Rtlaudio.exe

显示全部楼层 · 发表于 2010-8-9 09:00:06

文件夹图标病毒
在system32下生成RtlAudio.exe 谁能分析一下这个病毒到底要干嘛呢
2000 UDP RtlAudio.exe (%System%\RtlAudio.exe)
2008 TCP RtlAudio.exe (%System%\RtlAudio.exe)

显示全部楼层 · 发表于 2010-8-9 09:01:16

诺顿：Trojan.Gen

显示全部楼层 · 发表于 2010-8-9 09:03:44

http://www.sunbeltsecurity.com/c ... 773A831E8D40AD38F3C

启发，to xandora(panda)

显示全部楼层 · 发表于 2010-8-9 09:06:22

金山毒霸杀！

显示全部楼层 · 发表于 2010-8-9 09:16:54

ess kill

Win32/AutoRun.VB.DO 蠕虫的变种

显示全部楼层 · 发表于 2010-8-9 09:18:47

Kaspersky detected.
新建文件夹.EXE - Trojan.Win32.VB.kqx

显示全部楼层 · 发表于 2010-8-9 09:48:09

F-Secure
Gen:Trojan.Heur.sm0@srXRQ@kbb

显示全部楼层 · 发表于 2010-8-9 10:00:42

kingsoft kill

显示全部楼层 · 发表于 2010-8-9 10:19:12

Avira

Begin scan in 'C:\Users\Trent\Downloads\rtlaudio.zip'
C:\Users\Trent\Downloads\rtlaudio.zip
[0] Archive type: ZIP
  [DETECTION] Is the TR/Dropper.Gen Trojan
[NOTE]    A backup was created as '494bc175.qua'  ( QUARANTINE )
[NOTE]    The file was successfully wiped!
[NOTE]    The file was deleted!
  --> ￐ￂﾽﾨￎￄﾼﾼ￐.EXE
[1] Archive type: RSRC
[DETECTION] Is the TR/Dropper.Gen Trojan

显示全部楼层 · 发表于 2010-8-9 10:24:38

http://bbs.kafan.cn/forum.php?mo ... DEzMjA2MTV8MjY3MzA5 Win32/AutoRun.VB.DO 蠕虫的变种连接中断 - 已隔离通过应用程序访问 web 时检测到威胁: F:\TheWorld\TheWorld.exe.
http://bbs.kafan.cn/forum.php?mo ... DEzMjA2MTV8MjY3MzA5 > ZIP > 新建文件夹.EXE Win32/AutoRun.VB.DO 蠕虫的变种

[病毒样本] Rtlaudio.exe

浏览过的版块