Backdoor runtime

显示全部楼层 · 发表于 2008-1-23 18:28:44

测测ecard

[ 本帖最后由 Nblock 于 2008-1-23 19:22 编辑 ]

显示全部楼层 · 发表于 2008-1-23 18:30:42

干掉了

显示全部楼层 · 发表于 2008-1-23 18:35:44

测试报告（都是NOD不杀的，杀了我不报告了）
1.exe经过测试，发现就是疯狂下网页

除此无任何可疑动作

ecard.exe尝试加载驱动RUNTIME被沙盘阻止估计是修改系统时间的东东

[ 本帖最后由 garyyan456 于 2008-1-23 18:38 编辑 ]

显示全部楼层 · 发表于 2008-1-23 18:38:04

detected: Trojan program Backdoor.Win32.Agobot.aor URL: http://bbs.kafan.cn/attachment.php?aid=188645//cherry.exe
detected: virus Packed.Win32.NSAnti.r URL: http://bbs.kafan.cn/attachment.php?aid=188646//ºÅÂë.com//data.rar//6.exe
detected: Trojan program Trojan.Win32.Delf.atj URL: http://bbs.kafan.cn/attachment.p ... skmgre.exe//VPacker

显示全部楼层 · 发表于 2008-1-23 18:59:01

13/1

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： RootKit.Win32.RESSDT .b

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.28.21

显示全部楼层 · 发表于 2008-1-23 18:59:41

21/4

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Packer.Win32.Mian007.a
病毒： Trojan.PSW.Win32.GameOL.ljo
病毒： Trojan.PSW.Win32.QQGame.by
病毒： RootKit.Win32.RESSDT .b

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.28.21

显示全部楼层 · 发表于 2008-1-23 19:00:21

12/2

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Malicious Code
病毒： Trojan.IMMSG.Win32.MsgSender.am

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.28.21

显示全部楼层 · 发表于 2008-1-23 19:13:51

Begin scan in 'C:\Documents and Settings\dell\桌面\Backdoor.rar'
C:\Documents and Settings\dell\桌面\
C:\Documents and Settings\dell\桌面\Backdoor.rar
  [0] Archive type: RAR
  --> eCard.scr
   [DETECTION] Contains detection pattern of the worm WORM/Ntech.AI
   [WARNING] Infected files in archives cannot be repaired!
  --> File3.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [WARNING] Infected files in archives cannot be repaired!
  --> baidu.exe
Begin scan in 'C:\Documents and Settings\dell\桌面\号码.rar'
C:\Documents and Settings\dell\桌面\
C:\Documents and Settings\dell\桌面\号码.rar
  [0] Archive type: RAR
--> ºÅÂë.com
   [1] Archive type: RAR SFX (self extracting)
   --> 6.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [WARNING] Infected files in archives cannot be repaired!
  --> 22.exe
   [DETECTION] Is the Trojan horse TR/Rootkit.Gen
   [WARNING] Infected files in archives cannot be repaired!
  --> 21.exe
   [DETECTION] Is the Trojan horse TR/Rootkit.Gen
   [WARNING] Infected files in archives cannot be repaired!
   [WARNING] The file was ignored!
   [DETECTION] Contains suspicious code HEUR/Crypted
   [WARNING] Infected files in archives cannot be repaired!
  --> 1.exe
   [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.cpj.4 Backdoor server programs
   [WARNING] Infected files in archives cannot be repaired!
  --> ht2.exe
   [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.vzw Backdoor server programs
   [WARNING] Infected files in archives cannot be repaired!
   [WARNING] The file was ignored!Begin scan in 'C:\Documents and Settings\dell\桌面\taskmgre.rar'
C:\Documents and Settings\dell\桌面\
C:\Documents and Settings\dell\桌面\taskmgre.rar
  [0] Archive type: RAR
  --> taskmgre.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Sma.dat.4.B
   [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was successfully wiped!
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2008-1-23 19:14:32

Rising20.28.21未杀，等待ing。。。

显示全部楼层 · 发表于 2008-1-23 19:28:18

江民杀4个

[病毒样本] Backdoor runtime

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

回复 3楼 garyyan456 的帖子

第二包

第一包

第三包

本帖子中包含更多资源