疑似木马x3

qianwenxiang

http://ssta.vicp.cc/%E4%B8%8A%E4%BC%A0%E6%96%87%E4%BB%B6/cf.exe  (Radmin)
http://ssta.vicp.cc/%E4%B8%8A%E4%BC%A0%E6%96%87%E4%BB%B6/cftom.exe
http://ssta.vicp.cc/%E4%B8%8A%E4%BC%A0%E6%96%87%E4%BB%B6/cftom.rar

从清泉某列表里面挖出来的

[ 本帖最后由 qianwenxiang 于 2008-3-18 18:18 编辑 ]

spaceplane

BD 全飘

[ 本帖最后由 spaceplane 于 2008-3-18 19:42 编辑 ]

nosferatu

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\pack.rar'
C:\Documents and Settings\Administrator\桌面\pack.rar
  [0] Archive type: RAR
    --> cftom.rar
      [1] Archive type: RAR
      --> cftom.exe
          [DETECTION] Contains detection pattern of the application APPL/Rmadmin.17408
  --> cf.exe
      [DETECTION] Contains detection pattern of the application APPL/Rmadmin.17408
  --> cftom.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [INFO]      The file was deleted!

250662772

用的花生壳域名

tanlimo

ess扫描日志
病毒库版本: 2954 (20080318)
日期: 2008-3-18  时间: 19:45:08
已扫描的磁盘、文件夹和文件: D:\Documents and Settings\xx\桌面\pack.rar
D:\Documents and Settings\xx\桌面\pack.rar > RAR > cftom.rar > RAR > cftom.exe > PECompact v2.xx - Win32/RemoteAdmin 应用程序 的变种
D:\Documents and Settings\xx\桌面\pack.rar > RAR > cf.exe > PECompact v2.xx - Win32/RemoteAdmin 应用程序 的变种
D:\Documents and Settings\xx\桌面\pack.rar > RAR > cftom.exe > PECompact v2.xx - 解压错误
已扫描的对象数: 3
发现的威胁数: 2
完成时间: 19:47:32  总扫描时间: 144 秒 (00:02:24)

hahacomcn

原帖由 tanlimo 于 2008-3-18 19:47 发表
ess扫描日志
病毒库版本: 2954 (20080318)
日期: 2008-3-18  时间: 19:45:08
已扫描的磁盘、文件夹和文件: D:\Documents and Settings\xx\桌面\pack.rar
D:\Documents and Settings\xx\桌面\pack.rar > RAR > cf ...

红伞全保。。。

呵呵，，脱壳脱得卡吧。

28654621

费尔不认识

Palkia

卡巴不认识~

wangjay1980

2秒就搞定了
detected: riskware not-a-virus:RemoteAdmin.Win32.RAdmin.20        File: C:\Documents and Settings\Owner\×ÀÃæ\pack.rar/cftom.rar/cftom.exe//PE_Patch.PECompact//PecBundle//PECompact//#//NSPack//NSPack
detected: riskware not-a-virus:RemoteAdmin.Win32.RAdmin.20        File: C:\Documents and Settings\Owner\×ÀÃæ\pack.rar/cf.exe//PE_Patch.PECompact//PecBundle//PECompact//#//NSPack//NSPack


Hello,

cf.exek, cftom.exek - Backdoor.Win32.VB.cuj

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

cftom.exekk

This file is corrupted.

Please quote all when answering.

--
Best regards, Vladimir Krylov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: pack.rar

[ 本帖最后由 wangjay1980 于 2008-3-18 23:57 编辑 ]

傻猪猪米走鸡

D:\firefox download\pack.rar » RAR » cftom.rar » RAR » cftom.exe » PECompact v2.xx - a variant of Win32/RemoteAdmin application
D:\firefox download\pack.rar » RAR » cf.exe » PECompact v2.xx - a variant of Win32/RemoteAdmin application
D:\firefox download\pack.rar » RAR » cftom.exe » PECompact v2.xx - unpack error
D:\firefox download\pack.rar:Zone.Identifier - is OK