卡7飘~~~

显示全部楼层 · 发表于 2007-5-31 23:19:37

~Temp254.tmp - 可能是 Win32/PSW.Delf.NHI 木马的一个变种

显示全部楼层 · 发表于 2007-5-31 23:21:08

tart of the scan: 2007年5月31日  23:21

Starting the file scan:

Begin scan in 'E:\~Temp254.rar'
E:\~Temp254.rar
  [0] Archive type: RAR
  --> ~Temp254.tmp
   [DETECTION] Contains signature of the dropper DR/Delphi.Gen
   [INFO]    A backup was created as '46c3e835.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!

End of the scan: 2007年5月31日  23:21
Used time: 00:03 min

The scan has been done completely.

   0 Scanning directories
   2 Files were scanned
   1 viruses and/or unwanted programs were found
   0 classified as suspicious:
   1 files were deleted
   0 files were repaired
   1 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes
   0 Hidden objects were found

显示全部楼层 · 发表于 2007-5-31 23:21:33

还真飘了~~~~

无法运行~ 不能测试主动防御~~

显示全部楼层 · 发表于 2007-5-31 23:22:54

好东东

显示全部楼层 · 发表于 2007-5-31 23:24:16

又是这个毒

显示全部楼层 · 发表于 2007-5-31 23:29:13

卡巴对这个毒没办法~

直接上报添加病毒库来查杀~~

显示全部楼层 · 发表于 2007-6-1 00:05:37

删除hosts文件，IE目录下生成romdrivers.dll和romdrivers.bak

貌似那个升级狂的东西，等它下载……

显示全部楼层 · 发表于 2007-6-1 00:20:05

Hello,

~Temp254.tmp_ - Virus.Win32.AutoRun.p

This file is already detected. Please update your antivirus bases.

Please quote all when answering.

--
Best regards, Vladimir Lebedev
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

> Attachment: ~Temp254.zip

显示全部楼层 · 发表于 2007-6-1 00:27:28

神速啊~~~~~

[病毒样本] 卡7飘~~~

本帖子中包含更多资源

本帖子中包含更多资源

回复 #9 wangjay1980 的帖子