木馬-過很多[MD5:8b194c]

显示全部楼层 · 发表于 2007-6-8 20:25:02

今天分析毒網抓的
mcafee與dr.web與nod32都可以偵查,有過紅傘嗎?還是virustotal的問題,有待紅傘用戶測試嚕
過瞞多的

MD5: 8b194c6e69921a1a6bf23dd3c6a22a98

[ 本帖最后由黑衣~魂于 2007-6-8 20:27 编辑 ]

显示全部楼层 · 发表于 2007-6-8 20:29:25

显示全部楼层 · 发表于 2007-6-8 20:30:52

detected: Trojan program Trojan-PSW.Win32.OnLineGames.wb File: C:\Documents and Settings\Owner\×ÀÃæ\tt.zip/tt.exe//WMSHIJIE.DLL//NSPack

显示全部楼层 · 发表于 2007-6-8 20:32:20

红伞报壳
Virus or unwanted program 'PCK/NSPack [PCK/NSPack]'
detected in file 'C:\Documents and Settings\Joseph Wan\Desktop\tt\tt.exe.
Action performed: Allow access

AVAST挂

显示全部楼层 · 发表于 2007-6-8 20:37:33

ArcaBit - Scanning report [2007.06.08 20:38:17]
Base date : 2007.06.07 19:38:16

C:\Documents and Settings\all.HOME-\桌面\新資料夾 (2)\tt.exe<DLLRES>:SYSDLL1.exe<UPack>:SYSDLL1.exe <- Trojan.Psw.Onlinegames.Kh

显示全部楼层 · 发表于 2007-6-8 20:41:43

咖啡杀，报：PWS-Gamania(特洛伊)

显示全部楼层 · 发表于 2007-6-8 20:43:36

VT飞机了～～～
?          Copyright (c) 1993-2007 by VBA Ltd.          ?
酝屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯?
License expired
License #000000119 Valid till 2006-12-31
Demo mode
Command line options:
/r=susp.rpt /ha=3 /collect_suspects /nc /af+ /ar+ /bt- /mr- /ml+ /rw+ /as-
Ctrl-C will terminate program execution

*:
C:\
C:\ABC\tt.zip:<ZIP>\tt.exe : is suspected of Trojan-PSW.Lmir.41
Program execution terminated by user

Directories    : 3    Files in archives:    Files on disks:
Archives:                - total    : 1    - total    : 11
- scanned       : 1    -  scanned : 1    - scanned    : 11
- contain viruses : 0    -  infected : 0    - infected : 0
- deleted       : 0    -  suspicious : 1    - suspicious  : 1

Startup : 20:45:08 08-06-2007
End       : 20:45:12 08-06-2007
Total time : 00:00:04
终止批处理操作吗(Y/N)?

显示全部楼层 · 发表于 2007-6-8 20:47:17

好长啊

显示全部楼层 · 发表于 2007-6-8 20:47:27

上报中...

显示全部楼层 · 发表于 2007-6-8 20:52:28

kv2007 pass.

[病毒样本] 木馬-過很多[MD5:8b194c]

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源