微软最近是进步了fd2d58

显示全部楼层 · 发表于 2007-8-28 09:23:34

Microsoft

1.2803

2007.08.28

Backdoor:WinNT/Farfli.B!sys

显示全部楼层 · 发表于 2007-8-28 09:27:25

Scanning Log
NOD32 version 2487 (20070828) NT
Command line: R:\jj6y.zip
Checking CRC of NOD32.EXE: Status OK
Scanning memory: Not performed (option disabled)
Error occurred while scanning MBR sector of the 2.  ?
?physical disk. Error reading sector.
Date: 28.8.2007  Time: 09:26:54
Anti-Stealth technology is enabled.
Scanned disks, folders and files: R:\jj6y.zip
R:\jj6y.zip ?ZIP ?jj6y.sys - a variant of Win32/Rootkit. ?
?Agent.NCK trojan
Number of scanned files: 1
Number of threats found: 1
Time of completion: 09:26:55 Total scanning time: 1 sec  ?
?(00:00:01)

显示全部楼层 · 发表于 2007-8-28 09:27:46

驱逐舰挂，费尔扫描挂

显示全部楼层 · 发表于 2007-8-28 09:28:21

K7 pass

显示全部楼层 · 发表于 2007-8-28 09:31:44

一会杀

Hello,

iinwnn1slp.sys - Trojan-Downloader.Win32.Agent.bbb,
jj6y.sys - Trojan-Downloader.Win32.Agent.ccg

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Denis Maslennikov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

> Attachment: iinwnn1slp.zip
> Attachment: jj6y.zip

[ 本帖最后由 wangjay1980 于 2007-8-28 10:57 编辑 ]

显示全部楼层 · 发表于 2007-8-28 09:31:53

Starting the file scan:

Begin scan in 'F:\病毒样本\jj6y.zip'
F:\病毒样本\jj6y.zip
  [0] Archive type: ZIP
  --> jj6y.sys
   [DETECTION] Is the Trojan horse TR/Rootkit.Gen
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-8-28 09:33:08

irus or unwanted program 'TR/Rootkit.Gen [TR/Rootkit.Gen]'

显示全部楼层 · 发表于 2007-8-28 09:34:59

如果是见rookit就报的话
以后如果玩SecuROM技术的游戏会很惨
不过国内应该没事

显示全部楼层 · 发表于 2007-8-28 09:37:36

你怎么知道红伞是不是只是明细不表，归于大类？

显示全部楼层 · 发表于 2007-8-28 09:38:45

LS两个表把这个又搞成潜力贴哦

[病毒样本] 微软最近是进步了fd2d58

本帖子中包含更多资源