卡饭茶舍 | 软件下载专区 | HIPS专区 | 防火墙专区 | 病毒样本区 | 国内杀软专区 | 国外杀软专区 | 卡饭计算机安全软件下载中心
免费的安全盛宴 | 关于安全软件的12个谣言和误会~ 卡巴官方最新正式版 | 官方最新测试版帮助他人,快乐自己 | 助人者,人助之91款国外杀毒软件官方介绍 附优秀文章
论坛常见问题解答 | 相逢在论坛从杀毒软件到文化 | 我们为什么要装防火墙hips新手入门 | 卡饭HIPS教程集合病毒样本区 | 费尔区
发新话题
打印

[病毒样本] 一个可疑屏保(附加注册表信息)穿了Kis8????

一个可疑屏保(附加注册表信息)穿了Kis8????

2008-10-05 22:45
[BackDoor]
C:\WINDOWS\SYSTEM32\RVECSE.SCR
HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET001\SERVICES\WINDOWS RVECSE
HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET002\SERVICES\WINDOWS RVECSE
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\WINDOWS RVECSE

[2.8.1.8.0815 - 2.8.16.8.1005]
2008-10-05 22:45
[Risk.PCHealthCenter]
C:\WINDOWS\SYSTEM32\2.ICO
附件: 您所在的用户组无法下载或查看附件




卡巴2009不报,驱逐舰也不报




犯我强汉者,虽远必诛!

TOP

尸体?

[ 本帖最后由 wangjay1980 于 2008-10-5 23:22 编辑 ]
附件: 您所在的用户组无法下载或查看附件




我的地盘#KL病毒上报邮箱:newvirus@kaspersky.com
C:\Users\Administrator\Desktop\1\7_200810052245200656\C\WINDOWS\SYSTEM32\RVECSE.SCR - a variant of Win32/Delf.NGT trojan


TOP

Scan Stats:
  Scan Time: 3 seconds
  Scan Options:
  Scan Targets: D:\Virus\1.part2\7_200810052245200656.zip
  Counts:
   Total items scanned: 4
   - Files & Directories: 4
   - Registry Entries: 0
   - Processes & Start-up Items: 0
   - Network & Browser Items: 0
   - Other: 0
   - Trusted Files: 0
   - Skipped Files: 0

   Total security risks detected: 1
   Total items resolved: 1
   Total items that require attention: 0

Resolved Threats:
Backdoor.Trojan
Type: Compressed
Risk: High (High Stealth, High Removal, High Performance, High Privacy)  
Categories: Virus
Status: Fully Resolved
-----------
1 File
[rvecse.scr] inside of [d:\virus\1.part2\7_200810052245200656.zip] - Deleted




Unresolved Threats:


我们都是小熊猫~

TOP

http://www.threatexpert.com/repo ... 79ac4346959a46ea635


Visit ThreatExpert web site|Close Report

Submission Summary:
  • Submission details:
    • Submission received: 6 October 2008, 02:16:51
    • Processing time: 5 min 23 sec
    • Submitted sample:
      • File MD5: 0x71471DD8C385779AC4346959A46EA635
      • Filesize: 529,408 bytes
      • Alias: Backdoor.Trojan [Symantec], Backdoor:Win32/Delf.RAL [Microsoft]
  • Summary of the findings:
What's been foundSeverity Level
Contains characteristics of an identified security risk.


Technical Details:
Possible Security Risk

  • Attention! The following threat category was identified:
Threat CategoryDescription
A malicious backdoor trojan that runs in the background and allows remote access to the compromised system


File System Modifications

  • The following file was created in the system:
#Filename(s)File SizeFile MD5Alias
1[file and pathname of the sample #1] 529,408 bytes0x71471DD8C385779AC4346959A46EA635Backdoor.Trojan [Symantec]
Backdoor:Win32/Delf.RAL [Microsoft]


Memory Modifications

  • The following module was loaded into the address space of other process(es):
Module NameModule FilenameAddress Space Details
[filename of the sample #1][file and pathname of the sample #1]Process name: [generic host process]
Process filename: [generic host process filename]
Address space: 0x8F0000 - 0xA00000

  • Note:
    • [generic host process filename] is a full path filename of [generic host process].

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.
The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.
Copyright © 2008 ThreatExpert. All rights reserved.


我的地盘#KL病毒上报邮箱:newvirus@kaspersky.com

TOP

Starting the file scan:

Begin scan in 'C:\Users\TOSHIBA\Desktop\1'
C:\Users\TOSHIBA\Desktop\1\7_200810052245200656\C\WINDOWS\SYSTEM32\RVECSE.SCR
    [DETECTION] Contains recognition pattern of the WORM/Otwycal.J worm
    [NOTE]      A backup was created as '492ef18b.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!


End of the scan: 2008年10月6日  19:06
Used time: 00:02 Minute(s)

The scan has been done completely.

      5 Scanning directories
      3 Files were scanned
      1 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      0 Archives were scanned
      0 Warnings
      1 Notes


TOP

McAfee  miss



℡心淒淒 ﹏ | ℡孤零零 ﹏

TOP

发新话题
本功能由奇虎问答实现

相关主题

标题 作者 最后发表
清理WINDOWS的垃圾壁纸和屏保,用户头像,主题,鼠标方案 lookbooker 2008-05-17
启用KIS7.0的注册表保护后不能更改屏保和电源管理了 yiquhn 2007-12-18
走出误区 教你杀毒软件到底该怎么用 north_wolf 2008-04-30
菜鸟的十八个习惯动作,看看你有几个? 黑色准男爵 2008-04-12
我的电脑莫名其妙中标了! huliyong 2008-03-08
卡饭论坛