【转帖】过年了 发无壳免杀远控玩玩 过 瑞 江 卡 金 NOD 大蜘蛛 驱逐舰 铁门 咖啡

wsmurderer

生成服务端
程序：
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\抽筋个人版远控10月24日.EXE
木马程序生成以下文件：
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\抽筋~~服务端.EXE
2) C:\WINDOWS\SYSTEM32\SERVERGMH.DLL
3) C:\WINDOWS\SYSTEM32\SERVERGMH.DLL
4) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\抽筋~~服务端.EXE
是否删除木马程序及其衍生物?

saga3721

We received the following archive files:



File ID 燜ilename Size (Byte) Result
25243674  choujin.rar 3.82 MB OK

A listing of files contained inside archives alongside their results can be found below:

File ID 燜ilename Size (Byte) Result
25243675  ##############10#...##.exe  1.7 MB  DAMAGED FILE (UNKNOWN)
25243676  xp_corona.ssk  78.13 KB  CLEAN
540256  offline.wav  86.44 KB  CLEAN
25243677  online.wav  46.51 KB  CLEAN
540254  downfile.wav  75.43 KB  CLEAN
540255  login.wav  88.36 KB  CLEAN
540257  setting.wav  128.84 KB  CLEAN
540258  upfile.wav  73.56 KB  CLEAN
25243678  Config.ini  270 Byte  CLEAN
25243679  QQWry.Dat  7.43 MB  CLEAN
25217726  SkinPPWTL.dll  212 KB  CLEAN


Please find a detailed report concerning each individual sample below:

燜ilename Result
##############10#...##.exe  DAMAGED FILE (UNKNOWN)

The file '##############10##24##.exe' has been determined to be 'DAMAGED FILE (UNKNOWN)'. In particular this means that this file is damaged and not working properly. We could not find any malicious content. However the heuristic detection module may still detect this particular file even though it is damaged. In that case we will not adjust and remove detection for this damaged file.

那个“能过哪些杀毒软件”的样本也是无毒的，

File ID	燜ilename	Size (Byte)	Result
25243811	bord.rar	388.81 KB	OK

A listing of files contained inside archives alongside their results can be found below:

File ID	燜ilename	Size (Byte)	Result
25073148	Deamon.exe	840 KB	CLEAN
25073149	Defend.dll	48 KB	CLEAN
25073150	Hook.dll	56 KB	CLEAN
25243812	2009-01-27	16 KB	CLEAN

Please find a detailed report concerning each individual sample below:
看来微点这两次是误报的，但在样本区红伞漏微点报的大都确实是病毒木马！

[ 本帖最后由 saga3721 于 2009-1-28 10:47 编辑 ]

sun88990

檔案有點大~不太想下載測試了..