一个可疑屏保（附加注册表信息）穿了Kis8？？？？

wsboy

2008-10-05 22:45
[BackDoor]
C:\WINDOWS\SYSTEM32\RVECSE.SCR
HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET001\SERVICES\WINDOWS RVECSE
HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET002\SERVICES\WINDOWS RVECSE
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\WINDOWS RVECSE

[2.8.1.8.0815 - 2.8.16.8.1005]
2008-10-05 22:45
[Risk.PCHealthCenter]
C:\WINDOWS\SYSTEM32\2.ICO

kingmuro

卡巴2009不报，驱逐舰也不报

wangjay1980

尸体？

[ 本帖最后由 wangjay1980 于 2008-10-5 23:22 编辑 ]

The EQs

C:\Users\Administrator\Desktop\1\7_200810052245200656\C\WINDOWS\SYSTEM32\RVECSE.SCR - a variant of Win32/Delf.NGT trojan

无尽藏海

Scan Stats:
  Scan Time: 3 seconds
  Scan Options:
  Scan Targets: D:\Virus\1.part2\7_200810052245200656.zip
  Counts:
   Total items scanned: 4
   - Files & Directories: 4
   - Registry Entries: 0
   - Processes & Start-up Items: 0
   - Network & Browser Items: 0
   - Other: 0
   - Trusted Files: 0
   - Skipped Files: 0

   Total security risks detected: 1
   Total items resolved: 1
   Total items that require attention: 0

Resolved Threats:
Backdoor.Trojan
Type: Compressed
Risk: High (High Stealth, High Removal, High Performance, High Privacy)  
Categories: Virus
Status: Fully Resolved
-----------
1 File
[rvecse.scr] inside of [d:\virus\1.part2\7_200810052245200656.zip] - Deleted




Unresolved Threats:

wangjay1980

http://www.threatexpert.com/repo ... 79ac4346959a46ea635

Visit ThreatExpert web site

|

Close Report

Submission Summary:

• Submission details:
  • Submission received: 6 October 2008, 02:16:51
  • Processing time: 5 min 23 sec
  • Submitted sample:
    • File MD5: 0x71471DD8C385779AC4346959A46EA635
    • Filesize: 529,408 bytes
    • Alias: Backdoor.Trojan [Symantec], Backdoor:Win32/Delf.RAL [Microsoft]

• Summary of the findings:

What's been found	Severity Level
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File MD5	Alias
1	[file and pathname of the sample #1]	529,408 bytes	0x71471DD8C385779AC4346959A46EA635	Backdoor.Trojan [Symantec] Backdoor:Win32/Delf.RAL [Microsoft]

Memory Modifications

• The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
[filename of the sample #1]	[file and pathname of the sample #1]	Process name: [generic host process] Process filename: [generic host process filename] Address space: 0x8F0000 - 0xA00000

• Note:
  • [generic host process filename] is a full path filename of [generic host process].

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.
The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.
Copyright © 2008 ThreatExpert. All rights reserved.

Kitman

Starting the file scan:

Begin scan in 'C:\Users\TOSHIBA\Desktop\1'
C:\Users\TOSHIBA\Desktop\1\7_200810052245200656\C\WINDOWS\SYSTEM32\RVECSE.SCR
    [DETECTION] Contains recognition pattern of the WORM/Otwycal.J worm
    [NOTE]      A backup was created as '492ef18b.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!


End of the scan: 2008年10月6日  19:06
Used time: 00:02 Minute(s)

The scan has been done completely.

      5 Scanning directories
      3 Files were scanned
      1 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      0 Archives were scanned
      0 Warnings
      1 Notes

BING126

McAfee  miss