又过~setup~

显示全部楼层 · 发表于 2008-3-17 17:50:19

程序:
D:\MCAFEE\TMP\RAR$EX00.203\SETUP.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ALL USERS\「开始」菜单\程序\启动\~.EXE.62759218.EXE
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2008-3-17 20:32:56

rising20.36.02未杀！

显示全部楼层 · 发表于 2008-3-17 20:53:54

McAfee miss

显示全部楼层 · 发表于 2008-3-17 21:28:46

Please find a detailed report concerning each individual sample below:

Filename

Result

setup.exe

MALWARE

The file 'setup.exe' has been determined to be 'MALWARE'.
Our analysts named the threat DR/Agent.GVH. The term "DR/" denotes a program that is able to place a virus or a malware discretely on a system.Detection will be added to our virus definition file (VDF) with one of the next updates.

显示全部楼层 · 发表于 2008-3-17 21:55:28

奇怪,怎么不是Xorer

显示全部楼层 · 发表于 2008-3-17 21:55:33

ArcaBit miss.

显示全部楼层 · 发表于 2008-3-17 21:59:39

dark去哪里找的？

显示全部楼层 · 发表于 2008-3-17 23:20:45

现在红伞报了。

Begin scan in 'C:\virus\setup.rar'
C:\virus\setup.rar
  [0] Archive type: RAR
  --> setup.exe
   [DETECTION] Contains detection pattern of the dropper DR/Agent.GVH
   [1] Archive type: RAR SFX (self extracting)
   --> Setup.exe
      [DETECTION] Is the Trojan horse TR/Xorer.94208
   [INFO]    The file was moved to '48528c84.qua'!

显示全部楼层 · 发表于 2008-3-18 01:20:35

你这个是setup.exe报的，里面解压出来还有一个东西
昨天我帮xorer变种，总共让antivir添加了
TR/Xorer.94208
TR/Xorer.174009
TR/Drop.Xore.124727
这3个特征，希望最近的免杀可以少一些，而且如果变种过多，antivir就会考虑出基因的

显示全部楼层 · 发表于 2008-3-18 13:43:45

麦咖啡运行了下这个家伙，直接重启。难道要换？

[病毒样本] 又过~setup~

4/0

回复 14楼 llgiggs 的帖子

回复 18楼 capsshift 的帖子

浏览过的版块