load.exe

显示全部楼层 · 发表于 2011-5-6 18:32:27

Auto post by promised's robot
PM me if having problems
CAT-QuickHeal Found Backdoor.Kbot.s
McAfee Found FDoS-BEnergy
TheHacker Found Backdoor/Kbot.s
K7AntiVirus Found Trojan-Downloader
VirusBuster Found Backdoor.Kbot.FL
NOD32 Found Win32/Agent.NGC
F-Prot Found W32/Downldr2.MDV
Symantec Found Downloader
Norman Found W32/Suspicious_Gen2.KTMVS
TrendMicro-HouseCall Found BKDR_KBOT.CT
Avast Found Win32:Small-JGP
eSafe Found Win32.WORMRbot
ClamAV Found Trojan.Downloader-11579
Kaspersky Found Backdoor.Win32.Kbot.s
BitDefender Found Trojan.Generic.2267090
SUPERAntiSpyware Found Nothing
Sophos Found Troj/Bckdr-QYM
Comodo Found Backdoor.Win32.Agent.NGC
F-Secure Found Trojan.Generic.2267090
DrWeb Found Trojan.DownLoader.26661
VIPRE Found BehavesLike.Win32.Malware.ssc (mx-v)
AntiVir Found WORM/Rbot.Gen
TrendMicro Found BKDR_KBOT.CT
McAfee-GW-Edition Found Heuristic.BehavesLike.Win32.Spyware.J
Emsisoft Found Backdoor.Win32.Kbot!IK
eTrust-Vet Found Win32/Phdet.T
Jiangmin Found TrojanDownloader.Dirat.a
Antiy-AVL Found Backdoor/Win32.Kbot.gen
Microsoft Found Backdoor:Win32/Phdet.gen!A
ViRobot Found Backdoor.Win32.Kbot.22016
Prevx Found Medium Risk Malware
Commtouch Found W32/Downldr2.MDV
AhnLab-V3 Found Win-Trojan/Downloader.22016.CO
VBA32 Found Backdoor.Kbot.s
PCTools Found Downloader.Generic
Rising Found Trojan.DL.Win32.Small.evl
Ikarus Found Backdoor.Win32.Kbot
Fortinet Found W32/Kbot.S!tr.bdr
AVG Found Flooder.EQA
Panda Found Bck/BEnergy.K
Avast5 Found Win32:Small-JGP

显示全部楼层 · 发表于 2011-5-6 18:38:41

360 SD Kill

显示全部楼层 · 发表于 2011-5-6 19:24:32

本帖最后由 xwhmm 于 2011-5-6 19:24 编辑

秒杀

显示全部楼层 · 发表于 2011-5-6 20:45:23

ESS杀

显示全部楼层 · 发表于 2011-5-6 22:10:29

ESET杀了

来测试下HIPS~
PS: ESET的HIPS真DT，交互模式下没有在规则里的行为都会询问，但是询问完了竟然不会记入日志，好像是只有规则里明确指定了的行为才会记日志。这太不方便了，应该反映一下......

一上来就操作系统内核，不是好东东

创建自身？干嘛？

又创建svchost？可疑

保护svchost虚拟内存

改变线程上下文...可疑

哦，原来是注入了svchost...svchost现在也行为异常了

获取自身句柄...

接下来样本似乎在下载别的木马，时间太长，不测了......
事实证明ESET的手动HIPS还是不错的，但是还有一些方面没防御...
还有一个：ESET的HIPS规则没得分组...这个也得反映一下
希望看到更好的HIPS...

显示全部楼层 · 发表于 2011-5-6 22:12:28

卡巴

显示全部楼层 · 发表于 2011-5-6 23:03:39

大蜘蛛：load[1].exe found virus Trojan.DownLoader.26661

显示全部楼层 · 发表于 2011-5-7 00:13:49

mse kill

[病毒样本] load.exe

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源