最后发个更奇怪的MD5: D59A2253

显示全部楼层 · 发表于 2007-7-6 21:04:57

费尔启发。

显示全部楼层 · 发表于 2007-7-6 21:06:14

c:\ABC\rexue.rar:\rexue.exe - Signature 'Backdoor.Win32.Agent.ahj' found
PS：壳王继续XX

显示全部楼层 · 发表于 2007-7-6 21:07:36

程序:
E:\病毒库\REXUE\REXUE.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\REXUE.DLL
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-7-6 21:11:45

KIS 7
高启发不报

显示全部楼层 · 发表于 2007-7-6 21:17:37

还没有下完,就被告咖啡干掉了

显示全部楼层 · 发表于 2007-7-6 21:21:15

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\rexue.rar'
C:\Documents and Settings\Administrator\桌面\rexue.rar
  [0] Archive type: RAR
  --> rexue.exe
   [DETECTION] Contains suspicious code HEUR/Crypted
   [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-7-6 22:20:41

CreateFile C:\WINDOWS\system32\rexue.dll
CreateRegKey \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3495D328-661A-4FB0-BA67-8ACDD1704D1E}
CreateRegKey \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3495D328-661A-4FB0-BA67-8ACDD1704D1E}\InprocServer32
CreateRegValue \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{3495D328-661A-4FB0-BA67-8ACDD1704D1E}

显示全部楼层 · 发表于 2007-7-6 22:20:54

Hello,

rexue.exek, rexue.exek.unp - Trojan-PSW.Win32.Delf.qx

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vladimir Krylov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

> Attachment: rexue.zip

显示全部楼层 · 发表于 2007-7-6 22:40:53

卡嚓了

[病毒样本] 最后发个更奇怪的MD5: D59A2253

本帖子中包含更多资源

本帖子中包含更多资源