转来一包东西[MD5: 773B90 0FE905 7AAEB3 B4C0E8 7657F5 12FA49]

显示全部楼层 · 发表于 2007-7-8 09:16:39

转来一包东西

[ 本帖最后由 zane_xzz 于 2007-7-8 09:17 编辑 ]

显示全部楼层 · 发表于 2007-7-8 09:20:27

deleted: malware HackTool.Win32.Agent.be File: C:\Documents and Settings\Owner\×ÀÃæ\rrbhy.rar/zxarps..exe//UPack

显示全部楼层 · 发表于 2007-7-8 09:23:16

费尔报5个，3个启发。

显示全部楼层 · 发表于 2007-7-8 09:47:03

C:\Documents and Settings\Administrator\桌面\rrbh
y.rar>>zxarps..exe>>upack0.34 Hack.ArpCheater.a(ARP欺骗工具)

显示全部楼层 · 发表于 2007-7-8 09:47:50

c:\ABC\rrbhy\server.exe - Signature 'Backdoor.Win32.Rbot.cop' found
c:\ABC\rrbhy\server.exe.bak - Signature 'Backdoor.Win32.Rbot.cop' found
c:\ABC\rrbhy\winrar.css
c:\ABC\rrbhy\zxarps..exe - Signature 'Trojan-PWS.Win32.Small.br' found
c:\ABC\rrbhy\小哨兵还原卡密码读取.exe - Suspect code-parts found (Level: 210)
c:\ABC\rrbhy\小龙下载者.exe

6 Files scanned
(0 Archives with 0 files)
3 Signatures found
1 Suspect code-part found
Used time: 0:00.735

显示全部楼层 · 发表于 2007-7-8 09:50:27

小龙下载者.exe是一个server.exe的生成器
不杀也罢

显示全部楼层 · 发表于 2007-7-8 09:52:08

幸亏这里是样本区，否则这个变态的IK估计扫十个正常文件也得报五个

显示全部楼层 · 发表于 2007-7-8 09:54:05

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\rrbhy.rar'
C:\Documents and Settings\Administrator\桌面\
  rrbhy.rar
[0] Archive type: RAR
--> server.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> server.exe.bak
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> winrar.css
--> zxarps..exe
      [DETECTION] Contains signature of the SPR/Tool.Hackdns.2 program
      [WARNING] Infected files in archives cannot be repaired!
--> ¤p?¤U?ªÌ.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
--> ¤pï§L?ì¥d±K??¨ú.exe
      [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    A backup was created as '46f243fd.qua'  ( QUARANTINE )
      [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-7-8 09:56:45

红伞也可以做到

显示全部楼层 · 发表于 2007-7-8 09:59:36

nis 1

[病毒样本] 转来一包东西[MD5: 773B90 0FE905 7AAEB3 B4C0E8 7657F5 12FA49]

本帖子中包含更多资源

回复 #7 wangjay1980 的帖子