一个[MD5:a48f2c]

显示全部楼层 · 发表于 2007-7-10 21:45:58

RT
Hello.
New malicious software was found in the attached file.
Backdoor.Win32.Agent.ahj
It's detection will be included in the next update. Thank you for your help.
-----------------
Regards, Vladimir Krylov
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com http://www.viruslist.com

> Attachment: par.zip

[ 本帖最后由 wangjay1980 于 2007-7-10 23:10 编辑 ]

显示全部楼层 · 发表于 2007-7-10 21:46:58

Starting the file scan:

Begin scan in 'F:\病毒样本\par.zip'
F:\病毒样本\par.zip
  [0] Archive type: ZIP
  --> par.exe
   [DETECTION] Contains suspicious code HEUR/Crypted
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-7-10 21:47:05

Scan performed at: 2007-7-10 21:46:43
Scanning Log
NOD32 version 2389 (20070710) NT
Command line: C:\Documents and Settings\EQ2\桌面\par.zip
Operating memory - is OK

Date: 10.7.2007 Time: 21:46:51
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\par.zip
C:\Documents and Settings\EQ2\桌面\par.zip ?ZIP ?par.exe - probably a variant of Win32/Agent.NEO trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 21:46:51 Total scanning time: 0 sec (00:00:00)

显示全部楼层 · 发表于 2007-7-10 21:47:41

[Scan path] C:\Documents and Settings\Administrator\桌面\par.zip
>C:\Documents and Settings\Administrator\桌面\par.zip\par.exe infected with BackDoor.QQChin
C:\Documents and Settings\Administrator\桌面\par.zip - archive contains infected objects

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 3
Infected objects found: 1
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 18 Kb/s
Scan time: 00:00:01

显示全部楼层 · 发表于 2007-7-10 21:50:40

没办法，人家更新不换名字

显示全部楼层 · 发表于 2007-7-10 21:50:49

norman报鸽子

显示全部楼层 · 发表于 2007-7-10 21:51:25

c:\ABC\par.zip:\par.exe - Signature 'Trojan-PWS.Win32.Agent.BU' found
c:\ABC\par.zip

2 Files scanned
(1 Archiv with 1 file)
1 Signature found
0 Suspect code-parts found
Used time: 0:00.079

显示全部楼层 · 发表于 2007-7-10 21:52:39

NORMAN能报就不错了

，不能要求太高

显示全部楼层 · 发表于 2007-7-10 21:53:16

norman是对壳的反应。。。。。

显示全部楼层 · 发表于 2007-7-10 21:54:15

费尔启发。

[病毒样本] 一个[MD5:a48f2c]

本帖子中包含更多资源

又是老面孔

回复 #3 EQ2 的帖子

本帖子中包含更多资源

回复 #6 tracydk 的帖子