表于 2007-5-21 10:43:18

Virus: Win32:OnLineGames-SI [Trj], Win32:Small-EKC [Trj], Win32:OnLineGames-SR [Trj], Win32:Lmir-LM [Trj], Win32:OnLineGames-CP [Trj], Win32:Nilage-GB [Trj], Win32:Agent-GGO [Trj], Win32:Delf-EJU [Trj]

Virus found while downloading Web content.

Address: bbs.kafan.cn

显示全部楼层 · 发表于 2007-5-21 10:43:45

卡吧7报11个

已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.nw       文件: D:\Documents and Settings\Administrator\桌面\桌面.rar/7.exe
已隔离: 病毒 Invader (修改)       文件: D:\Documents and Settings\Administrator\桌面\桌面.rar/8.exe
已隔离: 病毒 Invader (修改)       文件: D:\Documents and Settings\Administrator\桌面\桌面.rar/9.exe//PE_Patch//UPack
已隔离: 病毒 Invader (修改)       文件: D:\Documents and Settings\Administrator\桌面\桌面.rar/0.exe
已隔离: 病毒 Invader (修改)       文件: D:\Documents and Settings\Administrator\桌面\桌面.rar/1.exe
已隔离: 病毒 Invader (修改)       文件: D:\Documents and Settings\Administrator\桌面\桌面.rar/10.exe
已隔离: 病毒 Trojan.Generic (修改)       文件: D:\Documents and Settings\Administrator\桌面\桌面.rar/11.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.WOW.qp       文件: D:\Documents and Settings\Administrator\桌面\桌面.rar/2.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.tz       文件: D:\Documents and Settings\Administrator\桌面\桌面.rar/3.exe
已删除: 病毒 Packed.Win32.NSAnti.n       文件: D:\Documents and Settings\Administrator\桌面\桌面.rar/4.exe
已隔离: 病毒 Downloader (修改)       文件: D:\Documents and Settings\Administrator\桌面\桌面.rar/6.exe

主动防御报5.exe

进程试图通过安装驱动程序获取对系统的完全访问. 从文件写入系统注册表值 D:\WINDOWS\system32\drivers\CelInDriver.sys

CreateFile D:\WINDOWS\system32\Drivers\CelInDriver.sysk
CreateRegKey \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\CelInDrv
CreateFile D:\WINDOWS\system32\Drivers\CelInDriver.sys
CreateFile D:\WINDOWS\system32\msdebug.dll
CreateFile D:\Documents and Settings\Administrator\桌面\桌面\5.dat

都报

[ 本帖最后由 kp2006 于 2007-5-21 10:49 编辑 ]

显示全部楼层 · 发表于 2007-5-21 10:45:36

Begin scan in 'C:\Documents and Settings\Administrator\桌面\桌面.rar'
C:\Documents and Settings\Administrator\桌面\桌面.rar
  [0] Archive type: RAR
  --> 7.exe
   [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> 8.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> 9.exe
   [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
  --> 0.exe
   [DETECTION] Is the Trojan horse TR/Agent.nma.1
  --> 1.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> 10.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> 11.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> 2.exe
   [DETECTION] Is the Trojan horse TR/Trenci.1
  --> 3.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> 4.exe
   [DETECTION] Is the Trojan horse TR/PCK.NSAnti.N.64
  --> 5.exe
   [DETECTION] Is the Trojan horse TR/Agent.22016.B
  --> 6.exe
   [DETECTION] Is the Trojan horse TR/Drop.QQPa.WP.1.A
   [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-5-21 11:00:36

NOD32 11个

显示全部楼层 · 发表于 2007-5-21 11:07:31

微点全杀，一个已知，其他行为

[病毒样本] 包(已上传)

本帖子中包含更多资源

avk2007

本帖子中包含更多资源

本帖子中包含更多资源