后门程序 微点第一次未报！

Nblock

2.exe

[ 本帖最后由 Nblock 于 2008-3-18 15:31 编辑 ]

mofunzone

antivir漏2个，nsis
Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\1'
C:\Documents and Settings\Administrator\My Documents\1\
  1.exe
  2.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: OVL
        --> Object
          [2] Archive type: OVL
          --> Object
            [3] Archive type: OVL
            --> Object
      [DETECTION] Contains suspicious code HEUR/Malware
      [NOTE]      The fund was classified as suspicious.
      [NOTE]      The file was moved to '484475a0.qua'!
  286.EXE
  ACPIDISK.SYS
      [DETECTION] Contains detection pattern of the rootkit RKIT/Cinmus.M
      [NOTE]      The file was moved to '482f75b5.qua'!
  DOSSSETUP.DLL
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/AdSpy.Gen
      [NOTE]      The file was moved to '483275c1.qua'!


End of the scan: 2008年3月17日  23:55
Used time: 00:05 min

The scan has been done completely.

      1 Scanning directories
      5 Files were scanned
      2 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      3 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      0 Archives were scanned
      0 Warnings
      3 Notes

mofunzone

Filename Result
286.EXE  MALWARE

The file '286.EXE' has been determined to be 'MALWARE'. Virus name is DROPPER (en) Detection will be added to our virus definition file (VDF) with one of the next updates.

Filename Result
1.exe  UNDER ANALYSIS

The file '1.exe' has been determined to be 'UNDER ANALYSIS'.

Nblock

有微点来测测那个后门  微点第一次竟然没有反应

yjwfn502

这不是报了吗?未报怎么说?

spaceplane

BD

项目: 1.rar DOSSSETUP.DLL
        检查档案: E:\pic\_PICtemp\新建.rar
        状态: 发现病毒
        病毒: Adware.Cinmus.Gen (BD 引擎)
项目: 1.rar=>286.EXE=>(NSIS o) lzma_nsis0000
        检查档案: E:\pic\_PICtemp\新建.rar
        状态: 发现病毒
        病毒: Adware.Cinmus.XY (BD 引擎)
项目: 1.rar=>286.EXE=>(NSIS o) lzma_nsis0002
        检查档案: E:\pic\_PICtemp\新建.rar
        状态: 发现病毒
        病毒: Adware.Cinmus.Gen (BD 引擎)

tanlimo

ESS扫描日志
病毒库版本: 2954 (20080318)
日期: 2008-3-18  时间: 15:20:25
已扫描的磁盘、文件夹和文件: D:\Documents and Settings\xx\桌面\新建 WinRAR 压缩文件.rar
D:\Documents and Settings\xx\桌面\新建 WinRAR 压缩文件.rar > RAR > 2.rar > RAR > 2.EXE - Win32/StartPage.NHW 特洛伊木马 的变种
D:\Documents and Settings\xx\桌面\新建 WinRAR 压缩文件.rar > RAR > 2.rar > RAR > HYXYOHNI.SYS - Win32/StartPage.ATV 特洛伊木马 的变种
D:\Documents and Settings\xx\桌面\新建 WinRAR 压缩文件.rar > RAR > 1.rar > RAR > DOSSSETUP.DLL - Win32/Adware.Cinmus 应用程序 的变种
D:\Documents and Settings\xx\桌面\新建 WinRAR 压缩文件.rar > RAR > 1.rar > RAR > 286.EXE > NSIS > DoSSSetup.dll - Win32/Adware.Cinmus 应用程序 的变种
已扫描的对象数: 11
发现的威胁数: 4
完成时间: 15:20:28  总扫描时间: 3 秒 (00:00:03)

stonejr

286.exe运行后红伞7报生成物
Virus or unwanted program 'RKIT/Cinmus.M [RKIT/Cinmus.M]'
detected in file 'C:\Documents and Settings\YCNET\Local Settings\Temp\acpidisk.sys.
Action performed: Delete file

2008-03-18 15:19:25        文件保护(创建文件)     操作:阻止
进程路径:C:\Documents and Settings\YCNET\桌面\新建 WinRAR 压缩文件\286.EXE
文件路径:C:\WINDOWS\system32\drivers\acpidisk.sys

2008-03-18 15:20:20        应用程序保护(运行应用程序)     操作:阻止
进程路径:C:\Documents and Settings\YCNET\桌面\新建 WinRAR 压缩文件\SYSCHC.EXE
文件路径:C:\WINDOWS\system32\rundll32.exe
命令行:C:\WINDOWS\system32\beginup.dll,_StartRun@16

[ 本帖最后由 stonejr 于 2008-3-18 15:22 编辑 ]

啊弥陀佛

微点砍掉

taiw_1144

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.610\2.EXE
是否删除病毒程序?

木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.438\ACPIDISK.SYS
是木马程序!
已成功阻止其运行,是否要删除此文件?

都是一运行就报的