[病毒样本] 2

显示全部楼层 · 发表于 2011-1-8 17:49:31

本帖最后由江湖的fans 于 2011-1-8 17:51 编辑

2

显示全部楼层 · 发表于 2011-1-8 17:56:57

mcafee清空

显示全部楼层 · 发表于 2011-1-8 17:59:06

ess kill all

显示全部楼层 · 发表于 2011-1-8 18:00:03

eset 清空
C:\Users\微亿毫\Desktop\2\dmvjsu.exe - Win32/ServStart.AD 特洛伊木马的变种 - 通过删除清除 - 已隔离
C:\Users\微亿毫\Desktop\2\dsound.dll - Win32/PSW.OnLineGames.PFZ.Gen 特洛伊木马 - 扫描完成后再选择处理方式
C:\Users\微亿毫\Desktop\2\dsound.dll.EXRP - Win32/PSW.OnLineGames.PFZ.Gen 特洛伊木马 - 扫描完成后再选择处理方式
C:\Users\微亿毫\Desktop\2\dsound.dll.NFWY - Win32/PSW.OnLineGames.PFZ.Gen 特洛伊木马 - 扫描完成后再选择处理方式
C:\Users\微亿毫\Desktop\2\dsound.dll - Win32/PSW.OnLineGames.PFZ.Gen 特洛伊木马 - 已删除 - 已隔离
C:\Users\微亿毫\Desktop\2\dsound.dll.EXRP - Win32/PSW.OnLineGames.PFZ.Gen 特洛伊木马 - 已删除 - 已隔离
C:\Users\微亿毫\Desktop\2\dsound.dll.NFWY - Win32/PSW.OnLineGames.PFZ.Gen 特洛伊木马 - 已删除 - 已隔离

显示全部楼层 · 发表于 2011-1-8 18:12:06

大蜘蛛：
dmvjsu.exe probably infected with DLOADER.Trojan
dsound.dll infected with Trojan.Starter.1572
dsound.dll.EXRP infected with Trojan.Starter.1572
dsound.dll.NFWY infected with Trojan.Starter.1572

显示全部楼层 · 发表于 2011-1-8 18:49:38

KIS
检测到威胁: HEUR:Trojan.Win32.Generic E:\download\2\dmvjsu.exe
检测到威胁: Trojan.Win32.Patched.ja E:\download\2\dsound.dll.NFWY
检测到威胁: Trojan.Win32.Patched.ja E:\download\2\dsound.dll.EXRP
检测到威胁: Trojan.Win32.Patched.ja E:\download\2\dsound.dll

显示全部楼层 · 发表于 2011-1-8 18:52:01

比特梵德

显示全部楼层 · 发表于 2011-1-8 19:09:58

dmvjsu：
2011-1-8 19:08:41 创建文件阻止
进程: c:\documents and settings\administrator\桌面\2\dmvjsu.exe
目标: C:\WINDOWS\system32\tkjxgg.exe
规则: [文件组]文件安全读写规则(阻止创建、修改) -> [文件]c:\windows\*; *.exe

2011-1-8 19:08:41 创建文件阻止
进程: c:\documents and settings\administrator\桌面\2\dmvjsu.exe
目标: C:\WINDOWS\system32\tkjxgg.exe
规则: [文件组]文件安全读写规则(阻止创建、修改) -> [文件]c:\windows\*; *.exe

2011-1-8 19:08:41 创建文件阻止
进程: c:\documents and settings\administrator\桌面\2\dmvjsu.exe
目标: C:\WINDOWS\system32\tkjxgg.exe
规则: [文件组]文件安全读写规则(阻止创建、修改) -> [文件]c:\windows\*; *.exe

2011-1-8 19:08:41 创建新进程阻止并结束进程
进程: c:\documents and settings\administrator\桌面\2\dmvjsu.exe
目标: c:\windows\system32\cmd.exe
命令行: C:\WINDOWS\system32\cmd.exe /c del C:\DOCUME~1\ADMINI~1\桌面\2\dmvjsu.exe > nul
规则: [应用程序组]所有程序规则-系统程序执行规则 -> [应用程序]* -> [子应用程序]c:\windows\system32\cmd.exe

显示全部楼层 · 发表于 2011-1-8 19:25:35

panda killed

显示全部楼层 · 发表于 2011-1-8 19:44:12

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Tim\桌面\test\2.rar'
C:\Documents and Settings\Tim\桌面\test\2.rar
[0] Archive type: RAR
  [DETECTION] Contains recognition pattern of the WORM/Rbot.Gen worm
--> dmvjsu.exe
  [DETECTION] Contains recognition pattern of the WORM/Rbot.Gen worm
--> dsound.dll
  [DETECTION] Is the TR/Patched.371200 Trojan
--> dsound.dll.EXRP
  [DETECTION] Is the TR/Patched.371200 Trojan
--> dsound.dll.NFWY
  [DETECTION] Is the TR/Patched.371200 Trojan
[NOTE]    A backup was created as '46f9ecb6.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

End of the scan: Saturday, 8 January, 2011  19:42
Used time: 01:33 Minute(s)

The scan has been done completely.

   0 Scanned directories
   5 Files were scanned
   4 Viruses and/or unwanted programs were found
   0 Files were classified as suspicious
   1 files were deleted
   0 Viruses and unwanted programs were repaired
   1 Files were moved to quarantine
   0 Files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   0 Warnings
   1 Notes

[病毒样本] 2

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块