一个~~

显示全部楼层 · 发表于 2007-5-26 21:59:02

Starting the file scan:

Begin scan in 'F:\样本\expseny.rar'
F:\样本\expseny.rar
  [0] Archive type: RAR
  --> expseny.exe
   [DETECTION] Contains suspicious code HEUR/Crypted
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-5-26 22:10:06

NOD32继续FOUND NOTHING!

显示全部楼层 · 发表于 2007-5-26 22:14:20

2007-05-26 22:12:36 创建文件
操作:阻止
进程路径:D:\expseny\expseny.exe
文件路径:C:\Documents and Settings\promised_2\Local Settings\Temp\jwsc.dll
规则:所有程序规则->全局设置_可执行文件1_普通模式->%SystemDrive%\*.dll
2007-05-26 22:12:48 底层磁盘操作
操作:阻止
进程路径:D:\expseny\expseny.exe

规则:所有程序规则->*
2007-05-26 22:12:50 底层磁盘操作
操作:阻止
进程路径:D:\expseny\expseny.exe

规则:所有程序规则->*
2007-05-26 22:12:51 运行应用程序
操作:阻止
进程路径:D:\expseny\expseny.exe
文件路径:C:\WINDOWS\system32\cmd.exe
规则:所有程序规则->系统程序->%windir%\system32\cmd.exe
还有一些就不贴出来了

显示全部楼层 · 发表于 2007-5-26 22:15:34

显示全部楼层 · 发表于 2007-5-26 22:15:37

?          Copyright (c) 1993-2007 by VBA Ltd.          ?
酝屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯?
License expired
License #000000119 Valid till 2006-12-31
Demo mode
Command line options:
/r=susp.rpt /ha=3 /collect_suspects /nc /af+ /ar+ /bt- /mr- /ml+ /rw+ /as-
Ctrl-C will terminate program execution

*:
C:\
C:\ABC\桌面.rar:<RAR>\expseny.exe : infected MalwareScope.Worm.Viking.3
Program execution terminated by user

Directories    : 3    Files in archives:    Files on disks:
Archives:                - total    : 1    - total    : 14
- scanned       : 1    -  scanned : 1    - scanned    : 14
- contain viruses : 1    -  infected : 1    - infected : 1
- deleted       : 0    -  suspicious : 0    - suspicious  : 0

Startup : 22:15:03 26-05-2007
End       : 22:15:07 26-05-2007
Total time : 00:00:04
终止批处理操作吗(Y/N)?
VBA报味精，最近表现真不错

显示全部楼层 · 发表于 2007-5-26 22:28:17

LZ搞甚麽啊?這不是那個4生成的嘛

http://bbs.kafan.cn/viewthread.php?tid=89562&extra=page%3D1

显示全部楼层 · 发表于 2007-5-26 22:30:42

Begin scan in 'D:\Documents and Settings\dell\桌面\expseny.rar'
D:\Documents and Settings\dell\桌面\
  expseny.rar
[0] Archive type: RAR
--> expseny.exe
      [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/NSPack). Please verify the origin of the file
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    The file was moved to '46c8449b.qua'!

显示全部楼层 · 发表于 2007-5-26 22:37:29

生成的为何还抱壳呢

显示全部楼层 · 发表于 2007-5-26 22:39:25

原帖由 scottxzt 于 2007-5-26 22:37 发表
生成的为何还抱壳呢

生成的文件本来就带壳

[病毒样本] 一个~~

本帖子中包含更多资源

本帖子中包含更多资源

报壳。此文件需要确认