2x

Palkia

今日更新发现瑞星终于加了此东西的通用特征了~

luxiao200888

1 to eset

江湖的fans

C:\Users\小P\Desktop\DL\ss.exe>>emb-2.cab>>qd.exe        Trojan.Hhkqsm.pycj        木马        已删除/隔离
C:\Users\小P\Desktop\DL\sss.exe>>emb-2.cab>>qd.exe        Trojan.Hhkqsm.pycj        木马        已删除/隔离

aerbeisi

Rising
ss.exe AdWare.Win32.FakeMS.cir
sss.exe>>TJPack AdWare.Win32.FakeMS.cir

angir

程序：
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\杂乱样本\SS.EXE
木马程序生成以下文件：
1) C:\WINDOWS\SYSTEM32\CJ5F.DLL
2) C:\WINDOWS\SYSTEM32\7S77.DLL
3) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\W0I\QD.EXE
4) C:\WINDOWS\SYSTEM32\S.EXE
5) C:\WINDOWS\SYSTEM32\TMP.EXE
6) C:\WINDOWS\SYSTEM32\F2N2.EXE
7) C:\WINDOWS\77C3.BMP
8) C:\WINDOWS\55F5.EXE
9) C:\WINDOWS\3117.FLV
是否删除木马程序及其衍生物?

sss.exe只报生成物，上报微点

sam.to

TO KL,LL,comodo,mcafee,eset


Filename         Result
sss.exe548764          UNDER ANALYSIS



http://sample.nod32.com.hk/index ... e3f5808f1158ef56c77

[ 本帖最后由 sam.to 于 2009-8-30 18:01 编辑 ]

451102995

TF（敏感度4）完美击杀....不过2只杀完后TF都提示需要重启系统！

wliao

Program Guard,2009-8-30 18:05:21,Blocked,C:\Documents and Settings\Administrator\My Documents\ss.exe wants to access hard disk directly using device \??\PhysicalDrive0
Program Guard,2009-8-30 18:05:12,Blocked,C:\Documents and Settings\Administrator\My Documents\ss.exe wants to create executable file C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ljcx28d\s.exe
Program Guard,2009-8-30 18:05:06,Blocked,C:\Documents and Settings\Administrator\My Documents\ss.exe wants to create executable file C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ljcx28d\qd.exe
Program Guard,2009-8-30 18:04:59,Blocked,C:\Documents and Settings\Administrator\My Documents\ss.exe wants to create executable file \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ljcx28d\p.dll
Program Guard,2009-8-30 18:04:54,Blocked,C:\Documents and Settings\Administrator\My Documents\ss.exe wants to create executable file \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ljcx28d\b.dll
Program Guard,2009-8-30 18:04:45,Allowed,C:\Documents and Settings\Administrator\My Documents\ss.exe

avast!

悠柚

1 to IObit

橙香漫舞

瑞星的反应速度还是很快的，有写特征是有必要加上去的。