来一个后门

显示全部楼层 · 发表于 2008-5-7 23:49:17

Begin scan in 'D:\Downloads\样本\taglog.rar'
D:\Downloads\样本\taglog.rar
  [0] Archive type: RAR
  --> taglog.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [NOTE]    The file was deleted!

End of the scan: 2008年5月7日  23:49
Used time: 00:03 min

The scan has been done completely.

   0 Scanning directories
   2 Files were scanned
   1 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   0 Warnings
   1 Notes

显示全部楼层 · 发表于 2008-5-7 23:50:13

显示全部楼层 · 发表于 2008-5-7 23:59:20

拦截

Backdoor.Win32.Turkojan.il

显示全部楼层 · 发表于 2008-5-8 00:05:08

C:\Documents and Settings\Administrator\桌面\virus\cmsetac.dll - Win32/Cakl.NAG 木马

做了免杀.

[ 本帖最后由 scottxzt 于 2008-5-8 00:08 编辑 ]

显示全部楼层 · 发表于 2008-5-8 00:05:47

卡巴8.0

显示全部楼层 · 发表于 2008-5-8 00:05:49

McAfee New Win32

显示全部楼层 · 发表于 2008-5-8 00:13:06

2008-05-08 00:09:27 应用程序保护(加载驱动程序)    操作:阻止
进程路径:C:\windows\system32\services.exe
驱动路径:C:\windows\system32\drivers\amon.sys

2008-05-08 00:10:13 文件保护(修改文件)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\virus\taglog.exe
文件路径:C:\windows\VMPipe32.dll
2008-05-08 00:10:23 应用程序保护(结束/挂起进程)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\virus\taglog.exe
目标进程:C:\windows\Explorer.EXE
2008-05-08 00:10:23 应用程序保护(运行应用程序)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\virus\taglog.exe
文件路径:C:\windows\system32\cmd.exe
命令行:/c ""C:\Documents and Settings\Administrator\桌面\virus\Uninstall.bat" C:\Documents and Settings\Administrator\桌面\virus\taglog.exe"

显示全部楼层 · 发表于 2008-5-8 04:36:39

还好ESET 没让我失望

显示全部楼层 · 发表于 2008-5-8 05:58:56

[病毒样本] 来一个后门

本帖子中包含更多资源

本帖子中包含更多资源

报生成的DLL文件

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源