经过NTFS流隐藏的木马[ad8870]

moonsilver

原帖由 SONGBOWEN 于 2007-7-9 17:25 发表
汗！连国内号称有流文件查杀功能的瑞星也失手了……

jotti上的瑞星太烂了

  瑞星病毒查杀结果报告
清除病毒种类列表：
病毒： Backdoor.BlackHole.df   
病毒： Trojan.Mnless.lww        
用户来源：互联网
软件版本：19.31.02

XinDOS

卡巴搞定

fireworld

金山不报的

yashoo

专家

2个威胁利用NTFS ADS“隐藏”在clear.vbs文件中，分别为流“s.exe”和“vqq.exe”。

NTFS文件系统支持给每个文件添加任意隐藏的数据，所以越来越多威胁采用这个特性隐藏自身。

蓝色牛仔裤

[Scan path] C:\Documents and Settings\Administrator\桌面\muma.zip
>>>C:\Documents and Settings\Administrator\桌面\muma.zip\s.exe\s.exe infected with BackDoor.BlackHole
>C:\Documents and Settings\Administrator\桌面\muma.zip\s.exe - archive contains infected objects
>C:\Documents and Settings\Administrator\桌面\muma.zip\vvqq.exe infected with BackDoor.Bifrost.78
C:\Documents and Settings\Administrator\桌面\muma.zip - archive contains infected objects

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 4
Infected objects found: 2
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 188 Kb/s
Scan time: 00:00:00

taihuxian

Virus: Backdoor.Win32.Delf.axh, Backdoor.Win32.Bifrose.adr

Virus found while downloading Web content.

Address: bbs.kafan.cn

tracydk

红伞的入库速度还是不能和卡巴相比的啊

wjw35

卡巴斯基7.0.125报！

啊弥陀佛

微点砍掉