第536次更新orz下载器，见1887楼.（过主流高品质）

显示全部楼层 · 发表于 2008-12-13 13:44:24

原帖由 935623508 于 2008-12-13 12:12 发表
12.13 To KL

C:\Documents and Settings\GUNDAM\桌面\orz.rar » RAR » orz.exe - probably a variant of Win32/TrojanDownloader.Agent.ONB trojan

显示全部楼层 · 发表于 2008-12-13 14:03:46

被nis2009 自動防護攔截了

显示全部楼层 · 发表于 2008-12-13 18:31:06

原帖由 935623508 于 2008-12-13 12:12 发表
12.13 To KL

2008/12/13 18:29:33 已清除木马程序 Trojan-Dropper.Win32.Agent.abku G:\Temp\Virus\orz.rar/orz.exe//UPX

显示全部楼层 · 发表于 2008-12-15 18:06:09

After the weekends~
To KL

显示全部楼层 · 发表于 2008-12-15 20:46:24

微点杀

显示全部楼层 · 发表于 2008-12-16 18:39:02

今天抓的样本不知道为什么还连带了几个dll?
To KL

显示全部楼层 · 发表于 2008-12-16 21:00:10

\orz.rar
[0] Archive type: RAR
   --> system.dll
      --> Object
      [2] Archive type: RSRC
      --> Object
         [DETECTION] Contains recognition pattern of the RKIT/Agent.fkp root kit
      --> Object
         [DETECTION] Is the TR/Agent.avcj Trojan
--> orz.exe
   [DETECTION] Is the TR/Dropper.Gen Trojan
   --> dll953.dll
      --> Object
      [2] Archive type: RSRC
      --> Object
         [DETECTION] Contains recognition pattern of the RKIT/Agent.fkp root kit
      --> Object
         [DETECTION] Is the TR/Agent.avcj Trojan
[NOTE]    The file was deleted!

End of the scan: 2008年12月16日星期二  20:58
Used time: 00:08 Minute(s)

The scan has been done completely.

   0 Scanning directories
   5 Files were scanned
   5 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   0 Files not concerned
   1 Archives were scanned
   0 Warnings
   1 Notes

显示全部楼层 · 发表于 2008-12-16 22:59:09

C:\Documents and Settings\Administrator\桌面\orz.rar > RAR > system.dll - 可能是 Win32/TrojanDownloader.Agent.OMQ 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\orz.rar > RAR > orz.exe - 可能是 Win32/TrojanDownloader.Agent.OMQ 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\orz.rar > RAR > 9153.dll - Win32/TrojanDownloader.Agent.OOA 特洛伊木马
C:\Documents and Settings\Administrator\桌面\orz.rar > RAR > dll953.dll - 可能是 Win32/TrojanDownloader.Agent.OMQ 特洛伊木马的变种

显示全部楼层 · 发表于 2008-12-17 01:45:17

原帖由 935623508 于 2008-12-16 18:39 发表
今天抓的样本不知道为什么还连带了几个dll?
To KL

微点杀。。

显示全部楼层 · 发表于 2008-12-17 04:44:40

D:\Download\orz(2).rar » RAR » system.dll - probably a variant of Win32/TrojanDownloader.Agent.OMQ trojan
D:\Download\orz(2).rar » RAR » orz.exe - probably a variant of Win32/TrojanDownloader.Agent.OMQ trojan
D:\Download\orz(2).rar » RAR » 9153.dll - Win32/TrojanDownloader.Agent.OOA trojan
D:\Download\orz(2).rar » RAR » dll953.dll - probably a variant of Win32/TrojanDownloader.Agent.OMQ trojan

[病毒样本] 第536次更新orz下载器，见1887楼.（过主流高品质）

本帖子中包含更多资源

本帖子中包含更多资源

回复 146楼 935623508 的帖子