rr.exe [md5:0668a3]

mofunzone

初号机+完全蜜罐系统果然最强，比malware listserv还率先捕获的rbot变种（实际我是在恶搞ikarus而已）-_-||
果然bd的引擎才是王道-_-||
File:         rr.exe
Status:         INFECTED/MALWARE
MD5:         0668a3a0343e3572d762ba19e7406590
Packers detected:         -
Bit9 reports:         File not found

Scanner results
Scan taken on 04 Dec 2007 05:02:17 (GMT)
A-Squared         Found nothing
AntiVir         Found HEUR/Crypted
ArcaVir         Found nothing
Avast         Found nothing
AVG Antivirus         Found BackDoor.PcClient.2.I
BitDefender         Found MemScan:Trojan.Agent.AFIE
ClamAV         Found PUA.Packed.Themida
CPsecure         Found nothing
Dr.Web         Found nothing
F-Prot Antivirus         Found nothing
F-Secure Anti-Virus         Found nothing
Fortinet         Found nothing
Ikarus         Found Backdoor.Win32.Rbot.boq
Kaspersky Anti-Virus         Found nothing
NOD32         Found nothing
Norman Virus Control         Found SDBot.gen8
Panda Antivirus         Found nothing
Rising Antivirus         Found nothing
Sophos Antivirus         Found nothing
VirusBuster         Found nothing
VBA32         Found nothing

[ 本帖最后由 mofunzone 于 2007-12-3 21:24 编辑 ]

sweeb

有没有搞错，居然每个都没附件？？？

mofunzone

你的网太快

sweeb

原帖由 <i>mofunzone</i> 于 2007-12-4 13:25 发表 <a href="http://bbs.kafan.cn/redirect.php?goto=findpost&pid=2208335&ptid=166132" target="_blank"><img src="http://bbs.kafan.cn/images/common/back.gif" border="0" onclick="zoom(this)" onload="attachimg(this, 'load')" alt="" /></a><br />
你的网太快

<br />
呵呵，呵呵

gogo8989

解压时提示需要另外的分卷

sam.to

卡巴不报,已上报

dericyeoh

will be deleted when the computer is restarted: Trojan program Backdoor.Win32.PcClient.bak        File: C:\Windows\System32\gadaou.dll               
deleted: Trojan program Rootkit.Win32.Agent.iz        File: C:\Windows\System32\drivers\gadaou.sys

gogo8989

FS扫描没报，沙盘报，

F:\迅雷和浏览器下载\RR\RR.EXE 中发现恶意代码。
感染: SDBot.gen8

aerbeisi

Ikarus不用恶搞，最新vb18个漏杀，26个误报，这个数据非常糟糕。

啊弥陀佛

程序出错 跑不起来