swf，谁来嗅探？(^_^)

qigang

[object]http://www.feifei110.cn/4561.swf
[object]http://www.feifei110.cn/4562.swf

allinwonderi

不是我

qianwenxiang

http://www.feifei110.cn/ms.exe

百度一下..

sam.to

to kl,antivir,pc security labs

[ 本帖最后由 kato9096 于 2008-6-5 20:38 编辑 ]

Starting the file scan:

Begin scan in 'E:\ms.exe'
E:\ms.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [NOTE]      The file was deleted!

红伞报启发, 是不是新的?

qigang

原帖由 qianwenxiang 于 2008-6-5 20:33 发表
http://www.feifei110.cn/ms.exe

百度一下..

我服了！


RS20.47.32未杀！

sam.to

原帖由 qianwenxiang 于 2008-6-5 20:33 发表
http://www.feifei110.cn/ms.exe

百度一下..

已刪除: 特洛伊木馬程式 Trojan.Win32.KillAV.ty        檔案: C:\Documents and Settings\kato9096\桌面\ms.rar/ms.exe//PE_Patch//UPack

qwer9909

ms.rar\ms.exe;C:\Documents and Settings\Administrator\桌面\ms.rar;Trojan.MulDrop.origin;;
ms.rar;C:\Documents and Settings\Administrator\桌面;发现压缩文件中有被感染的对象;;

sam.to

Filename         Result
4561.swf          MALWARE

The file '4561.swf' has been determined to be 'MALWARE'. Our analysts named the threat EXP/Flash.add. The term "EXP/" denotes malware that is able to detect and use certain security vulnerabilities whereby the attacker can get control of the system.Detection will be added to our virus definition file (VDF) with one of the next updates.
Filename         Result
4562.swf          MALWARE

The file '4562.swf' has been determined to be 'MALWARE'. Our analysts named the threat EXP/Flash.ade. The term "EXP/" denotes malware that is able to detect and use certain security vulnerabilities whereby the attacker can get control of the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

a256886572008

2008-06-05 21:16:52        應用程序防護(執行應用程序)     操作:使用沙箱操作
程序路徑:D:\桌面\virus\ms.exe
檔案路徑:C:\WINDOWS\system32\net.exe
指令列:stop "Security Center"

2008-06-05 21:16:54        應用程序防護(執行應用程序)     操作:使用沙箱操作
程序路徑:D:\桌面\virus\ms.exe
檔案路徑:C:\WINDOWS\system32\net.exe
指令列:stop "Windows Firewall/Internet Connection Sharing (ICS)"

2008-06-05 21:16:57        應用程序防護(執行應用程序)     操作:使用沙箱操作
程序路徑:D:\桌面\virus\ms.exe
檔案路徑:C:\WINDOWS\system32\net.exe
指令列:stop System Restore Service

2008-06-05 21:17:00        應用程序防護(執行應用程序)     操作:使用沙箱操作
程序路徑:D:\桌面\virus\ms.exe
檔案路徑:C:\WINDOWS\system32\net.exe
指令列:stop "Security Center"

2008-06-05 21:17:13        應用程序防護(執行應用程序)     操作:使用沙箱操作
程序路徑:D:\桌面\virus\ms.exe
檔案路徑:C:\WINDOWS\system32\cmd.exe
指令列:/c del D:\NTDUBECT.EXE