强

挪威的冬天

又是 cab 。。。 之前好像发过了 解包继续杀

病毒        2008-02-10  22:59:21        病毒在文件C:\Users\挪威的冬天\Desktop\TEST_01\TEST 01\ok.exe中        Win32.Troj.PcClientT.ex.61815        处理成功（操作：删除）       


不解包因为 cab 的关系所以继续飘 ~

woshilizhongqi

驱逐舰 pass

spatra

微点过.....
拉动文件后程序出错，创建服务，然后....

冷冷

IK
I:\virus\TEST_01.zip:\TEST 01.EXE - Signature 'Backdoor.Win32.Hupigon.eez' found
I:\virus\TEST_01.zip

        2 Files scanned
          (1 Archiv with 1 file)
        1 Signature found
        0 Suspect code-parts found
        Used time: 0:00.079

----------------------------




[ 本帖最后由 冷_冷 于 2008-2-11 00:29 编辑 ]

saga3721

Virus or unwanted program 'BDS/Pcclient.atg.1 [BDS/Pcclient.atg.1]'

Graybird

Starting the file scan:

Begin scan in 'E:\virus\system32.rar'
E:\virus\system32.rar
  [0] Archive type: RAR
  --> system32\pkgnek.dll0
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Pcclient.atg.1 Backdoor server programs
      [WARNING]   The file was ignored!

The file '00045834.ini' has been determined to be 'KNOWN CLEAN'. In particular this means that we could not find any malicious content. Please note that the file is part of 'F-Secure Anti-Virus 5.10-450'.

The file 'pkgnek.sys' has been determined to be 'UNDER ANALYSIS'

[ 本帖最后由 Graybird 于 2008-2-11 06:26 编辑 ]

Graybird

Starting the file scan:

Begin scan in 'E:\virus\TEST_01.zip'
E:\virus\TEST_01.zip
  [0] Archive type: ZIP
  --> TEST 01.EXE
      [DETECTION] Contains detection pattern of the dropper DR/PcClient.bbe
      [INFO]      The file was deleted!

qigang

4/1

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Win32.Undef.agn   

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.30.60

Graybird

The file 'pkgnek.sys' has been determined to be 'MALWARE'. Our analysts named the threat BDS/Pcclient.bct. The term "BDS/" denotes a Backdoor-Server program. Backdoor-Server programs are used to spy out, modify or delete data.Detection is added to our virus definition file (VDF) starting with version 7.00.02.117.

zeroten

微点报未知