老外的小rk

显示全部楼层 · 发表于 2007-12-3 14:58:44

差远了
This rootkit is a pure "hider" (intrusion or hacker tool): it acts as an hidden service/driver.
But it does not hide its registry keys, that makes it easy to detect for users who know their system well.
In this example, we purposefully take the side and point of view of classical users who are not usually very knowledgeable about the ins and out of their pc on a deeperlevel, and therefore would like a clearer diagnosis of a rootkit presence.

显示全部楼层 · 发表于 2007-12-3 15:00:03

Starting the file scan:

Begin scan in 'E:\Oddysee.rar'
E:\Oddysee.rar
  [0] Archive type: RAR
  --> Oddysee.exe
   [DETECTION] Is the Trojan horse TR/Rkit.Agent.DM
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-12-3 15:00:43

Rootkit.Win32.Agent.dm

显示全部楼层 · 发表于 2007-12-3 15:03:54

卡巴杀

显示全部楼层 · 发表于 2007-12-3 15:05:55

C:\Documents and Settings\dell\桌面\Oddysee.rar >>RAR >>Oddysee.exe - Win32/Pegan.D 蠕虫

显示全部楼层 · 发表于 2007-12-3 15:10:16

小A
D:\Downloads\样本\Oddysee.rar\Oddysee.exe\[Embedded#0300]
Win32:Agent-FSN [Trj]
特洛伊木马

显示全部楼层 · 发表于 2007-12-3 15:35:08

显示全部楼层 · 发表于 2007-12-3 16:08:53

DR.WEB 4.44
D:\Temporary Internet Files\Content.IE5\OVV7EKPP\Oddysee[1].rar\Oddysee.exe - infected with Trojan.NtRootKit.267

Archive contains an infected item

显示全部楼层 · 发表于 2007-12-3 16:30:14

G:\Users\Administrator\Desktop\Oddysee.rar » RAR » Oddysee.exe - Win32/Pegan.D worm - was a part of the deleted object
G:\Users\Administrator\Desktop\Oddysee.rar - Win32/Pegan.D worm - deleted - quarantined

显示全部楼层 · 发表于 2007-12-3 18:44:21

運行之後，沒反應！

看誰來修好病毒

[病毒样本] 老外的小rk

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块