一些

显示全部楼层 · 发表于 2008-6-15 21:04:16

http://nb88.cn/search/wincap.exe
http://nb88.cn/search/arp.exe
http://lkjhg.orgorg.cn/ai.exe
http://nb88.cn/search/psaaa.exe
http://lkjhg.orgorg.cn/r3a2.exe

显示全部楼层 · 发表于 2008-6-15 21:08:46

http://lkjhg.orgorg.cn/ai.exe

http://lkjhg.orgorg.cn/r3a2.exe

显示全部楼层 · 发表于 2008-6-15 21:10:17

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Backdoor.Win32.PcClient.eki

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.48.62

显示全部楼层 · 发表于 2008-6-15 21:13:50

[Scanning : C:\Documents and Settings\All Users\Documents\Test]

C:\Documents and Settings\All Users\Documents\Test\virus.rar<RAR>:arp.exe <- Trojan.Pakes.Cux : No action
C:\Documents and Settings\All Users\Documents\Test\virus.rar<RAR>:wincap.exe<FSG>:wincap.exe <- Trojan.Psw.Onlinegames.Fq : No action

Scanned objects : 9

Infected objects : 2

显示全部楼层 · 发表于 2008-6-15 21:14:26

[Found backdoor] <W32/PcClient.C.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\virus.rar->psaaa.exe
[Found possible security risk] <W32/Heuristic-210!Eldorado (not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\virus.rar->arp.exe->(NSPack)->(Klone.AF)->(PE_Patch)->(PECRC)->(Klone.AF)->(NSPack)->(PE_Patch)->(NSPack)->(PE_Patch)

---------------------------------------------------------------------
Scan ended: 2008-6-15, 21:14:10
Duration: 0:00:09

Scan result:

Scanned files:    6
Infected objects:    2
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

显示全部楼层 · 发表于 2008-6-15 21:15:14

加了这么多层壳，真BT。

显示全部楼层 · 发表于 2008-6-15 21:37:54

Begin scan in 'C:\Documents and Settings\haha\桌面\virus.rar'
C:\Documents and Settings\haha\桌面\virus.rar
  [0] Archive type: RAR
  --> psaaa.exe
   [DETECTION] Contains detection pattern of the dropper DR/PcClient.Gen
  --> arp.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> wincap.exe
   [DETECTION] Contains suspicious code HEUR/Crypted
   [NOTE]    A backup was created as '48c71b8a.qua'  ( QUARANTINE )

显示全部楼层 · 发表于 2008-6-15 23:35:36

D:\firefox download\virus.rar » RAR » psaaa.exe - a variant of Win32/PcClient trojan
D:\firefox download\virus.rar » RAR » arp.exe - Win32/HackTool.ArpSnoof.B trojan
D:\firefox download\virus.rar » RAR » wincap.exe » FSG v2.0 - is OK
D:\firefox download\virus.rar:Zone.Identifier - is OK

[病毒样本] 一些

死链接！

8/1

本帖子中包含更多资源

ArcaVir2008

F-Prot 4.4.4