MD5: AD28C6已重新上传生成物

显示全部楼层 · 发表于 2007-9-10 09:13:12

MP

请楼主协助将此样本加密连同微点目录下的mp6文件夹一同发送到support@micropoint.com.cn 并写明原因。

显示全部楼层 · 发表于 2007-9-10 09:43:50

我早就上报了，只是发到微点VIRUS邮箱而已。
我运行的好像没有这个随机8位数的DLL。
但有一个随机8位数的EXE还注册为自启动项。被我不小心看到，删了。

[ 本帖最后由自由于 2007-9-10 09:45 编辑 ]

显示全部楼层 · 发表于 2007-9-10 09:46:43

卡巴斯基互联网安全套装 7.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=125872 is infected with Backdoor.Win32.Agent.bnb virus
有个是空的啊

显示全部楼层 · 发表于 2007-9-10 11:30:41

Scan performed at: 2007-9-10 11:29:45
Scanning Log
NOD32 version 2517 (20070910) NT
Command line: D:\Documents and Settings\EKINCHENG\桌面\样本.rar

Date: 10.9.2007 Time: 11:29:46
Anti-Stealth technology is enabled.
Scanned disks, folders and files: D:\Documents and Settings\EKINCHENG\桌面\样本.rar
D:\Documents and Settings\EKINCHENG\桌面\样本.rar ?RAR ?auto.exe - probably a variant of Win32/Genetik trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 11:29:46 Total scanning time: 0 sec (00:00:00)
Scan performed at: 2007-9-10 11:29:52
Scanning Log
NOD32 version 2517 (20070910) NT
Command line: D:\Documents and Settings\EKINCHENG\桌面\9A5FAAE2.rar

Date: 10.9.2007 Time: 11:29:53
Anti-Stealth technology is enabled.
Scanned disks, folders and files: D:\Documents and Settings\EKINCHENG\桌面\9A5FAAE2.rar
D:\Documents and Settings\EKINCHENG\桌面\9A5FAAE2.rar ?RAR ?9A5FAAE2.EXE - probably a variant of Win32/Genetik trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 11:29:53 Total scanning time: 0 sec (00:00:00)

显示全部楼层 · 发表于 2007-9-10 14:04:31

F:\9.10\样本2.rar >>RAR >>auto.exe - 可能是 Win32/Genetik 木马的一个变种
F:\9.10\9A5FAAE2.rar >>RAR >>9A5FAAE2.EXE - 可能是 Win32/Genetik 木马的一个变种

显示全部楼层 · 发表于 2007-9-10 17:20:04

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Paranoia Database - 4102
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\auto.exe

C:\Documents and Settings\uhthn\Desktop\auto.exe - Suspicious of Trojan-PSW.Game.8

1 Files scanned
0 Infected files found
1 Suspicious files found
0 Files cured
0 Files deleted

显示全部楼层 · 发表于 2007-9-10 20:16:13

微点：
木马名称:Backdoor.Win32.Agent.ele

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\AUTO.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Backdoor.Win32.Agent.ele

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\9A5FAAE2.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

谁上报过了？

[病毒样本] MD5: AD28C6已重新上传生成物

本帖子中包含更多资源

回复 11楼 soft_killer 的帖子