5个[MD5: B33AC2 7561F1 7A4351 310316 A06BA7]

显示全部楼层 · 发表于 2007-6-15 22:57:12

晕啊！

BD报两个。

显示全部楼层 · 发表于 2007-6-15 22:57:43

那个下载者运行后在C:\program files\common files\system释放Updaterun..添加Run启动.
NOD32两个都挂..
但那个下载者下载的都杀了..

Time Module Object Name Threat Action User Information
2007-6-15 22:25:29 AMON file C:\windows\f2.exe probably a variant of Win32/TrojanDownloader.Agent.BBB trojan quarantined - deleted ET250\Administrator Event occurred on a new file created by the application: C:\Documents and Settings\Administrator\Local Settings\Temp\tempaq. The file was moved to quarantine. You may close this window.
2007-6-15 22:25:27 AMON file C:\windows\system32\jcqhu.dll a variant of Win32/TrojanDownloader.QQHelper trojan quarantined - deleted ET250\Administrator Event occurred on a new file created by the application: C:\Documents and Settings\Administrator\Local Settings\Temp\tempaq. The file was moved to quarantine. You may close this window.
2007-6-15 22:25:25 AMON file C:\windows\system32\wbem\snulk.dll a variant of Win32/TrojanDownloader.QQHelper trojan quarantined - deleted ET250\Administrator Event occurred on a new file created by the application: C:\Documents and Settings\Administrator\Local Settings\Temp\tempaq. The file was moved to quarantine. You may close this window.

显示全部楼层 · 发表于 2007-6-15 23:08:58

还就把那下载者杀了

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\virus.rar'
C:\Documents and Settings\Administrator\My Documents\
  virus.rar
[0] Archive type: RAR
--> bind_50127.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
--> eozlt.dll
--> f2.exe
--> pggcq.sys
--> Updaterun.exe
      [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-6-15 23:14:51

第一个运行连网阻止后，没动静。其它全部拦截。

显示全部楼层 · 发表于 2007-6-15 23:41:29

扫描开始时间: 2007-6-15 23:42:51
扫描日志
NOD32 版本 2334 (20070615) NT
命令行: F:\virus\virus.rar
C:\Program Files\Eset\nod32.exe<病毒 - 正常>

日期: 2007年6月15日时间: 23:43:08
反 Rookits 技术已启用。
已扫描磁盘、文件夹和文件: F:\virus\virus.rar
F:\virus\virus.rar ?RAR ?bind_50127.exe<病毒 - 正常>
F:\virus\virus.rar ?RAR ?eozlt.dll<病毒 - Win32/TrojanDownloader.Agent.NMN 木马变种>
F:\virus\virus.rar ?RAR ?f2.exe<病毒 - 可能是 Win32/TrojanDownloader.Agent.BBB 木马变种>
F:\virus\virus.rar ?RAR ?pggcq.sys<病毒 - 可能是 Win32/TrojanDownloader.Agent.BBB 木马变种>
F:\virus\virus.rar ?RAR ?Updaterun.exe<病毒 - 正常>
F:\virus\virus.rar:Zone.Identifier<病毒 - 正常>
已扫描文件数量: 6
已发现病毒数量: 3
完成时间: 23:43:11 总共扫描时间: 3 秒 (00:00:03)

[病毒样本] 5个[MD5: B33AC2 7561F1 7A4351 310316 A06BA7]

本帖子中包含更多资源