病毒样本，用txt伪装的，两个被卡巴斯基杀了

a87750530

检测到：木马程序 Trojan.BAT.Qrap 文件: C:\Documents and Settings\cxsh\桌面\黑客命令集.rar/黑客命令集\批处理教程.txt
检测到：木马程序 Trojan-Downloader.Win32.OpenPort.a 文件: C:\Documents and Settings\cxsh\桌面\黑客命令集.rar/黑客命令集\远程DOS下开3389.txt

nosferatu

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\黑客命令集.rar'
C:\Documents and Settings\Administrator\桌面\黑客命令集.rar
  [0] Archive type: RAR
  --> ºÚ¿ÍÃüÁ\ÎåÖÖ°ì·¨¿ªÆô3389ÖÕ¶Ë.txt
      [DETECTION] Is the Trojan horse TR/OpenPort.A.7
  --> ºÚ¿ÍÃüÁ\ÀûÓÃTELNET¿ª·Å3389¶Ë¿Ú.txt
      [DETECTION] Is the Trojan horse TR/OpenPort.A.8
  --> ºÚ¿ÍÃüÁ\Åú´¦Àí½Ì³Ì.txt
      [DETECTION] Contains detection pattern of the batch virus BAT/Munga
  --> ºÚ¿ÍÃüÁ\Öն˷þÎñÈ«¹¥ÂÔ.txt
      [DETECTION] Is the Trojan horse TR/OpenPort.A.6
  --> ºÚ¿ÍÃüÁ\Ô¶³ÌDOSÏ¿ª3389.txt
      [DETECTION] Is the Trojan horse TR/OpenPort.A.9
  --> ºÚ¿ÍÃüÁ\Ô¶³Ì¿ªÆô3389Öն˷þÎñ.txt
      [DETECTION] Is the Trojan horse TR/OpenPort.A.5
      [INFO]      The file was deleted!


End of the scan: 星期五 2008年2月22日  11:31
Used time: 00:09 min

The scan has been done completely.

      0 Scanning directories
    110 Files were scanned
      6 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted

Graybird

Starting the file scan:

Begin scan in 'E:\AntiVir\黑客命令集.rar'
E:\AntiVir\黑客命令集.rar
  [0] Archive type: RAR
  --> ºÚ¿ÍÃüÁ\ÎåÖÖ°ì·¨¿ªÆô3389ÖÕ¶Ë.txt
      [DETECTION] Is the Trojan horse TR/OpenPort.A.7
  --> ºÚ¿ÍÃüÁ\ÀûÓÃTELNET¿ª·Å3389¶Ë¿Ú.txt
      [DETECTION] Is the Trojan horse TR/OpenPort.A.8
  --> ºÚ¿ÍÃüÁ\Åú´¦Àí½Ì³Ì.txt
      [DETECTION] Contains detection pattern of the batch virus BAT/Munga
  --> ºÚ¿ÍÃüÁ\Öն˷þÎñÈ«¹¥ÂÔ.txt
      [DETECTION] Is the Trojan horse TR/OpenPort.A.6
  --> ºÚ¿ÍÃüÁ\Ô¶³ÌDOSÏ¿ª3389.txt
      [DETECTION] Is the Trojan horse TR/OpenPort.A.9
  --> ºÚ¿ÍÃüÁ\Ô¶³Ì¿ªÆô3389Öն˷þÎñ.txt
      [DETECTION] Is the Trojan horse TR/OpenPort.A.5
      [WARNING]   The file was ignored!

swans

全被费尔杀了

闪电战

怀疑是里面的什么命令被卡巴拦截了，而不是真的有毒

傻猪猪米走鸡

just some txt

挪威的冬天

只是 TXT 而已。。。

Graybird

---------------------------------------------------------
AVG Anti-Spyware - 扫描报告
---------------------------------------------------------

+ 创建时间:        13:03:48 2008-2-22

+ 扫描结果:       



E:\AntiVir\黑客命令集.rar/ºÚ¿ÍÃüÁ\ÀûÓÃTELNET¿ª·Å3389¶Ë¿Ú.txt -> Trojan.OpenPort.a : 未进行操作.
E:\AntiVir\黑客命令集.rar/ºÚ¿ÍÃüÁ\Ô¶³ÌDOSÏ¿ª3389.txt -> Trojan.OpenPort.a : 未进行操作.
E:\AntiVir\黑客命令集.rar/ºÚ¿ÍÃüÁ\Åú´¦Àí½Ì³Ì.txt -> Trojan.Qrap : 未进行操作.


::报告结束

3

wolffshen

只是txt文件而已啊，哪来什么伪装啊？

noissy

晕了 还伪装