2个

显示全部楼层 · 发表于 2009-7-8 14:18:19

2个。

显示全部楼层 · 发表于 2009-7-8 14:45:55

估计是下载者，运行后都有删除自身，在SYSTEM32创建EXE并要求联网动作。拦截联网后，系统似乎没啥异样。

显示全部楼层 · 发表于 2009-7-8 14:47:25

卡巴清空(报backdoor)

上报ll

[ 本帖最后由 sam.to 于 2009-7-8 14:48 编辑 ]

显示全部楼层 · 发表于 2009-7-8 15:12:40

to mpav

显示全部楼层 · 发表于 2009-7-8 15:18:55

1.exe -- 'WORM/Rbot.cyj'

The file '2.exe' has been determined to be 'UNDER ANALYSIS'.

显示全部楼层 · 发表于 2009-7-8 16:23:09

Starting the file scan:

Begin scan in 'C:\Users\Administrator\Desktop\2.rar'
C:\Users\Administrator\Desktop\2.rar
  [0] Archive type: RAR
[WARNING] The file was ignored!
--> 2.exe
   [DETECTION] Contains recognition pattern of the WORM/VanBot.bdt worm
--> 1.exe
   [DETECTION] Contains recognition pattern of the WORM/Rbot.cyj worm

IKARUS - T3SCAN V1.32.10.0 (WIN32)
      T3 V1.01.64
      Copyright (c) 2006 - 2009 by Ikarus Software.
      All rights reserved.

Signature-database from 8.7.2009 04:09:41 (Build: 72997)

C:\Users\Administrator\Desktop\2.rar:2.exe - Signature 'Backdoor.Win32.VanBot' found
C:\Users\Administrator\Desktop\2.rar:1.exe - Signature 'Backdoor.Win32.VanBot' found
C:\Users\Administrator\Desktop\2.rar - Signature 'Backdoor.Win32.VanBot' found

3 Files scanned
   (1 Archiv with 2 files)
3 Signatures found
0 Suspect code-parts found
Used time: 0:00.015

显示全部楼层 · 发表于 2009-7-8 16:48:53

金山 0

显示全部楼层 · 发表于 2009-7-8 17:15:40

2009-7-8 17:15:03 http://bbs.kafan.cn/attachment.p ... 04&t=1247044487 Internet Explorer 处理错误: Backdoor.Win32.VanBot.bdt 启发式分析计算的威胁级别值较高
KIS8.0 Kill
2009-7-8 17:15:03 http://bbs.kafan.cn/attachment.p ... t=1247044487//2.exe Internet Explorer 拒绝: Backdoor.Win32.VanBot.bdt 启发式分析计算的威胁级别值较高
2009-7-8 17:15:03 http://bbs.kafan.cn/attachment.p ... t=1247044487//2.exe Internet Explorer 检测到: Backdoor.Win32.VanBot.bdt 启发式分析计算的威胁级别值较高

显示全部楼层 · 发表于 2009-7-8 18:23:09

http://www.virustotal.com/zh-tw/ ... c0418c6a-1247048797

显示全部楼层 · 发表于 2009-7-8 22:34:25

McAfee w32/nirbot.worm!a

[病毒样本] 2个

本帖子中包含更多资源