我也来发个毒网

显示全部楼层 · 发表于 2007-5-31 22:14:08

http://www.irenti.com/2.htm

复制代码

显示全部楼层 · 发表于 2007-5-31 22:24:07

显示全部楼层 · 发表于 2007-5-31 22:25:02

Scan performed at: 2007-5-31 22:25:04
Scanning Log
NOD32 version 2301 (20070531) NT
Command line: C:\Documents and Settings\EQ2\桌面\smss.rar C:\Documents and Settings\EQ2\桌面\MeTest.rar
Operating memory - is OK

Date: 31.5.2007 Time: 22:25:08
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\smss.rar; C:\Documents and Settings\EQ2\桌面\MeTest.rar
C:\Documents and Settings\EQ2\桌面\smss.rar ?RAR ?smss.exe - probably a variant of Win32/PSW.Delf.NHI trojan
C:\Documents and Settings\EQ2\桌面\MeTest.rar ?RAR ?MeTest[1].jpg - a variant of Win32/TrojanDownloader.Ani.Gen trojan
Number of scanned files: 4
Number of threats found: 2
Number of files cleaned: 2
Time of completion: 22:25:08 Total scanning time: 0 sec (00:00:00)

显示全部楼层 · 发表于 2007-5-31 22:30:05

detected: malware Exploit.Win32.IMG-ANI.gen (modification) URL: http://bbs.kafan.cn/attachment.php?aid=79128//MeTest[1].jpg
detected: virus Virus.Win32.AutoRun.p File: C:\Documents and Settings\Owner\×ÀÃæ\smss.rar/smss.exe//ROMDRIVERS.DLL//UPX

显示全部楼层 · 发表于 2007-5-31 22:58:05

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\smss.rar'
C:\Documents and Settings\morgan\My Documents\
  smss.rar
[0] Archive type: RAR
--> smss.exe
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    The file was deleted!
Begin scan in 'C:\Documents and Settings\morgan\My Documents\MeTest.rar'
C:\Documents and Settings\morgan\My Documents\
  MeTest.rar
[0] Archive type: RAR
--> MeTest[1].jpg
      [DETECTION] Contains signature of the exploits EXP/Ani.Gen
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-5-31 22:58:50

Hello,

smss.exek - Virus.Win32.AutoRun.p

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vladimir Krylov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

> Attachment: smss.zip

显示全部楼层 · 发表于 2007-5-31 23:20:49

AVAST对新的ANI不敏感，不过另一个杀了

显示全部楼层 · 发表于 2007-5-31 23:21:47

ANI好多

显示全部楼层 · 发表于 2007-6-1 13:47:35

木马名称:Trojan-Downloader.Win32.Delf.ftq
程序:
C:\DOCUMENTS AND SETTINGS\MASTER.MASTE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\G1WNSZ0V\DOWN[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Downloader.Win32.Delf.ftq
程序:
C:\DOCUMENTS AND SETTINGS\MASTER.MASTE\LOCAL SETTINGS\TEMP\DOWN.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
蠕虫名称:Worm.Win32.Vikings.aeh
程序:
C:\DOCUMENTS AND SETTINGS\MASTER.MASTE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\G1WNSZ0V\1[1].EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?
蠕虫名称:Worm.Win32.Vikings.aeh
程序:
C:\WINNT\605.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?

[病毒样本] 我也来发个毒网

抓获的样本

本帖子中包含更多资源

本帖子中包含更多资源

打开网页后微点拦的是已知