网马

显示全部楼层 · 发表于 2007-4-11 22:26:38

过了N个杀软，用EQSecure捕获的极品

Antivirus	Version	Update	Result
AhnLab-V3	2007.4.12.0	04/11/07	no virus found
AntiVir	7.3.1.50	04/11/07	TR/Delphi.Downloader.Gen
Authentium	4.93.8	04/11/07	no virus found
Avast	4.7.936.0	04/11/07	no virus found
AVG	7.5.0.447	04/11/07	no virus found
BitDefender	7.2	04/11/07	Generic.Malware.Fdld.9FEF3B52
CAT-QuickHeal	9	04/10/07	no virus found
ClamAV	devel-20070312	04/11/07	no virus found
DrWeb	4.33	04/11/07	no virus found
eSafe	7.0.15.0	04/10/07	suspicious Trojan/Worm
eTrust-Vet	30.7.3560	04/11/07	no virus found
Ewido	4	04/10/07	no virus found
FileAdvisor	1	04/11/07	no virus found
Fortinet	2.85.0.0	04/11/07	no virus found
F-Prot	4.3.1.45	04/11/07	no virus found
F-Secure	6.70.13030.0	04/11/07	no virus found
Ikarus	T3.1.1.5	04/11/07	no virus found
Kaspersky	4.0.2.24	04/11/07	no virus found
McAfee	5005	04/10/07	no virus found
Microsoft	1.24	04/11/07	no virus found
NOD32v2	2181	04/11/07	probably a variant of Win32/PSW.Legendmir.AIT
Norman	5.80.02	04/11/07	no virus found
Panda	9.0.0.4	04/11/07	no virus found
Prevx1	V2	04/11/07	no virus found
Sophos	04/16/00	04/06/07	no virus found
Sunbelt	2.2.907.0	04/07/07	no virus found
Symantec	10	04/11/07	no virus found
TheHacker	6.1.6.088	04/09/07	no virus found
VBA32	03/11/03	04/10/07	no virus found
VirusBuster	04/03/07 07:09 AM	04/11/07	no virus found
Webwasher-Gateway	6.0.1	04/11/07	Trojan.Delphi.Downloader.Gen

[ 本帖最后由 solcroft 于 2007-4-12 00:08 编辑 ]

显示全部楼层 · 发表于 2007-4-11 22:34:12

密码？

显示全部楼层 · 发表于 2007-4-11 22:35:42

竟然都不告诉密码。。。。

显示全部楼层 · 发表于 2007-4-11 22:39:13

解除密码了... 上报给Malware Listserv的样本都是要加密码的，发给Malware Listserv后忘了去掉密码...

显示全部楼层 · 发表于 2007-4-11 22:40:19

Scan performed at: 2007-4-11 22:40:30
Scanning Log
NOD32 version 2181 (20070411) NT
Command line: C:\Documents and Settings\EQ2\桌面\s3.zip
Operating memory - is OK

Date: 11.4.2007 Time: 22:40:33
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\s3.zip
C:\Documents and Settings\EQ2\桌面\s3.zip ?ZIP ?s3.exe - probably a variant of Win32/PSW.Legendmir.AIT trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 22:40:33 Total scanning time: 0 sec (00:00:00)

显示全部楼层 · 发表于 2007-4-11 22:40:20

你.....going down

显示全部楼层 · 发表于 2007-4-11 22:45:06

驱逐舰没反应~~~

显示全部楼层 · 发表于 2007-4-11 22:45:14

才发现到一个奇怪的东西
这个样本创建.dll文件后什么动作也没了
明明是网马啊？难道黑客这么无聊拿死马来挂？

大家帮忙分析看看

显示全部楼层 · 发表于 2007-4-11 22:45:42

[REGISTRY - SET VALUE]                2007.04.11 22:41:59
[BLOCK]                               C:\Documents and Settings\Administrator\
                                    Command Line:"C:\Documents and Settings\Administrator\
[ACCESS TO]                            Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\
                                    Value: Common Documents

显示全部楼层 · 发表于 2007-4-11 22:56:38

原帖由 solcroft 于 2007-4-11 22:45 发表
才发现到一个奇怪的东西
这个样本创建.dll文件后什么动作也没了
明明是网马啊？难道黑客这么无聊拿死马来挂？
大家帮忙分析看看

结果一样，而且那个DLL文件更不没有进行数据写入，导致他是空的

[病毒样本] 网马

本帖子中包含更多资源

nod32启发式干掉

回复 #1 solcroft 的帖子