过卡吧.红伞启发报

显示全部楼层 · 发表于 2007-6-3 21:47:26

这年头,针对咔吧的病毒越来越多了

咔吧6月3日的病毒库没有反应.

注:未加密压缩.请谨慎处理!
cpjkdbi.exe会在磁盘分区创建qmkrwim.exe,貌似通过U盘传播.我同学的机器中毒后咔吧也被K.O.了

显示全部楼层 · 发表于 2007-6-3 21:48:48

Scan performed at: 2007-6-3 21:49:26
Scanning Log
NOD32 version 2305 (20070601) NT
Command line: C:\Documents and Settings\EQ2\桌面\cpjkdbi.rar C:\Documents and Settings\EQ2\桌面\qmkrwim.rar
Operating memory - is OK

Date: 3.6.2007 Time: 21:49:31
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\cpjkdbi.rar; C:\Documents and Settings\EQ2\桌面\qmkrwim.rar
C:\Documents and Settings\EQ2\桌面\cpjkdbi.rar ?RAR ?cpjkdbi.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\EQ2\桌面\qmkrwim.rar ?RAR ?qmkrwim.exe - probably a variant of Win32/Genetik trojan
Number of scanned files: 5
Number of threats found: 2
Number of files cleaned: 2
Time of completion: 21:49:31 Total scanning time: 0 sec (00:00:00)

显示全部楼层 · 发表于 2007-6-3 21:49:21

嗯。。启发！

[Scan path] C:\Documents and Settings\Administrator\桌面\qmkrwim.rar
>C:\Documents and Settings\Administrator\桌面\qmkrwim.rar\autorun.inf - Ok
>>C:\Documents and Settings\Administrator\桌面\qmkrwim.rar\qmkrwim.exe probably infected with DLOADER.Trojan
C:\Documents and Settings\Administrator\桌面\qmkrwim.rar - archive contains infected objects

[Scan path] C:\Documents and Settings\Administrator\桌面\cpjkdbi.rar
>>C:\Documents and Settings\Administrator\桌面\cpjkdbi.rar\cpjkdbi.exe probably infected with DLOADER.Trojan
C:\Documents and Settings\Administrator\桌面\cpjkdbi.rar - archive contains infected objects

显示全部楼层 · 发表于 2007-6-3 21:52:00

网上过卡巴的毒多的是，那些挂马的做个出来连卡巴都过不来就别混了。

上网的话打齐补丁是王道。

U盘的话没办法了，只好不双击用资源管理器或者右键？反正我是用totalcmd的

显示全部楼层 · 发表于 2007-6-3 21:55:54

D:\Documents and Settings\dell\桌面\新建文件夹\
D:\Documents and Settings\dell\桌面\新建文件夹\cpjkdbi.rar
  [0] Archive type: RAR
  --> cpjkdbi.exe
   [DETECTION] Is the Trojan horse TR/Agent.24530
   [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was successfully wiped!
   [INFO]    The file was deleted!
D:\Documents and Settings\dell\桌面\新建文件夹\qmkrwim.rar
  [0] Archive type: RAR
  --> qmkrwim.exe
   [DETECTION] Is the Trojan horse TR/Agent.24530
   [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was successfully wiped!
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-6-3 21:57:26

开着主动防御，过主动防御的没几个
detected: virus Worm.Generic (modification) File: C:\Documents and Settings\Owner\×ÀÃæ\qmkrwim.rar/qmkrwim.exe//FSG
detected: virus Worm.Generic (modification) File: C:\Documents and Settings\Owner\×ÀÃæ\cpjkdbi.rar/cpjkdbi.exe//FSG

显示全部楼层 · 发表于 2007-6-3 21:58:35

拦截了

显示全部楼层 · 发表于 2007-6-3 22:00:29

资源管理器和右键，知道
totalcmd是什么？

这么说，用卡巴的都不要上网了

显示全部楼层 · 发表于 2007-6-3 22:15:28

主动防御杀

显示全部楼层 · 发表于 2007-6-3 22:34:12

total commander?嘿嘿

[病毒样本] 过卡吧.红伞启发报

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源