kv报backdoor

kp2006

快杀

The EQs

nod32未报

kp2006

原帖由 EQ2 于 2007-3-9 02:33 发表
nod32未报

The EQs

大多数杀软还是报的rootkit比较多。。。。

The EQs

AntiVir 7.3.1.41 03.08.2007 TR/Rootkit.GDT.1
Authentium 4.93.8 03.07.2007  no virus found
Avast 4.7.936.0 03.08.2007 Win32:Trojan-gen. {Other}
AVG 7.5.0.447 03.08.2007  no virus found
BitDefender 7.2 03.08.2007 Trojan.Rootkit.GDT
CAT-QuickHeal 9.00 03.08.2007  no virus found
ClamAV devel-20060426 03.08.2007  no virus found
DrWeb 4.33 03.08.2007  no virus found
eSafe 7.0.14.0 03.08.2007  no virus found
eTrust-Vet 30.6.3464 03.08.2007  no virus found
Ewido 4.0 03.07.2007 Adware.Cdn
FileAdvisor 1 03.08.2007  no virus found
Fortinet 2.85.0.0 03.08.2007  no virus found
F-Prot 4.3.1.45 03.07.2007  no virus found
F-Secure 6.70.13030.0 03.08.2007  no virus found
Ikarus T3.1.1.3 03.08.2007 Trojan.Rootkit.GDT
Kaspersky 4.0.2.24 03.08.2007  no virus found
McAfee 4980 03.08.2007  no virus found
Microsoft 1.2204 03.08.2007 VirTool:WinNT/Protmin.L
NOD32v2 2103 03.08.2007  no virus found
Norman 5.80.02 03.07.2007  no virus found
Panda 9.0.0.4 03.08.2007  no virus found
Prevx1 V2 03.08.2007 Polynomial.Code.Exploit
Sophos 4.15.0 03.07.2007  no virus found
Sunbelt 2.2.907.0 03.07.2007 3721 Chinese Keywords (CNSMin)
Symantec 10 03.08.2007  no virus found
TheHacker 6.1.6.072 03.07.2007  no virus found
UNA 1.83 03.07.2007  no virus found
VBA32 3.11.2 03.07.2007  no virus found
VirusBuster 4.3.19:9 03.08.2007 no virus found


Aditional Information
File size: 6575 bytes
MD5: b2412168c14fdced3dee532a278d4835
SHA1: 5659790a4da4f5f04c3e6d4aa7b3e33053023307
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PXC=00c737903827
Sunbelt info: 3721 Chinese Keywords, also known as CNSMin or Adware.CDN, is keyword-lookup provider that takes over the search feature of IE's address bar. It is aimed at providing keywords using Chinese characters.

VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.
> Go to: Home Contactar En Español
--------------------------------------------------------------------------------
www.virustotal.com :: ©Hispasec Sistemas

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\11403484.rar'
C:\Documents and Settings\Administrator\My Documents\
  11403484.rar
    [0] Archive type: RAR
    --> 11403484.sys
        [DETECTION] Is the Trojan horse TR/Rootkit.GDT.1
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!

jlennon

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-3-6
Start time: 2007-3-9 4:13
Engine(s): KAV engine (AVK 17.3103), BD-Engine (BD 17.2113)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: 11403484.sys
        In archive: C:\Documents and Settings\Administrator\桌面\11403484.rar
        Status: Virus detected
        Virus: Trojan.Rootkit.GDT (BD-Engine)
Object: 11403484.rar
        Path: C:\Documents and Settings\Administrator\桌面
        Status: Move file into quarantine
        Virus: Trojan.Rootkit.GDT (BD-Engine)
Analysis complete: 2007-3-9 4:13
    1 files checked
    1 infected files detected
    0 suspected files detected

hsjj2005

费尔

bridgewr

sys，上报微点分析，不知道是否木马

The EQs

rootkit