疑似木马一个。[MD5: 3DD70B]

显示全部楼层 · 发表于 2007-6-7 13:37:09

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\样本.rar'
C:\Documents and Settings\Administrator\My Documents\
  样本.rar
[0] Archive type: RAR
--> wg.com
      [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/NSPack). Please verify the origin of the file
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-6-7 13:37:21

wg.com - Win32/PSW.Lineage.DN 木马的变种

显示全部楼层 · 发表于 2007-6-7 13:50:17

探测到: 木马程序 Trojan-PSW.Win32.OnLineGames.wb 文件: C:\Documents and Settings\Administrator\桌面\样本.rar/wg.com//WMSHIJIE.DLL//NSPack
卡巴7报

显示全部楼层 · 发表于 2007-6-7 13:50:53

启发

?          Copyright (c) 1993-2007 by VBA Ltd.          ?
酝屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯?
License expired
License #000000119 Valid till 2006-12-31
Demo mode
Command line options:
/r=susp.rpt /ha=3 /collect_suspects /nc /af+ /ar+ /bt- /mr- /ml+ /rw+ /as-
Ctrl-C will terminate program execution

*:
C:\
C:\ABC\样本.rar:<RAR>\wg.com : is suspected of Trojan-PSW.Lmir.41
Program execution terminated by user

Directories    : 4    Files in archives:    Files on disks:
Archives:                - total    : 2    - total    : 26
- scanned       : 2    -  scanned : 2    - scanned    : 25
- contain viruses : 0    -  infected : 0    - infected : 0
- deleted       : 0    -  suspicious : 1    - suspicious  : 1

Startup : 13:52:01 07-06-2007
End       : 13:52:07 07-06-2007
Total time : 00:00:06
终止批处理操作吗(Y/N)?

显示全部楼层 · 发表于 2007-6-7 17:47:40

Virus: Trojan-PSW.Win32.OnLineGames.wb

Virus found while downloading Web content.

Address: bbs.kafan.cn

显示全部楼层 · 发表于 2007-6-7 18:50:17

咖啡报木马了

显示全部楼层 · 发表于 2007-6-7 18:52:55

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本.rar'
C:\Documents and Settings\Administrator\桌面\样本.rar
  [0] Archive type: RAR
  --> wg.com
   [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/NSPack). Please verify the origin of the file
   [INFO]    A backup was created as '46964ad5.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-6-7 19:05:09

Kaspersky Anti-Virus 7.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=83371 is infected with Trojan-PSW.Win32.OnLineGames.wb virus

显示全部楼层 · 发表于 2007-6-8 15:16:52

[病毒样本] 疑似木马一个。[MD5: 3DD70B]

本帖子中包含更多资源

评分

微点报未知木马

本帖子中包含更多资源

浏览过的版块