经过NTFS流隐藏的木马[ad8870]

坐在墙头

费尔好像也解不了包？
Backdoor.Bifrose.adr.vwcx
Backdoor.Delf.axh.cuwt
Backdoor.Bifrose.adr.vwcx

taihuxian

BitDefender

This web page has been blocked by BitDefender Antivirus Real-time Protection!

The blocked web page included objects that were either infected or likely to be infected with a virus. Your system has NOT been infected.

Backdoor.Agent.YQV
Generic.Graybird.F4729A11

SONGBOWEN

BitDefender的确很强！

tracydk

原帖由 SONGBOWEN 于 2007-7-9 18:05 发表
BitDefender的确很强！

总结一下,在样本区牛的:ANTIVIR BD Ilukas vba32  长期有效

SONGBOWEN

支持，不过微点也不落后啊！微点的主动防御几乎可以识别绝大多数的木马和病毒，包括未知的木马和病毒……

qianwenxiang

NTFSADS中包含2个木马,一个是压缩档 解压后是s.exe,另外一个是附件中的ntfsads2.exe

SONGBOWEN

Arcavir 防病毒	1.0.4	200707081522	2007-07-08	Trojan.Bifrose.Adr	1.331
Avast 防病毒	1.0.8	000754-5	2007-07-08	Win32:Delf-EAJ	1.539
AVG 防病毒	7.5.47.442	269.10.2/891	2007-07-08	BackDoor.Generic6.TWS	1.124
BitDefender 防病毒	7.60825.698548	7.13787	2007-07-09	Generic.Graybird.F4729A11	2.664
ClamAV	N/A	3613	2007-07-09	Trojan.Delf-682	0.026
F-SECURE 防病毒	5.51.6100	2007.07.04.14	2007-07-04	Backdoor.Win32.Delf.axh	2.445
MKS_VIR 防病毒	2.01	2007.07.08	2007-07-08	没有检测到病毒	0.492
NOD32 防病毒	2.70.7	2385	2007-07-09	Win32/BlackHole.NAA trojan	1.811
SOPHOS 防病毒	2.43	4.15	2007-07-01	Mal/Packer	0.325
VBA32 防病毒	3.12.0.2	20070708.1942	2007-07-08	Backdoor.Win32.Delf.axh	1.032
VirusBuster 防病毒	4.3.19:9	9.087.7/11.0	2007-07-09	Backdoor.Bifrose.WU	1.556
冰岛杀毒	3.16.15	2007.07.06	2007-07-06	W32/Threat-Backdoor-Silly-based!Maximus	1.255
卡巴斯基防病毒	5.5.10	2007.07.09	2007-07-09	Backdoor.Win32.Delf.axh	0.152
大蜘蛛防病毒	4.33	2007.07.09	2007-07-09	BackDoor.BlackHole	4.405
小红伞防病毒	7.4.0.39	6.39.0.118	2007-07-09	BDS/Graybird.PA.2	1.964
熊猫卫士	9.00.00	2007.07.08	2007-07-08	Bck/BlackHole.AQ	1.061
诺曼防病毒	5.90.37	5.90	2007-07-06	W32/Downloader.AEL	2.395
赛门铁克防病毒	N/A	20070708.007	2007-07-08	Infostealer.Lineage	0.424
趋势防病毒	8.310-1002	4.587.00	2007-07-08	没有检测到病毒	0.088
迈克菲防病毒	5.1.00	5069	2007-07-06	Generic BackDoor	0.761
金山毒霸	2006.11.1.240	2007.7.4	2007-07-04	Win32.Troj.Agent.tp.252879	3.63

注意: 就算报告发现病毒，也可能是杀软误报，请根据查毒结果自行判断

1688388728

病毒: Backdoor.Win32.Delf.axh, Backdoor.Win32.Bifrose.adr
文件: muma[1].rar
目录: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4LEVWHMJ
进程: GreenBrowser.exe

tracydk

Dear Sir or Madam,

Thank you for your email to Avira's virus lab.
Tracking number: INC00058784.




We received the following archive files:


File ID  Filename  Size (Byte) Result
1099762  muma.rar 279.09 KB OK

A listing of files contained inside archives alongside their results can be found below:

File ID  Filename  Size (Byte) Result
1099763  muma.exe  329.83 KB  MALWARE


Please find a detailed report concerning each individual sample below:

Filename Result  muma.exe  MALWARE

The file 'muma.exe' has been determined to be 'MALWARE'. Virus name is DROPPER (en) Detection will be added to our virus definition file (VDF) with one of the next updates.

SONGBOWEN

不知发这个文件是何用意呢？请说明！