两个可疑木马样本，费尔未报

显示全部楼层 · 发表于 2007-5-23 16:31:03

发现有可疑木马

显示全部楼层 · 发表于 2007-5-23 16:33:02

detected: Trojan program Trojan-Downloader.Win32.LoadAdv.gen File: C:\Documents and Settings\Owner\×ÀÃæ\001.rar/001.exe//PE_Patch.UPX//UPX
detected: adware not-a-virus:AdWare.Win32.Virtumonde.bq File: C:\Documents and Settings\Owner\×ÀÃæ\002.rar/002.exe

显示全部楼层 · 发表于 2007-5-23 16:34:33

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\002.rar'
C:\Documents and Settings\morgan\My Documents\
  002.rar
[0] Archive type: RAR
--> ClipBoard.jpg
--> 002.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!
Begin scan in 'C:\Documents and Settings\morgan\My Documents\001.rar'
C:\Documents and Settings\morgan\My Documents\
  001.rar
[0] Archive type: RAR
--> 001.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> ClipBoard.jpg
      [WARNING] The file was ignored!

扫描日志
NOD32版本 2285 (20070522) NT
命令行： C:\Documents and Settings\morgan\My Documents\ ?
?001.rar C:\Documents and Settings\morgan\My Documents\ ?
?002.rar
正在检查NOD32.EXE文件的CRC：状态正常
D:\Eset\nod32.exe - 是正常的
扫描系统内存中：没有进行 (选项已关闭)
扫描MBR及引导区中：没有进行 (选项已关闭)
日期： 23.5.2007  时间：01:34:02
已关闭反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\ ?
?morgan\My Documents\001.rar; C:\Documents and Settings\ ?
?morgan\My Documents\002.rar
C:\Documents and Settings\morgan\My Documents\001.rar  ?
?>>RAR >>001.exe - Win32/TrojanDownloader.Small.NUS 木马
C:\Documents and Settings\morgan\My Documents\001.rar  ?
?>>RAR >>ClipBoard.jpg - 是正常的
C:\Documents and Settings\morgan\My Documents\002.rar  ?
?>>RAR >>ClipBoard.jpg - 是正常的
C:\Documents and Settings\morgan\My Documents\002.rar  ?
?>>RAR >>002.exe - 是正常的
已扫描的文件数目：5
已发现的病毒数目：1
活动的病毒数目：1
完成时间： 01:34:03 总扫描时间：1 秒 (00:00:01)

[Scan path] C:\Documents and Settings\morgan\My Documents\002.rar
>C:\Documents and Settings\morgan\My Documents\002.rar\ClipBoard.jpg - Ok
>C:\Documents and Settings\morgan\My Documents\002.rar\002.exe - Ok
C:\Documents and Settings\morgan\My Documents\002.rar - Ok

[Scan path] C:\Documents and Settings\morgan\My Documents\001.rar
>>C:\Documents and Settings\morgan\My Documents\001.rar\001.exe infected with Trojan.DownLoader.22411
>C:\Documents and Settings\morgan\My Documents\001.rar\ClipBoard.jpg - Ok
C:\Documents and Settings\morgan\My Documents\001.rar - archive contains infected objects

显示全部楼层 · 发表于 2007-5-23 16:34:48

那么说002可能只是个广告程序了。不过还是要杀杀杀

显示全部楼层 · 发表于 2007-5-23 16:36:34

KV 华丽地飘过

显示全部楼层 · 发表于 2007-5-23 16:53:32

显示全部楼层 · 发表于 2007-5-23 17:03:02

卡巴报2个

显示全部楼层 · 发表于 2007-5-23 17:18:28

铁克第一个报...第2个未报...上报中谢谢分享

显示全部楼层 · 发表于 2007-5-23 23:05:27

deleted: Trojan program Trojan-Downloader.Win32.LoadAdv.gen File: C:\Documents and Settings\huaxun\桌面\001.rar\001.exe/PE_Patch.UPX/UPX
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.bq File: C:\Documents and Settings\huaxun\桌面\002.rar\002.exe

显示全部楼层 · 发表于 2007-5-23 23:08:04

趋势杀一个

[病毒样本] 两个可疑木马样本，费尔未报

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源