4个后门程序或恶意软件

小邪邪

用AVK查出来的

金剑

风暴胜者V2 测试版本(http://www.v0day.com)
_________您的安全是我们的责任_______________
载入病毒库…进行整理…分配内存…可以使用



===============================================
   ___________病毒查杀结果__________________


===============================================

2007年4月7日18时39分34秒 开始查杀C:\Documents and Settings\Administrator\桌面\新建文件夹\4个后门程序和恶意软件[1]
C:\Documents and Settings\Administrator\桌面\新建文件夹\4个后门程序和恶意软件[1]\4个后门程序和恶意软件\svcagnt.exe 发现未知可疑文件:Win32.NkHack.Preloc.A 操作:阻止运行
=========================================

_________文件性质分析结果________________
"带壳"仅指文件性质,仅供专业人员分析使用。


C:\Documents and Settings\Administrator\桌面\新建文件夹\4个后门程序和恶意软件[1]\4个后门程序和恶意软件\rcomsrv.exe 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\新建文件夹\4个后门程序和恶意软件[1]\4个后门程序和恶意软件\Rcomclt.exe 带壳文件:UPX加壳
-----------------------------------------

2007年4月7日18时39分35秒收起线程…100% 查杀完毕！
扫描文件：4查杀病毒：1

金剑

影子远程控制？

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\4个后门程序和恶意软件'
C:\Documents and Settings\morgan\My Documents\4个后门程序和恶意软件\4个后门程序和恶意软件\
  dtsview.exe
      [DETECTION] Contains signature of the SPR/RemoteDesktopSpy.310.2 program
      [WARNING]   The file was ignored!
  Rcomclt.exe
    [0] Archive type: ZIP SFX (self extracting)
    --> chatlog.dll
    --> ChatLPC.dll
    --> raudio.dll
    --> rchat.dll
    --> Rcomclt.exe
    --> vcintc.dll
    --> vcints.dll
    --> voice.dll
  rcomsrv.exe
    [0] Archive type: ZIP SFX (self extracting)
    --> rcomsrv.exe
    --> rsaudio.dll
    --> rschat.dll
    --> Settings for Radmin Communication Server.exe
        [DETECTION] Contains suspicious code HEUR/Crypted
        [WARNING]   Infected files in archives cannot be repaired!
    --> voice.dll
        [WARNING]   The file was ignored!
  svcagnt.exe
      [DETECTION] Contains signature of the SPR/RemoteDesktopSpy.310.3 program
      [WARNING]   The file was ignored!