[MD5: E67D9D]卡7飘

显示全部楼层 · 发表于 2007-6-23 01:47:52

2007-6-23 1:52:03 C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$EX00.984\10.exe \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks C:\windows\System32\tmpFil 没有键入值查出

显示全部楼层 · 发表于 2007-6-23 01:55:43

File:	10.exe
Status:	INFECTED/MALWARE
MD5:	e67d9d8abd60b5f5a1b3f048c896f361
Packers detected:	UPACK
Bit9 reports:	File not found

Scanner results
Scan taken on 22 Jun 2007 17:54:01 (GMT)
A-Squared	Found nothing
AntiVir	Found PCK/UPACK
ArcaVir	Found nothing
Avast	Found nothing
AVG Antivirus	Found nothing
BitDefender	Found nothing
ClamAV	Found nothing
Dr.Web	Found nothing
F-Prot Antivirus	Found nothing
F-Secure Anti-Virus	Found nothing
Fortinet	Found nothing
Kaspersky Anti-Virus	Found nothing
NOD32	Found nothing
Norman Virus Control	Found W32/Suspicious_U.gen
Panda Antivirus	Found nothing
Rising Antivirus	Found nothing
VirusBuster	Found Packed/Upack
VBA32	Found Trojan-PSW.Game.44 (paranoid heuristics) (probable variant)

显示全部楼层 · 发表于 2007-6-23 02:06:04

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\样本.rar'
C:\Documents and Settings\Administrator\My Documents\
  样本.rar
[0] Archive type: RAR
--> 10.exe
      [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-6-23 02:32:42

上报看看

显示全部楼层 · 发表于 2007-6-23 05:21:37

试图挂全局钩子的东西

显示全部楼层 · 发表于 2007-6-23 05:50:11

Virus: Trojan.Win32.Qhost.lo

Virus found while downloading Web content.

Address: bbs.kafan.cn

显示全部楼层 · 发表于 2007-6-23 08:35:49

?       Copyright (c) 1993-2007 by VBA Ltd.          ?
酝屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯图
License expired
License #000000119 Valid till 2006-12-31
Demo mode
Command line options:
/r=susp.rpt /ha=3 /collect_suspects /nc /af+ /ar+ /bt- /mr- /ml+ /rw+ /as-
Ctrl-C will terminate program execution

*:
C:\
C:\ABC\...\10.exe : is suspected of Trojan-PSW.Game.44 (paranoid heuristics)
Program execution terminated by user

Directories    : 3    Files in archives:    Files on disks:
Archives:                - total    : 1    - total    : 15
- scanned       : 1    -  scanned : 1    - scanned    : 14
- contain viruses : 0    -  infected : 0    - infected : 0
- deleted       : 0    -  suspicious : 1    - suspicious  : 1

Startup : 08:40:22 23-06-2007
End       : 08:40:28 23-06-2007
Total time : 00:00:06
终止批处理操作吗(Y/N)?

显示全部楼层 · 发表于 2007-6-23 08:40:57

现在可以杀了

显示全部楼层 · 发表于 2007-6-23 08:42:15

费尔报

[病毒样本] [MD5: E67D9D]卡7飘

本帖子中包含更多资源

本帖子中包含更多资源

壳王没的说啊，要是正常文件放在这个壳里，红伞就要上报false positive了

本帖子中包含更多资源

本帖子中包含更多资源