质量不好(据说过HIPS)

显示全部楼层 · 发表于 2007-10-20 19:11:59

帮忙测一下,据说这东西专攻主动防御连HIPS都能过,QQ.EXE是原始文件,其他是变种

[ 本帖最后由 chenrui19930 于 2007-10-20 19:18 编辑 ]

显示全部楼层 · 发表于 2007-10-20 19:12:45

扫描进行于：2007-10-20 19:12:29
扫描日志
NOD32版本 2604 (20071019) NT
命令行： C:\Documents and Settings\Deepin\桌面\新建文件夹.rar

日期： 20.10.2007 时间：19:12:31
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\Deepin\桌面\新建文件夹.rar
C:\Documents and Settings\Deepin\桌面\新建文件夹.rar >>RAR >>Serve1.exe - Win32/Agent.ADW 木马的变种
C:\Documents and Settings\Deepin\桌面\新建文件夹.rar >>RAR >>Serve2.exe - Win32/Agent.ADW 木马的变种
C:\Documents and Settings\Deepin\桌面\新建文件夹.rar >>RAR >>Serve3.exe - Win32/Agent.ADW 木马的变种
C:\Documents and Settings\Deepin\桌面\新建文件夹.rar >>RAR >>Server.exe - Win32/Agent.ADW 木马的变种
C:\Documents and Settings\Deepin\桌面\新建文件夹.rar >>RAR >>qq.exe - Win32/Agent.ADW 木马的变种
已扫描的文件数目：5
已发现的病毒数目：5
完成时间： 19:12:32 总扫描时间：1 秒 (00:00:01)

显示全部楼层 · 发表于 2007-10-20 19:13:35

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Deepin\桌面\新建文件夹.rar'
C:\Documents and Settings\Deepin\桌面\新建文件夹.rar
  [0] Archive type: RAR
  --> Serve1.exe
   [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.buw.1 Backdoor server programs
  --> Serve2.exe
   [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.buw.1 Backdoor server programs
  --> Serve3.exe
   [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.buw.1 Backdoor server programs
  --> Server.exe
   [DETECTION] Contains suspicious code HEUR/Crypted
  --> qq.exe
   [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.buw.1 Backdoor server programs
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-10-20 19:13:58

2007-10-20 19:13:36 1192878816 Administrator 3736 Sign of "Win32:Visel-B [Trj]" has been found in "D:\Downloads\5.rar\Serve1.exe\[Embedded#0e0d0]" file.
2007-10-20 19:13:39 1192878819 Administrator 3736 Sign of "Win32:Visel-B [Trj]" has been found in "D:\Downloads\5.rar\Serve1.exe" file.
2007-10-20 19:13:39 1192878819 Administrator 3736 Sign of "Win32:Visel-B [Trj]" has been found in "D:\Downloads\5.rar\Serve2.exe\[Embedded#0e0d0]" file.
2007-10-20 19:13:39 1192878819 Administrator 3736 Sign of "Win32:Visel-B [Trj]" has been found in "D:\Downloads\5.rar\Serve2.exe" file.
2007-10-20 19:13:39 1192878819 Administrator 3736 Sign of "Win32:Visel-B [Trj]" has been found in "D:\Downloads\5.rar\Serve3.exe\[Embedded#0e0d0]" file.
2007-10-20 19:13:39 1192878819 Administrator 3736 Sign of "Win32:Visel-B [Trj]" has been found in "D:\Downloads\5.rar\Serve3.exe" file.
2007-10-20 19:13:39 1192878819 Administrator 3736 Sign of "Win32:Visel-B [Trj]" has been found in "D:\Downloads\5.rar\qq.exe\[Embedded#0e0d0]" file.
2007-10-20 19:13:39 1192878819 Administrator 3736 Sign of "Win32:Visel-B [Trj]" has been found in "D:\Downloads\5.rar\qq.exe" file.

显示全部楼层 · 发表于 2007-10-20 19:18:28

费尔 6个

显示全部楼层 · 发表于 2007-10-20 19:19:56

kv2008 2个

显示全部楼层 · 发表于 2007-10-20 19:23:35

恩
RS 5个
别人的电脑就不试RS的主防了。。。。。。

显示全部楼层 · 发表于 2007-10-20 19:25:41

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Backdoor.Win32.ByShell.b

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.14.52

显示全部楼层 · 发表于 2007-10-20 19:26:52

红伞C 4个
Begin scan in 'C:\Download\新建文件夹.rar'
C:\Download\新建文件夹.rar
  [0] Archive type: RAR
  --> Serve1.exe
   [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.buw.1 Backdoor server programs
  --> Serve2.exe
   [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.buw.1 Backdoor server programs
  --> Serve3.exe
   [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.buw.1 Backdoor server programs
  --> qq.exe
   [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.buw.1 Backdoor server programs
   [INFO]    The file was renamed to '新建文件夹.rar.VIR'!

显示全部楼层 · 发表于 2007-10-20 19:32:35

Attempt to set value WinDir within the key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\

没有过DW 试图往启动项目添加键值

[ 本帖最后由秋叶濛濛于 2007-10-20 19:40 编辑 ]

[病毒样本] 质量不好(据说过HIPS)

本帖子中包含更多资源

5个

4 Viruses+1 suspicious

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块