keygen.exe，tdss。

显示全部楼层 · 发表于 2011-1-10 10:38:08

本帖最后由 byxxdrls 于 2011-1-10 10:47 编辑

回复 1楼 salmon5 的帖子

建议在PE下修复MBR，否则可能修复无效。

卡巴的TDSS专杀真给力，记得以前是不能修复的，现在这个可以在中毒系统中修复了。

http://www.kaspersky.com/downloads/utils/tdsskiller.zip

显示全部楼层 · 发表于 2011-1-10 11:28:02

Start of the scan: Monday, 10 January, 2011  11:23

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Tim\桌面\test\keygen'
C:\Documents and Settings\Tim\桌面\test\keygen\keygen.exe
[DETECTION] Is the TR/Crypt.XPACK.Gen3 Trojan
[NOTE]    A backup was created as '46c0d237.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

End of the scan: Monday, 10 January, 2011  11:26
Used time: 02:45 Minute(s)

The scan has been done completely.

   1 Scanned directories
   1 Files were scanned
   1 Viruses and/or unwanted programs were found
   0 Files were classified as suspicious
   1 files were deleted
   0 Viruses and unwanted programs were repaired
   1 Files were moved to quarantine
   0 Files were renamed
   0 Files cannot be scanned
   0 Files not concerned
   0 Archives were scanned
   0 Warnings
   1 Notes

显示全部楼层 · 发表于 2011-1-10 11:43:50

SK云少发表于 2011-1-10 10:01
mse kill

过mse，不管右键还是运行，mse都没反应

显示全部楼层 · 发表于 2011-1-10 11:59:36

微点杀毒miss

显示全部楼层 · 发表于 2011-1-10 12:15:30

小A 5.1 不给下载。。秒杀[:26:]

显示全部楼层 · 发表于 2011-1-10 13:17:10

本帖最后由 salmon5 于 2011-1-10 13:27 编辑

回复 10楼 byxxdrls 的帖子

不好意思，来晚了。
tdsskiller确实好用，我虚拟机上测试了下，可以把这个tdss清理干净。
物理机上我之前fdisk /mbr和第62扇区winhex全部填0过，tdsskiller没检查出异常。
现在启动gmer,xuetr,RkUnhooker检查下也都正常了。
tdss运行后第63扇区确实不能用winhex复制出来，我复制出0-200扇区，
搜索应该在63扇区的ntfs标志EB5290，没有，估计tdss做了保护机制。

显示全部楼层 · 发表于 2011-1-10 13:28:38

"";"C:\Users\Administrator\Downloads\keygen.zip:\keygen.exe";"特洛伊木马 Generic20.BPWI";"已移至病毒库"

显示全部楼层 · 发表于 2011-1-10 13:58:32

panda 启发

显示全部楼层 · 发表于 2011-1-10 14:32:06

to comodo

显示全部楼层 · 发表于 2011-1-10 14:50:12

BitDefender

[病毒样本] keygen.exe，tdss。

本帖子中包含更多资源

浏览过的版块