http://bbs.kafan.cn/viewthread.php?tid=188445&extra=page%3D1&page=3

显示全部楼层 · 发表于 2008-1-18 21:56:55

http://bbs.kafan.cn/viewthread.php?tid=188445;extra=page%3D1&page=3&
样本释放的几个文件
大家扫一下,上传个结果

[ 本帖最后由 jehovah_king 于 2008-1-31 08:51 编辑 ]

显示全部楼层 · 发表于 2008-1-18 22:09:52

Begin scan in 'C:\Users\Administrator\Downloads\释放的.rar'

End of the scan: 2008年1月18日  22:09
Used time: 00:01 min

The scan has been done completely.

   0 Scanning directories
   9 Files were scanned
   0 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   9 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-1-18 22:10:14

D:\firefox download\释放的.rar » RAR » 新建文件夹\comadmin.dll - is OK
D:\firefox download\释放的.rar » RAR » 新建文件夹\comempty.dat - is OK
D:\firefox download\释放的.rar » RAR » 新建文件夹\comexp.msc - is OK
D:\firefox download\释放的.rar » RAR » 新建文件夹\comrepl.exe - is OK
D:\firefox download\释放的.rar » RAR » 新建文件夹\comrereg.exe - is OK
D:\firefox download\释放的.rar » RAR » 新建文件夹\mtsadmin.tlb - is OK
D:\firefox download\释放的.rar » RAR » 新建文件夹\smss.exe » FSG v2.0 - is OK

显示全部楼层 · 发表于 2008-1-18 22:11:25

3649511    comadmin.dll    190.5 KB    UNDER ANALYSIS
89000    comempty.dat    60 KB    KNOWN CLEAN
1043933    comexp.msc    75.53 KB    KNOWN CLEAN
513921    comrepl.exe    9.5 KB    KNOWN CLEAN
1043935    comrereg.exe    5 KB    KNOWN CLEAN
73827    mtsadmin.tlb    19 KB    KNOWN CLEAN
3649254    smss.exe    20.23 KB    MALWARE

上报antivir~

显示全部楼层 · 发表于 2008-1-18 22:17:53

smss.exe 只发现一个

显示全部楼层 · 发表于 2008-1-18 22:19:20

2008-1-18 22:19:34 Kernel File 'D:\firefox download\释放的.rar' was sent to ESET for analysis.

显示全部楼层 · 发表于 2008-1-18 22:19:59

The file 'comadmin.dll' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.

The file 'smss.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/Xorer.DF.3. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: PCK/FSG.

显示全部楼层 · 发表于 2008-1-18 22:20:28

显示全部楼层 · 发表于 2008-1-18 22:39:43

avast
未报

显示全部楼层 · 发表于 2008-1-19 09:30:12

D:\1\样本\释放的.rar\新建文件夹\smss.exe - infected with Trojan.Rox

Archive contains an infected item

[病毒样本] http://bbs.kafan.cn/viewthread.php?tid=188445&extra=page%3D1&page=3

本帖子中包含更多资源

Avira AntiVir

回复 4楼 Graybird 的帖子

本帖子中包含更多资源