2个~~

显示全部楼层 · 发表于 2007-5-26 21:37:19

红伞报壳[:27:]

显示全部楼层 · 发表于 2007-5-26 21:40:23

Starting the file scan:

Begin scan in 'F:\样本\桌面.rar'
F:\样本\桌面.rar
  [0] Archive type: RAR
  --> 4.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-5-26 21:52:55

又搞定了2个，嘿嘿

显示全部楼层 · 发表于 2007-5-26 21:56:11

NOD32 MISS,汗

显示全部楼层 · 发表于 2007-5-26 21:58:33

簡單跑了下4:

寫入變量下WanPacket.dll,npptools.dll,expseny.exe之後再由4啓動expseny,expseny.exe緊接著在臨時目錄下生成jwsc.dll(隱藏屬性),_wpcap_.bat,gc.sys,安裝SERVER,啓動修改IE,4在打開CMD命令删除自身,幷且添加自己到注册表RUN啓動,過程中NOD啓發gc.sys

5沒有試驗,應該繞過了沒有磁盤底層存取的HIPS

显示全部楼层 · 发表于 2007-5-26 22:48:37

Hello,

expseny.exed, jwsc.dll - Trojan-PSW.Win32.OnLineGames.vh

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

npf.sys, npptools.dll, WanPacket.dll

No malicious code were found in these files.

Please quote all when answering.

--
Best regards, Denis Maslennikov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

> Attachment: ???1.zip

显示全部楼层 · 发表于 2007-5-26 23:04:13

又是没启发出来~~~~~~ 我对卡7的启发真的是无语言了~~~~

看来卡7照样要靠病毒库啊

显示全部楼层 · 发表于 2007-5-27 11:48:46

已删除: 木马程序 Trojan.Win32.Agent.abf 文件: C:\Documents and Settings\Administrator\桌面\桌面.rar/5.exe
已删除: 木马程序 Trojan-Dropper.Win32.Agent.bdw 文件: C:\Documents and Settings\Administrator\桌面\桌面.rar/4.exe
咔吧７现在可以杀

[病毒样本] 2个~~

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

回复 #7 wangjay1980 的帖子