寻找感染EXPLORER.EXE的样本

Nblock

昨天晚上 某某浏览黄页遇到一病毒，这病毒感染系统进程EXPLORER.EXE，使它出现在微点的其他软件中    结果被微点删除。。

造成重启后看不到桌面   进程里也找不到explorer.exe  谁有相关的样本？ 谢谢。

[ 本帖最后由 Nblock 于 2008-1-21 21:17 编辑 ]

醉一生爱妍

C:\Documents and Settings\Administrator\桌面\badrkdemo.rar >>RAR >>badrkdemo.exe - 可能是 Win32/Rootkit 木马 的一个变种

[ 本帖最后由 garyyan456 于 2008-1-21 19:50 编辑 ]

Graybird

Starting the file scan:

Begin scan in 'E:\badrkdemo.rar'
E:\badrkdemo.rar
  [0] Archive type: RAR
  --> badrkdemo.exe
      [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.EP
      [INFO]      The file was deleted!

Nblock

谁有这样的样本？  这毒最近貌似好几个人中了

haol

avast found Win32:Trojan-gen {Other}
又一個

Joker

ACCESS DENIED
The requested URL could not be retrieved

--------------------------------------------------------------------------------

While trying to retrieve the URL: http://bbs.kafan.cn/attachment.php?aid=187400

The folowing error was encountered:

The requested object is INFECTED. The following viruses Rootkit.Win32.Agent.ep were found

Please contact your service provider if you feel this is incorrect.



--------------------------------------------------------------------------------

Generated Mon Jan 21 20:51:08 2008 by Kaspersky Internet Security 7.0




ACCESS DENIED
The requested URL could not be retrieved

--------------------------------------------------------------------------------

While trying to retrieve the URL: http://bbs.kafan.cn/attachment.php?aid=187402

The folowing error was encountered:

The requested object is INFECTED. The following viruses Rootkit.Win32.Agent.ep were found

Please contact your service provider if you feel this is incorrect.



--------------------------------------------------------------------------------

Generated Mon Jan 21 20:51:15 2008 by Kaspersky Internet Security 7.0

碧水寒潭

Start of the scan: 2008年1月21日  20:53

Starting the file scan:

Begin scan in 'I:\样本'
I:\样本\badrkdemo.rar
  [0] Archive type: RAR
  --> badrkdemo.exe
      [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.EP
      [INFO]      The file was deleted!

tracydk

xqiafl

gm.kv8.info/mm.exe

LZ  和我昨天一样啊. 那个黄网,中的毒网,我之前已经屏掉了.

但,这几天没上,它娘的又更新的网马地址. 当然,我没中招.

是我自己把病毒下载下来, 运行的.  然后, EXPLORER.EXE 挂掉了.

连影子都被突破了.  最好,还是从另一个文件夹中复制了一个EXPLORER.EXE 过来.

再搞定期

悠柚

BitDefender

This web page has been blocked by BitDefender Antivirus Real-time Protection!

The blocked web page included objects that were either infected or likely to be infected with a virus. Your system has NOT been infected.
Trojan.Rookit.Agent.EP第一个
第二个pass