MD5: 0647D4]网上抓来一只

zane_xzz

MD5: 0647D4]网上抓来一只

woai_jolin

2007/6/21 19:47:50        Scanning Log
2007/6/21 19:47:50        Version of virus signature database: 2342 (20070621)
2007/6/21 19:47:50        Date: 21.6.2007  Time: 19:47:49
2007/6/21 19:47:50        Scanned disks, folders and files: D:\病毒\
2007/6/21 19:47:50        D:\病毒\样本.rar - a variant of Win32/Butileg worm - deleted - quarantined
2007/6/21 19:47:50        D:\病毒\样本.rar » RAR » me.exe - a variant of Win32/Butileg worm
2007/6/21 19:47:50        Number of scanned files: 2
2007/6/21 19:47:50        Number of threats found: 1
2007/6/21 19:47:50        Time of completion: 19:47:50  Total scanning time: 1 sec (00:00:01)

harrystopet

RS  Worm.Mail.Warezov.gr

wangjay1980

上报之

zane_xzz

原帖由 woai_jolin 于 2007-6-21 19:51 发表
2007/6/21 19:47:50        Scanning Log
2007/6/21 19:47:50        Version of virus signature database: 2342 (20070621)
2007/6/21 19:47:50        Date: 21.6.2007  Time: 19:47:49
2007/6/21 19:47:50        Scanned disks, fol ...

看来Nod32启发还真是强啊

欠妳緈諨

AVAST没反应，上报

aerbeisi

detected: riskware Hidden install        Running process: me.exe

dyw1021

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本.rar'
C:\Documents and Settings\Administrator\桌面\样本.rar
  [0] Archive type: RAR
  --> me.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '46a8d72f.qua'!


End of the scan: 2007年6月21日  20:33
Used time: 00:04 min

The scan has been done completely.

      0 Scanning directories
      2 Files were scanned
      1 viruses and/or unwanted programs were found
      1 classified as suspicious:
      0 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      0 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

小邪邪

已由访问保护规则禁止 样本\me.exe
C:\WINDOWS\boot.txt
防病毒标准保护:禁止远程创建/修改可执行文件和配置文件
已阻止的操作: 创建

已由访问保护规则禁止样本\me.exe
C:\Program Files\Common Files\System\ado\msado15.exe
通用最大保护:禁止在 Program Files 文件夹中创建新的可执行文件
已阻止的操作: 创建

已由访问保护规则禁止 样本\me.exe
C:\WINDOWS\system32\notepad.exe
用户定义的规则:FD 禁读保护
已阻止的操作: 读取

试图在WINDOWS根目录下创建boot.exe
试图在C:\Program Files\Common Files\System\ado\目录下创建msado15.exe
试图调用notepad.exe .....

咖啡在强保护下只监控到这些前期动作

aziok

Virus or unwanted program 'HEUR/Malware [HEUR/Malware]'
detected in file 'C:\Documents and Settings\？？？？？\桌面\me.exe.
Action performed: Deny access