再來個maran樣本，附介紹

显示全部楼层 · 发表于 2007-5-6 12:04:16

This is a trojan detection. Unlike viruses, trojans do notself-replicate. They are spread manually, often under the premise thatthey are beneficial or wanted. The most common installation methodsinvolve system or security exploitation, and unsuspecting usersmanually executing unknown programs. Distribution channels includeemail, malicious or hacked web pages, Internet Relay Chat (IRC),peer-to-peer networks, etc.

显示全部楼层 · 发表于 2007-5-6 12:05:29

Starting the file scan:

Begin scan in 'F:\样本\link.rar'
F:\样本\link.rar
  [0] Archive type: RAR
  --> link.exe
   [DETECTION] Is the Trojan horse TR/PSW.Maran.AU
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-5-6 12:06:14

Scan performed at: 2007-5-6 12:06:23
Scanning Log
NOD32 version 2244 (20070505) NT
Command line: C:\Documents and Settings\EQ2\桌面\link.rar
Operating memory - is OK

Date: 6.5.2007 Time: 12:06:28
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\link.rar
C:\Documents and Settings\EQ2\桌面\link.rar ?RAR ?link.exe - probably a variant of Win32/PSW.Maran trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 12:06:29 Total scanning time: 1 sec (00:00:01)

显示全部楼层 · 发表于 2007-5-6 12:06:16

英文看不懂...

显示全部楼层 · 发表于 2007-5-6 12:07:00

干了

显示全部楼层 · 发表于 2007-5-6 12:07:54

好像剛搜的介紹是所有木馬的共有特征

看看這個對不對，瑞星的介紹
60.Trojan.Maran
破坏方法：该病毒不停地破坏注册表的run项。
将所有应用程序的主窗口的标题更改为“::$ Fack you!!!!!!!!!@@@@@@@@”

显示全部楼层 · 发表于 2007-5-6 12:09:29

原帖由 lanvin 于 2007-5-6 12:07 发表
好像剛搜的介紹是所有木馬的共有特征

看看這個對不對，瑞星的介紹
60.Trojan.Maran
破坏方法：该病毒不停地破坏注册表的run项。
将所有应用程序的主窗口的标题更改为“::$ Fack you!!!!!!!!!@@@@@@@@”

FUCK YOU ???

显示全部楼层 · 发表于 2007-5-6 12:09:42

F:\link.rar=>link.exe Infected: Generic.PWS.Maran.58EEF85F

显示全部楼层 · 发表于 2007-5-6 12:12:30

KIS621将其斩立决，但是过了KV07，上报中

显示全部楼层 · 发表于 2007-5-6 12:12:36

再補充一個maran
上面那個蜘蛛掛
這個蜘蛛滅了
懶得開新帖了，不然太水

[病毒样本] 再來個maran樣本，附介紹

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源