MD5:60acc8

pluto1313

释放随机8位字符exe和dll，附带批处理删除自身，dll注入winlogon.exe和explorer.exe用于保护自身服务
不是之前说的AV终结者

至少今天下午没AV报，报的都是启发

发这里只是想知道卡7可启发不

主防的不用测了，过不了

风野胤

Scanning Log
NOD32 version 2367 (20070701) NT
Command line: C:\Documents and Settings\Administrator\ ?
?桌面\virus.rar
Checking CRC of NOD32.EXE: Status OK
Scanning memory: Not performed (option disabled)
Error occurred while scanning MBR sector of the 2.  ?
?physical disk. Error reading sector.
Error occurred while scanning MBR sector of the 3.  ?
?physical disk. Error reading sector.
Date: 1.7.2007  Time: 23:45:16
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and  ?
?Settings\Administrator\桌面\virus.rar
C:\Documents and Settings\Administrator\桌面\virus.rar  ?
??RAR ?virus.exe - probably a variant of Win32/Agent.NEO  ?
?trojan
Number of scanned files: 2
Number of threats found: 1
Time of completion: 23:45:17 Total scanning time: 1 sec  ?
?(00:00:01)


没过nod启发
理论上应该也过不了vba32吧

promised

VBA32最近库很烂的
?         Copyright (c) 1993-2007 by VBA Ltd.           ?
酝屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯图
License expired
License #000000119 Valid till 2006-12-31
Demo mode
Command line options:
/r=susp.rpt /ha=3 /collect_suspects /n.../af+ /fd+ /ar+ /bt- /mr- /ml+ /rw+ /as-
Ctrl-C will terminate program execution

*:
C:\
C:\ABC\...\virus.exe : is suspected of Trojan-PSW.Game.63 (paranoid heuristics)
Program execution terminated by user


Directories       : 3       Files in archives:      Files on disks:
Archives:                   - total       : 1       - total       : 11
- scanned         : 1       -  scanned    : 1       - scanned     : 11
- contain viruses : 0       -  infected   : 0       - infected    : 0
- deleted         : 0       -  suspicious : 1       - suspicious  : 1

Startup    : 23:47:42 01-07-2007
End        : 23:47:47 01-07-2007
Total time : 00:00:05
终止批处理操作吗(Y/N)?

[ 本帖最后由 promised 于 2007-7-1 23:48 编辑 ]

蓝色牛仔裤

Check system areas...
Check selected directories and files...
Object: virus.exe
        Path: C:\Documents and Settings\Administrator\桌面\virus
        Status: Virus detected
        Virus: Win32:Agent-HFX [Trj] (AVAST-Engine)
Analysis complete: 2007-7-1 23:46
    1 files checked
    1 infected files detected
    0 suspected files detected

欠妳緈諨

AVAST报已知啊

wangjay1980

detected: virus Heur.Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\virus.rar/virus.exe

pluto1313

这东西大概也知道卡7可启发到，只是上来确认一下

看这个坛子最近卡7的启发表现还不错，比之前出来的要好得多

野马

好像见过

hj5abc

原帖由 wangjay1980 于 2007-7-1 23:50 发表
detected: virus Heur.Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\virus.rar/virus.exe

卡巴启发前途无量.
就近好像连连得志.

yurius

为什么我的7.0.0.123启发不出来的？已经开到最大了，你用的是什么版本