上几个病毒样本

显示全部楼层 · 发表于 2007-6-1 23:53:06

smss1.exe - 可能是 Win32/PSW.Delf.NHI 木马的一个变种

显示全部楼层 · 发表于 2007-6-1 23:54:24

那几个job和样本的是网页
指向的是深度技术的论坛
没有任何问题啊
怎么发上来了？？？

还有83_167125_a0ec9e988b6b964.rar 是张卡巴扫描结果的图片

[ 本帖最后由 Redevil 于 2007-6-1 23:55 编辑 ]

显示全部楼层 · 发表于 2007-6-1 23:55:11

detected: virus Virus.Win32.AutoRun.p File: C:\Documents and Settings\Owner\×ÀÃæ\_smss1.rar/smss1.exe//UPX
detected: Trojan program Trojan-PSW.Win32.Nilage.bcw File: C:\Documents and Settings\Owner\×ÀÃæ\_hello.rar/hello.exe//UPX

显示全部楼层 · 发表于 2007-6-1 23:56:23

看了3楼的回复，我就不测试了。

显示全部楼层 · 发表于 2007-6-1 23:57:35

其他都是PHP

显示全部楼层 · 发表于 2007-6-2 02:56:40

不验证样本？
实际只有3个病毒而已
Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\_smss1\smss1.exe'
C:\Documents and Settings\morgan\My Documents\_smss1\
  smss1.exe
   [DETECTION] Contains signature of the dropper DR/Delphi.Gen
   [INFO]    A backup was created as '46d36c5a.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
Begin scan in 'C:\Documents and Settings\morgan\My Documents\_smss1\第十四节订购客户跟踪表.doc'
C:\Documents and Settings\morgan\My Documents\_smss1\
  第十四节订购客户跟踪表.doc
   [DETECTION] Contains signature of the dropper DR/Drop.MSWord.1Table.CI
   [INFO]    A backup was created as '9d3bbf2e.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
Begin scan in 'C:\Documents and Settings\morgan\My Documents\_smss1\样本(1).php'
C:\Documents and Settings\morgan\My Documents\_smss1\
  样本(1).php
Begin scan in 'C:\Documents and Settings\morgan\My Documents\_smss1\83_167125_a0ec9e988b6b964.jpg'
C:\Documents and Settings\morgan\My Documents\_smss1\
  83_167125_a0ec9e988b6b964.jpg
Begin scan in 'C:\Documents and Settings\morgan\My Documents\_smss1\hello.exe'
C:\Documents and Settings\morgan\My Documents\_smss1\
  hello.exe
   [DETECTION] Is the Trojan horse TR/PSW.Nilage.bcw.16
   [INFO]    A backup was created as '46cc6c52.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
Begin scan in 'C:\Documents and Settings\morgan\My Documents\_smss1\job(2).php'
C:\Documents and Settings\morgan\My Documents\_smss1\
  job(2).php
Begin scan in 'C:\Documents and Settings\morgan\My Documents\_smss1\job.php'
C:\Documents and Settings\morgan\My Documents\_smss1\
  job.php

显示全部楼层 · 发表于 2007-6-2 09:09:20

加密的，旧的，没意思

上几个病毒样本

本帖子中包含更多资源