Lcass病毒过了卡巴

显示全部楼层 · 发表于 2007-6-25 15:49:20

这个病毒有些特别,不是在u盘的根目录下，而是在一个伪装成系统隐藏的RECYCLER目录下，autorun.inf文件也相应改成了
[autorun]
open=.\RECYCLER\Lcass.exe
shell\1=打开(&O)
shell\1\Command=.\RECYCLER\Lcass.exe
shell\2\=浏览(&V)...
shell\2\Command=.\RECYCLER\Lcass.exe
shellexecute=.\RECYCLER\Lcass.exe
右键打开同样中毒……

用最新病毒库的卡巴居然没查出来……
用小红伞一解压就报警……
运行时也被微点拦截了……

显示全部楼层 · 发表于 2007-6-25 15:53:28

咖啡：杀得干干净净了

显示全部楼层 · 发表于 2007-6-25 15:57:34

你运行一下，卡巴也会拦截的

显示全部楼层 · 发表于 2007-6-25 15:58:31

病毒: Win32:VB-DVG [Wrm]
檔案: Lcass.exe
目錄: E:\病毒库\Lcass\RECYCLER
處理序: WinRAR.exe

显示全部楼层 · 发表于 2007-6-25 15:59:55

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\Lcass'
C:\Documents and Settings\Administrator\My Documents\Lcass\
  autorun.inf
C:\Documents and Settings\Administrator\My Documents\Lcass\RECYCLER\
  Lcass.exe
   [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Tzhen.A.1 Backdoor server programs
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-6-25 15:59:57

IKARUS - T3SCAN V1.25 (WIN32)
      T3 V1.01.08
      Copyright (c) 2003 - 2007 by IKARUS Software.
      Written by Richard Schmoegner.
      All rights reserved.

Signature-database from 25.6.2007 04:16:03 (Build: 69118)

C:\virus\RECYCLER.rar:\RECYCLER\Lcass.exe - Signature 'Backdoor.Win32.VB.ags' found

      2 Files scanned
      (1 Archiv with 1 file)
      1 Signature found
      0 Suspect code-parts found
      Used time: 0:00.078

RECYCLER.rar
[0] Archive type: RAR
--> RECYCLER\Lcass.exe
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Tzhen.A.1 Backdoor server programs
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-6-25 16:04:19

每次卡死的都是panda。。
A-Squared
Found nothing
AntiVir
Found BDS/Tzhen.A.1
ArcaVir
Found nothing
Avast
Found Win32:VB-DVG
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Scanning, please wait...
Rising Antivirus
Scanning, please wait...
VirusBuster
Scanning, please wait...
VBA32
Scanning, please wait...

显示全部楼层 · 发表于 2007-6-25 16:05:01

卡巴主动防御报了

显示全部楼层 · 发表于 2007-6-25 16:14:52

虚拟机里只装了小红伞和微点，主机用的是卡巴，没胆子直接运行啊……

呵呵……

显示全部楼层 · 发表于 2007-6-25 16:55:14

[病毒样本] Lcass病毒过了卡巴

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

回复 #3 wangjay1980 的帖子

本帖子中包含更多资源