加了不同壳的同一个样本

显示全部楼层 · 发表于 2007-3-23 01:30:59

过了红伞，BD，蜘蛛和vba32

显示全部楼层 · 发表于 2007-3-23 01:42:42

1

[ 本帖最后由 jlennon 于 2007-3-23 01:43 编辑 ]

显示全部楼层 · 发表于 2007-3-23 01:43:43

下回去问问怎么样才能过卡巴的主动防御。。。。

显示全部楼层 · 发表于 2007-3-23 01:48:21

Virus check with AntiVirusKit
Version 17.0.6282
Virus signatures of 3/22/2007
Start time: 3/23/2007 01:48
Engine(s): Engine A (AVK 17.3465), Engine B (AVKB 17.179)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: CMDOW CMDOW.EXE
In archive: C:\Documents and Settings\Administrator\桌面\1.rar
Status: Virus detected
Virus: not-a-virus:RiskTool.Win32.HideWindows (Engine A)
Object: 1.rar
Path: C:\Documents and Settings\Administrator\桌面
Status: Move file into quarantine
Virus: not-a-virus:RiskTool.Win32.HideWindows (Engine A)
Object: CMDOW CMDOW.EXE
In archive: C:\Documents and Settings\Administrator\桌面\2.rar
Status: Virus detected
Virus: not-a-virus:RiskTool.Win32.HideWindows (Engine A)
Object: 2.rar
Path: C:\Documents and Settings\Administrator\桌面
Status: Move file into quarantine
Virus: not-a-virus:RiskTool.Win32.HideWindows (Engine A)
Object: CMDOW.EXE
In archive: C:\Documents and Settings\Administrator\桌面\CMDOW.rar
Status: Virus detected
Virus: not-a-virus:RiskTool.Win32.HideWindows (Engine A)
Object: CMDOW.rar
Path: C:\Documents and Settings\Administrator\桌面
Status: Move file into quarantine
Virus: not-a-virus:RiskTool.Win32.HideWindows (Engine A)
Analysis complete: 3/23/2007 01:48
3 files checked
3 infected files detected
0 suspected files detected

显示全部楼层 · 发表于 2007-3-23 03:10:58

雨伞有两个的
因为是spr，所以vt看不见，但是jotti能看见
Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\CMDOW.rar'
C:\Documents and Settings\morgan\My Documents\
  CMDOW.rar
[0] Archive type: RAR
--> CMDOW.EXE
      [DETECTION] Contains signature of the SPR/HideWindows.I program
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!
Begin scan in 'C:\Documents and Settings\morgan\My Documents\1.rar'
C:\Documents and Settings\morgan\My Documents\
  1.rar
[0] Archive type: RAR
--> CMDOW\CMDOW.EXE
      [DETECTION] Contains signature of the SPR/HideWindows.I program
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!
Begin scan in 'C:\Documents and Settings\morgan\My Documents\2.rar'
C:\Documents and Settings\morgan\My Documents\
  2.rar
[0] Archive type: RAR
--> CMDOW\CMDOW.EXE

显示全部楼层 · 发表于 2007-3-23 11:19:14

呵呵，跳出来DOS窗口

显示全部楼层 · 发表于 2007-3-23 11:35:01

原帖由 EQ2 于 2007-3-23 01:43 发表
下回去问问怎么样才能过卡巴的主动防御。。。。

把系统时间改了，卡巴不攻自破，过主动防御了

显示全部楼层 · 发表于 2007-3-23 13:03:02

感觉这种方法已经很多人用了。。。而且也有不少人反应给卡巴了。。。。下回去让人找找还有其他漏洞没。。。

显示全部楼层 · 发表于 2007-3-23 13:04:50

要说还有的话就是利用启动文件夹实施启动的，卡巴的主动防御也不管

显示全部楼层 · 发表于 2007-3-23 13:06:04

下回试试看。。。。。主动防御不是攻不可破了。。。

[病毒样本] 加了不同壳的同一个样本

本帖子中包含更多资源

本帖子中包含更多资源

回复 #7 dikex 的帖子