红伞(C版)不报，其它报

显示全部楼层 · 发表于 2008-6-14 02:13:28

AhnLab-V3	2008.6.13.1	2008.06.13	-
AntiVir	7.8.0.55	2008.06.13	HEUR/Crypted
Authentium	5.1.0.4	2008.06.12	W32/Threat-SysVenFakU-based!Maximus
Avast	4.8.1195.0	2008.06.13	-
AVG	7.5.0.516	2008.06.13	Downloader.Agent.AHLK
BitDefender	7.2	2008.06.13	Trojan.Crypt.DJ
CAT-QuickHeal	9.50	2008.06.13	TrojanDownloader.Agent.slt
ClamAV	0.92.1	2008.06.13	PUA.Packed.UPack-2
DrWeb	4.44.0.09170	2008.06.13	DLOADER.Trojan
eSafe	7.0.15.0	2008.06.12	Suspicious File
eTrust-Vet	31.6.5871	2008.06.13	-
Ewido	4.0	2008.06.13	-
F-Prot	4.4.4.56	2008.06.12	W32/Threat-SysVenFakU-based!Maximus
F-Secure	6.70.13260.0	2008.06.13	W32/Suspicious_U.gen
Fortinet	3.14.0.0	2008.06.13	-
GData	2.0.7306.1023	2008.06.13	Trojan-Downloader.Win32.Agent.slt
Ikarus	T3.1.1.26.0	2008.06.13	Trojan-Downloader.Win32.Zlob.and
Kaspersky	7.0.0.125	2008.06.13	Trojan-Downloader.Win32.Agent.slt
McAfee	5317	2008.06.13	New Malware.aj
Microsoft	None	2008.06.13	-
NOD32v2	3185	2008.06.13	probably a variant of Win32/TrojanDownloader.Agent.NWV
Norman	5.80.02	2008.06.13	W32/Suspicious_U.gen
Panda	9.0.0.4	2008.06.12	Suspicious file
Prevx1	V2	2008.06.13	-
Rising	20.48.42.00	2008.06.13	-
Sophos	4.30.0	2008.06.13	Mal/Heuri-E
Sunbelt	3.0.1145.1	2008.06.05	VIPRE.Suspicious
Symantec	10	2008.06.13	-
TheHacker	6.2.92.346	2008.06.12	Trojan/Downloader.Agent.slt
VBA32	3.12.6.7	2008.06.12	-
VirusBuster	4.3.26:9	2008.06.12	Packed/Upack
Webwasher-Gateway	6.6.2	2008.06.13	Heuristic.Crypted

显示全部楼层 · 发表于 2008-6-14 02:15:41

貌似见过。症状是将正宗的explorer.exe移到system32,冒充货放在windows下
We received the following archive files:
File ID    Filename Size (Byte) Result
25045467    fyxe.rar 587.85 KB OK

A listing of files contained inside archives alongside their results can be found below:
File ID    Filename Size (Byte) Result
25045468    fyxe.ex    955.5 KB    UNDER ANALYSIS

显示全部楼层 · 发表于 2008-6-14 02:41:57

AntiVir 7.8.0.55 2008.06.13 HEUR/Crypted
???? 順道一說VT都是高啟發狀態的

显示全部楼层 · 发表于 2008-6-14 06:15:02

这病毒更新的也忒快了

显示全部楼层 · 发表于 2008-6-14 09:24:31

C:\Documents and Settings\Administrator\桌面\fyxe\fyxe.ex TrojanPSW.OnLineGames.wlu.kjdk 木马还未处理

kav 0

显示全部楼层 · 发表于 2008-6-14 10:23:27

费尔
文件名称名称性质
E:\fyxe.ex TrojanPSW.OnLineGames.wlu.kjdk 木马

显示全部楼层 · 发表于 2008-6-14 10:26:05

找不到所请求的 URL

在尝试检索 URL 时:

http://bbs.kafan.cn/attachment.php?aid=
285853&k=1ebd4d4bbf795d84fb23b4badff3c44
f&t=1213410243

遇到了下列错误:

所请求的对象已被感染了下列病毒: Trojan-Downloader.Win32.Agent.slt

如果您认为这是不正确的,请联系您的服务提供商。
生成于:
Sat Jun 14 10:26:25 2008
Kaspersky Internet Security 2009

显示全部楼层 · 发表于 2008-6-14 11:30:30

操作系统内核？？？

内核级木马？？？

显示全部楼层 · 发表于 2008-6-14 12:40:21

Begin scan in 'C:\Documents and Settings\haha\桌面\fyxe.ex'
C:\Documents and Settings\haha\桌面\fyxe.ex
[DETECTION] Contains suspicious code HEUR/Crypted
[NOTE] A backup was created as '48cb4c1a.qua' ( QUARANTINE )

显示全部楼层 · 发表于 2008-6-14 12:41:02

Begin scan in 'C:\Documents and Settings\haha\桌面\fyxe.ex'
C:\Documents and Settings\haha\桌面\fyxe.ex
[DETECTION] Contains suspicious code HEUR/Crypted
[NOTE] A backup was created as '48cb4c1a.qua' ( QUARANTINE )

网络卡了一下，，重复鸟。。

[病毒样本] 红伞(C版)不报，其它报

本帖子中包含更多资源