一个可以过很多著名引擎的“小文件”

显示全部楼层 · 发表于 2008-8-22 11:32:40

难道过了江民的自我保护

显示全部楼层 · 发表于 2008-8-22 12:18:47

这个东西向WINDOWS和system32目录下写文件时江民的09智能主防为何没有反应呢？

schrars.exe:1024 218.75.220.85:8003

地址：湖南省株洲市电信ADSL

[ 本帖最后由 tanlimo 于 2008-8-22 12:28 编辑 ]

显示全部楼层 · 发表于 2008-8-22 13:59:47

to lab

显示全部楼层 · 发表于 2008-8-22 15:16:27

kis8已杀

显示全部楼层 · 发表于 2008-8-24 01:33:59

原帖由 tanlimo 于 2008-8-22 12:18 发表
这个东西向WINDOWS和system32目录下写文件时江民的09智能主防为何没有反应呢？

340987

schrars.exe:1024 218.75.220.85:8003

地址：湖南省株洲市电信ADSL

那是AV终结者木马的客户端地址，就是控制地址，你的机器成RJ了。

显示全部楼层 · 发表于 2008-8-24 02:11:37

BD，直接阻止下载

显示全部楼层 · 发表于 2008-8-24 10:16:00

迅雷下载有提示·····

NOD32 也报了

[:14:]

显示全部楼层 · 发表于 2008-8-24 10:22:34

都不敢下载了，怕中招

显示全部楼层 · 发表于 2008-8-24 12:14:50

Norton found W32.SillyDC

显示全部楼层 · 发表于 2008-8-24 12:24:55

Begin scan in 'C:\Documents and Settings\Administrator\桌面\RAVSYS.rar'
C:\Documents and Settings\Administrator\桌面\RAVSYS.rar
[0] Archive type: RAR
--> RAVSYS\RAVSYS\RAVSYS.EXE
   [DETECTION] Is the TR/Downloader.Gen Trojan
[NOTE]    The file was moved to '4906e223.qua'!

End of the scan: 2008年8月24日星期日  12:21
Used time: 00:08 Minute(s)

The scan has been done completely.

   0 Scanning directories
   2 Files were scanned
   1 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   1 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   0 Warnings
   1 Notes

[病毒样本] 一个可以过很多著名引擎的“小文件”

ArcaVir2008, F-Prot 4.4.4,NVC 5.99