两个

显示全部楼层 · 发表于 2007-5-27 02:54:34

铁克挂..几次测试下来看来铁克想在内地取下龙头地位难..

心里开始浮动...更换杀毒瘾又犯了..

3.rar

增加值:
----------------------------------
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_BRC_SERVICES\0000\Control\*NewlyCreated*: 0x00000000
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_BRC_SERVICES\0000\Control\ActiveService: "BRC_Services"
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_BRC_SERVICES\0000\Service: "BRC_Services"
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_BRC_SERVICES\0000\Legacy: 0x00000001
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_BRC_SERVICES\0000\ConfigFlags: 0x00000000
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_BRC_SERVICES\0000\Class: "LegacyDriver"
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_BRC_SERVICES\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_BRC_SERVICES\0000\DeviceDesc: "BlackHole Remote Control Services"
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_BRC_SERVICES\NextInstance: 0x00000001
HKLM\SYSTEM\ControlSet001\Services\kmixer\Enum\0: "SW\{b7eafdc0-a680-11d0-96d8-00aa0051e51d}\{9B365890-165F-11D0-A195-0020AFD156E4}"
HKLM\SYSTEM\ControlSet001\Services\BRC_Services\Enum\0: "Root\LEGACY_BRC_SERVICES\0000"
HKLM\SYSTEM\ControlSet001\Services\BRC_Services\Enum\Count: 0x00000001
HKLM\SYSTEM\ControlSet001\Services\BRC_Services\Enum\NextInstance: 0x00000001
HKLM\SYSTEM\ControlSet001\Services\BRC_Services\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00
HKLM\SYSTEM\ControlSet001\Services\BRC_Services\Type: 0x00000110
HKLM\SYSTEM\ControlSet001\Services\BRC_Services\Start: 0x00000002
HKLM\SYSTEM\ControlSet001\Services\BRC_Services\ErrorControl: 0x00000000
HKLM\SYSTEM\ControlSet001\Services\BRC_Services\ImagePath: ""C:\windows\system32\brc_Server.exe" /service"---黑洞后门

HKLM\SYSTEM\ControlSet001\Services\BRC_Services\DisplayName: "BlackHole Remote Control Services"
HKLM\SYSTEM\ControlSet001\Services\BRC_Services\ObjectName: "LocalSystem"
HKLM\SYSTEM\ControlSet001\Services\BRC_Services\Description: "BlackHole Remote Control Services"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BRC_SERVICES\0000\Control\*NewlyCreated*: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BRC_SERVICES\0000\Control\ActiveService: "BRC_Services"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BRC_SERVICES\0000\Service: "BRC_Services"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BRC_SERVICES\0000\Legacy: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BRC_SERVICES\0000\ConfigFlags: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BRC_SERVICES\0000\Class: "LegacyDriver"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BRC_SERVICES\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BRC_SERVICES\0000\DeviceDesc: "BlackHole Remote Control Services"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BRC_SERVICES\NextInstance: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\kmixer\Enum\0: "SW\{b7eafdc0-a680-11d0-96d8-00aa0051e51d}\{9B365890-165F-11D0-A195-0020AFD156E4}"
HKLM\SYSTEM\CurrentControlSet\Services\BRC_Services\Enum\0: "Root\LEGACY_BRC_SERVICES\0000"
HKLM\SYSTEM\CurrentControlSet\Services\BRC_Services\Enum\Count: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\BRC_Services\Enum\NextInstance: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\BRC_Services\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00
HKLM\SYSTEM\CurrentControlSet\Services\BRC_Services\Type: 0x00000110
HKLM\SYSTEM\CurrentControlSet\Services\BRC_Services\Start: 0x00000002
HKLM\SYSTEM\CurrentControlSet\Services\BRC_Services\ErrorControl: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\BRC_Services\ImagePath: ""C:\windows\system32\brc_Server.exe" /service"----黑洞后门

HKLM\SYSTEM\CurrentControlSet\Services\BRC_Services\DisplayName: "BlackHole Remote Control Services"
HKLM\SYSTEM\CurrentControlSet\Services\BRC_Services\ObjectName: "LocalSystem"
HKLM\SYSTEM\CurrentControlSet\Services\BRC_Services\Description: "BlackHole Remote Control Services"

----------------------------------
文件增加:1
----------------------------------

C:\WINDOWS\system32\brc_Server.exe---黑洞后门

----------------------------------
文件删除:1
----------------------------------
C:\download\3.exe

m.rar

文件增加:3
----------------------------------
C:\Program Files\Internet Explorer\Connection Wizard\icwres.ocx
C:\Program Files\Internet Explorer\Connection Wizard\isignup.dll---盗q木马[:02:]
C:\Program Files\Internet Explorer\Connection Wizard\isignup.sys

[ 本帖最后由 playx 于 2007-5-27 02:55 编辑 ]

显示全部楼层 · 发表于 2007-5-27 06:36:01

Dr.Web
m.exe;C:\Documents and Settings\Mahaijun\桌面\m3;Trojan.Progress.10;;
3.exe;C:\Documents and Settings\Mahaijun\桌面\m3;BackDoor.BlackHole;;

显示全部楼层 · 发表于 2007-5-27 07:48:20

Hello.

New malicious software was found in the attached file.
Trojan-Dropper.Win32.Agent.bjd
It's detection will be included in the next update. Thank you for your help.
-----------------
Regards, Roman Gavrilchenko
Virus Analyst, Kaspersky Lab.

Ph.: +7(495) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com http://www.viruslist.com
http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

> Attachment: m.rar

Hello.

This file already detected as Backdoor.Win32.Delf.axh.
You must delete it.

Sincerely yours,
Pavel Zelensky
Virus analyst

Kaspersky Lab Ltd
Moscow, Russia
Tel/Fax: +7 (495) 797-8700
E-mail: newvirus@kaspersky.com
Internet: http://www.kaspersky.com, http://www.viruslist.com

> Attachment: 3.rar

显示全部楼层 · 发表于 2007-5-27 08:15:35

探测到: 木马程序 Backdoor.Win32.Delf.axh 文件: C:\Documents and Settings\Administrator\桌面\3.rar/3.exe
探测到: 木马程序 Trojan-Dropper.Win32.Agent.bjd 文件: C:\Documents and Settings\Administrator\桌面\m.rar/m.exe
现在咔吧7可以杀了

显示全部楼层 · 发表于 2007-5-27 08:18:28

KV报了一个病毒，但是漏杀一个让卡巴7干掉了

显示全部楼层 · 发表于 2007-5-27 08:58:49

显示全部楼层 · 发表于 2007-5-27 09:06:32

趋势直接飘过，鄙视那种周末休息的杀毒厂商

这个东西金山还能报一个

显示全部楼层 · 发表于 2007-5-27 09:21:48

[Scan path] C:\Documents and Settings\Administrator\桌面\3.rar
>C:\Documents and Settings\Administrator\桌面\3.rar\3.exe infected with BackDoor.BlackHole
C:\Documents and Settings\Administrator\桌面\3.rar - archive contains infected objects

[Scan path] C:\Documents and Settings\Administrator\桌面\m.rar
>C:\Documents and Settings\Administrator\桌面\m.rar\m.exe infected with Trojan.Progress.10
C:\Documents and Settings\Administrator\桌面\m.rar - archive contains infected objects

显示全部楼层 · 发表于 2007-5-28 16:39:31

[病毒样本] 两个

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

微点拦

本帖子中包含更多资源