样本

显示全部楼层 · 发表于 2007-5-2 00:48:00

Begin scan in 'D:\Documents and Settings\dell\桌面\sample.rar'
D:\Documents and Settings\dell\桌面\sample.rar
  [0] Archive type: RAR
  --> svchost.exe
   [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-5-2 00:48:13

[ 本帖最后由 aoyang 于 2007-5-2 00:52 编辑 ]

显示全部楼层 · 发表于 2007-5-2 00:49:14

上报。。。。LS的打开侦测壳看看。。。

显示全部楼层 · 发表于 2007-5-2 01:07:12

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-4-25
Start time: 2007-5-2 1:03
Engine(s): KAV engine (AVK 17.4126), BD-Engine (BD 17.3645)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: svchost.exe
In archive: C:\Documents and Settings\Administrator\桌面\sample.rar
Status: Virus detected
Virus: Trojan-Downloader.Win32.Agent.bmo (KAV engine), Worm.Dowque.A (BD-Engine)
Object: sample.rar
Path: C:\Documents and Settings\Administrator\桌面
Status: Move file into quarantine
Virus: Trojan-Downloader.Win32.Agent.bmo (KAV engine), Worm.Dowque.A (BD-Engine)
Analysis complete: 2007-5-2 1:03
1 files checked
1 infected files detected
0 suspected files detected

显示全部楼层 · 发表于 2007-5-2 01:07:56

BD和Kaspersky对病毒的定义不一样。。。

显示全部楼层 · 发表于 2007-5-2 01:09:04

显示全部楼层 · 发表于 2007-5-2 01:10:09

我印象中，BD没有Downloader这个叫法

显示全部楼层 · 发表于 2007-5-2 01:17:50

nod32没有backdoor这种命名。。。。

显示全部楼层 · 发表于 2007-5-2 07:57:37

C:\Documents and Settings\moonsilver\桌面\sample.
rar>>svchost.exe>>mian007

Trojan.Mnless.ktl

rising

[病毒样本] 样本

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

回复 #6 EQ2 的帖子

回复 #8 jlennon 的帖子