Backdoor 2x

显示全部楼层 · 发表于 2009-3-17 15:58:12

其中一个（6.rar由kaba heur得来），另外一个(8.rar)kaba miss, to kill !在沙盘运行，其删除自身，在windows文件夹生成一个病毒样本！拿去在线检测，报的都是后门程序！
rising >Backdoor.Win32.DDOS.kd

6.rar

Hello,

6.exe - Trojan.Win32.Buzus.aqln

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

[ 本帖最后由幸福的猪猪于 2009-3-17 16:01 编辑 ]

显示全部楼层 · 发表于 2009-3-17 15:59:51

Starting the file scan:

Begin scan in 'D:\new\8.rar'
D:\new\8.rar
  [0] Archive type: RAR
--> 8.exe
   [DETECTION] Contains a recognition pattern of the (harmful) BDS/Backdoor.Gen back-door program
[NOTE]    A backup was created as '4a31590c.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
Begin scan in 'D:\new\6.rar'
D:\new\6.rar
  [0] Archive type: RAR
--> 6.exe
   [DETECTION] Is the TR/Hijacker.Gen Trojan
[NOTE]    A backup was created as '4b42d5ed.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

End of the scan: 2009年3月17日  16:01
Used time: 00:00 Minute(s)

The scan has been done completely.

   0 Scanned directories
   7 Files were scanned
   2 Viruses and/or unwanted programs were found
   0 Files were classified as suspicious
   2 files were deleted
   0 Viruses and unwanted programs were repaired
   2 Files were moved to quarantine
   0 Files were renamed
   0 Files cannot be scanned
   5 Files not concerned
   2 Archives were scanned
   0 Warnings
   2 Notes

显示全部楼层 · 发表于 2009-3-17 16:00:58

蜘蛛漏一个！~

[扫描路径] C:\Documents and Settings\Administrator\桌面\8.rar
C:\Documents and Settings\Administrator\桌面\8.rar - 压缩文件 RAR
>C:\Documents and Settings\Administrator\桌面\8.rar/8.exe 已加壳，方式： ASPROTECT
>>C:\Documents and Settings\Administrator\桌面\8.rar/8.exe - 确定
>C:\Documents and Settings\Administrator\桌面\8.rar/error.ini - 确定
>C:\Documents and Settings\Administrator\桌面\8.rar/maxthon.exe.manifest - 确定
>C:\Documents and Settings\Administrator\桌面\8.rar/maxzlib.dll - 确定
C:\Documents and Settings\Administrator\桌面\8.rar - 确定
C:\Documents and Settings\Administrator\桌面\8.rar:Zone.Identifier - 确定

[扫描路径] C:\Documents and Settings\Administrator\桌面\6.rar
C:\Documents and Settings\Administrator\桌面\6.rar - 压缩文件 RAR
>C:\Documents and Settings\Administrator\桌面\6.rar/6.exe 已被病毒感染： Trojan.DownLoad.26007
C:\Documents and Settings\Administrator\桌面\6.rar - 发现压缩文件中有被感染的对象
C:\Documents and Settings\Administrator\桌面\6.rar:Zone.Identifier - 确定

显示全部楼层 · 发表于 2009-3-17 16:23:03

过咖啡8.7i

显示全部楼层 · 发表于 2009-3-17 16:28:51

程序：
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\6.EXE
木马程序生成以下文件：
1) C:\WINDOWS\WEB\IEXPL0RE.EXE
是否删除木马程序及其衍生物?
程序：
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\8.EXE
木马程序生成以下文件：
1) C:\WINDOWS\SYSTEM32\SYSTEM64.EXE
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2009-3-17 17:42:53

to VB

显示全部楼层 · 发表于 2009-3-17 18:22:51

DR.WB
\6.exe - infected with Trojan.DownLoad.26007
8.rar miss to

显示全部楼层 · 发表于 2009-3-17 18:56:00

File scanned: C:\Downloads\8\8.exe - SIGNATURE FOUND "Generic.Trojan.Generic"
File scanned: C:\Downloads\6\6.exe - SIGNATURE FOUND "Downloader.Delphi"

[病毒样本] Backdoor 2x

本帖子中包含更多资源