2009.3.7 卡巴启发

显示全部楼层 · 发表于 2009-3-7 17:55:33

卡巴启发

@@@@@@@@@@@@@@@@@@

[ 本帖最后由 killloop 于 2009-3-7 18:35 编辑 ]

显示全部楼层 · 发表于 2009-3-7 17:57:09

Lcass.rar > RAR > Lcass.exe - Win32/VB.AGS 特洛伊木马
DNFydt0306.exe - Win32/Rootkit.Agent.NJQ 特洛伊木马的变种

卡巴什么时候有NOD的启发就好了

NOD KILL

显示全部楼层 · 发表于 2009-3-7 17:58:13

TO KL

显示全部楼层 · 发表于 2009-3-7 17:59:59

Starting the file scan:

Begin scan in 'D:\DNFydt0306.exe'
D:\DNFydt0306.exe
[DETECTION] Is the TR/Rootkit.Gen Trojan
[NOTE]    A backup was created as '49f8464e.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
Begin scan in 'D:\Lcass.exe'
D:\Lcass.exe
[DETECTION] Contains a recognition pattern of the (harmful) BDS/Tzhen.A.1 back-door program
[NOTE]    A backup was created as '4a134663.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

End of the scan: 2009年3月7日  18:01
Used time: 00:09 Minute(s)

The scan has been done completely.

   0 Scanning directories
   2 Files were scanned
   2 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   2 files were deleted
   0 files were repaired
   2 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   0 Files not concerned
   0 Archives were scanned
   0 Warnings
   2 Notes

显示全部楼层 · 发表于 2009-3-7 18:00:32

rs backdoor *1
binder *1

显示全部楼层 · 发表于 2009-3-7 18:26:10

2009/3/7 18:25:57 c:\users\gx\desktop\lcass\lcass.exe 创建文件 C:\Windows\system32\Mswinsck.ocx 阻止 [文件组]可执行文件阻止1 -> [文件]?:\*; *.ocx
2009/3/7 18:25:57 c:\users\gx\desktop\lcass\lcass.exe 创建文件 C:\Windows\system32\Mswinsck.ocx 阻止 [文件组]可执行文件阻止1 -> [文件]?:\*; *.ocx
2009/3/7 18:25:57 c:\users\gx\desktop\lcass\lcass.exe 创建文件 C:\Windows\system32\Mswinsck.ocx 阻止 [文件组]可执行文件阻止1 -> [文件]?:\*; *.ocx
2009/3/7 18:25:58 c:\users\gx\desktop\lcass\lcass.exe 创建文件 C:\Windows\system32\Ntsvc.ocx 阻止 [文件组]可执行文件阻止1 -> [文件]?:\*; *.ocx
2009/3/7 18:25:58 c:\users\gx\desktop\lcass\lcass.exe 创建文件 C:\Windows\system32\Ntsvc.ocx 阻止 [文件组]可执行文件阻止1 -> [文件]?:\*; *.ocx
2009/3/7 18:25:58 c:\users\gx\desktop\lcass\lcass.exe 创建文件 C:\Windows\system32\Ntsvc.ocx 阻止 [文件组]可执行文件阻止1 -> [文件]?:\*; *.ocx
2009/3/7 18:25:58 c:\users\gx\desktop\lcass\lcass.exe 创建文件 C:\Windows\system32\Lcass.dll 阻止 [文件组]可执行文件阻止1 -> [文件]?:\*; *.dll
2009/3/7 18:25:58 c:\users\gx\desktop\lcass\lcass.exe 创建文件 C:\Windows\system32\Lcass.dll 阻止 [文件组]可执行文件阻止1 -> [文件]?:\*; *.dll
2009/3/7 18:25:58 c:\users\gx\desktop\lcass\lcass.exe 创建文件 C:\Windows\system32\Lcass.dll 阻止 [文件组]可执行文件阻止1 -> [文件]?:\*; *.dll
2009/3/7 18:25:58 c:\users\gx\desktop\lcass\lcass.exe 创建文件 C:\Windows\system32\Lcass.exe 阻止 [文件组]EXE阻止 -> [文件]?:\windows\*; *.exe

显示全部楼层 · 发表于 2009-3-7 18:26:29

2009/3/7 18:26:18 c:\users\gx\desktop\dnfydt0306\dnfydt0306.exe 创建文件 C:\Windows\system32\CTFNOM.exe 阻止 [文件组]EXE阻止 -> [文件]?:\windows\*; *.exe
2009/3/7 18:26:18 c:\users\gx\desktop\dnfydt0306\dnfydt0306.exe 创建文件 C:\Windows\system32\CTFM0M.exe 阻止 [文件组]EXE阻止 -> [文件]?:\windows\*; *.exe
2009/3/7 18:26:18 c:\users\gx\desktop\dnfydt0306\dnfydt0306.exe 创建文件 C:\Windows\system32\CIFMON.exe 阻止 [文件组]EXE阻止 -> [文件]?:\windows\*; *.exe
2009/3/7 18:26:18 c:\users\gx\desktop\dnfydt0306\dnfydt0306.exe 创建文件 C:\Windows\system32\CIFM0N.exe 阻止 [文件组]EXE阻止 -> [文件]?:\windows\*; *.exe
2009/3/7 18:26:18 c:\users\gx\desktop\dnfydt0306\dnfydt0306.exe 创建文件 C:\Windows\system32\CTFMOM.exe 阻止 [文件组]EXE阻止 -> [文件]?:\windows\*; *.exe
2009/3/7 18:26:18 c:\users\gx\desktop\dnfydt0306\dnfydt0306.exe 创建文件 C:\Windows\system32\DNFydt0306.exe 阻止 [文件组]EXE阻止 -> [文件]?:\windows\*; *.exe

显示全部楼层 · 发表于 2009-3-7 18:28:21

Kaspersky Lab
拒绝访问
无法返回请求的网页

试图访问的网页：

http://bbs.kafan.cn/attachment.php?aid=
479717&k=9c56833bfad25c6d8409da55759a09a
3&t=1236421661

发生下列错误：

请求的对象被感染，发现下列病毒 Backdoor.Win32.VB.ags

如有疑问，请联系您的技术支持
创建日期：
Sat Mar 07 18:28:05 2009
Kaspersky Lab

显示全部楼层 · 发表于 2009-3-7 18:42:07

VirusBuster found nothing

显示全部楼层 · 发表于 2009-3-7 18:43:16

[病毒样本] 2009.3.7 卡巴启发

本帖子中包含更多资源

VC

本帖子中包含更多资源

浏览过的版块