Shadow Defender 1.1.0.275被穿！样本，大家测试下

noldna

Shadow Defender 1.1.0.275被穿！样本，大家测试下

主要是看穿不穿SD 275不？


我电脑C D分区,C是SD保护，为排除其他盘启动后感染的可能，SD影子状态下格式化了D盘，重启后依旧中毒

为了安全附件设个密码0

有人反映说可能样本提取不全，这种情况下 觉得那个userinit.exe 是不是需要替换系统文件后才行
今天重新提取了样本并找到了下载木马列表kn.txt
下载者木马列表有34个，其中16个能下载下来
大家测试下
将近20个 还不确定那个是穿还原的木马

[ 本帖最后由 noldna 于 2008-11-5 12:57 编辑 ]

尤金卡巴斯基

2008/11/4 21:21:20 已删除 木马程序 Trojan-GameThief.Win32.MultiFirst.h G:\Temp\Virus\穿SD275样本密码0.rar/System.exe//PE_Patch//UPack  
2008/11/4 21:20:03 已清除 木马程序 Trojan-Downloader.Win32.Agent.anoe G:\Temp\Virus\穿SD275样本密码0.rar/userinit.exe

[ 本帖最后由 尤金卡巴斯基 于 2008-11-4 21:22 编辑 ]

浪滔天

卡8 全灭

wangjay1980

2008-11-4 JAY21:20:12        Untreated        Trojan program        Trojan-Downloader.Win32.Agent.anoe        High        Exact        C:\Documents and Settings\Owner\桌面\穿SD275样本密码0.rar/userinit.exe        Postponed       
2008-11-4 JAY21:20:12        Untreated        Trojan program        Trojan-GameThief.Win32.MultiFirst.h        High        Exact        C:\Documents and Settings\Owner\桌面\穿SD275样本密码0.rar/System.exe/PE_Patch/UPack        Postponed       
很老了

BING126

McAfee  报了1个。。

System.exe      PWS-Mmorpg.gen

userinit.exe      no

fzz8848

Begin scan in 'E:\Download\Virus\穿SD275样本密码0'
E:\Download\Virus\穿SD275样本密码0\System.exe
    [DETECTION] Is the TR/Spy.Agent.nxa Trojan
    [NOTE]      The file was deleted!
E:\Download\Virus\穿SD275样本密码0\userinit.exe
    [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      The file was deleted!


End of the scan: 2008年11月4日星期二  22:03
Used time: 00:05 Minute(s)

The scan has been done completely.

      1 Scanning directories
      2 Files were scanned
      2 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      2 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      0 Files not concerned
      0 Archives were scanned
      0 Warnings
      2 Notes

tcgg1983

费尔解压报告，微点报告

啊弥陀佛

微点拦截

Killer_cg

红伞不报的说！

superwin

Dr.web 解压缩时候  C:\Documents and Settings\computer door\桌面\穿SD275样本密码0\System.exe - 已感染 Trojan.Starter.600

小A竟然没报，哭泣中......