蠕虫一个【30ae14】

欠妳緈諨

[ 本帖最后由 欠你幸福 于 2007-7-11 21:19 编辑 ]

The EQs

Scan performed at: 2007-7-11 21:19:53
Scanning Log
NOD32 version 2392 (20070711) NT
Command line: C:\Documents and Settings\EQ2\桌面\ffgi_ii.rar
Operating memory - is OK

Date: 11.7.2007  Time: 21:19:59
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\ffgi_ii.rar
C:\Documents and Settings\EQ2\桌面\ffgi_ii.rar ?RAR ?FFGI II.exe - probably unknown NewHeur_PE virus [7]
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 21:19:59 Total scanning time: 0 sec (00:00:00)

Notes:
[7] File is probably infected with an unknown virus.

tracydk

红伞挂了

1688388728

不能运行

promised

MS是重复样本
19个一包的那个里面的
C:\ABC\ffgi_ii\FFGI II.exe - 特征码 'Backdoor.Win32.Rbot.bpb' 被发现

        1 个文件被扫描
          (0 个压缩档 0 个文件)
        1 个特征码被侦测
        0 个可疑代码段被发现
        耗时: 0:00.000

wangjay1980

A-Squared  Found nothing
AntiVir  Found WORM/VB.NLQ  
ArcaVir  Found nothing
Avast  Found nothing
AVG Antivirus  Found Worm/Agobot.DAI  
BitDefender  Found Win32.Worm.VB.NLQ  
ClamAV  Found nothing
Dr.Web  Found nothing
F-Prot Antivirus  Found nothing
F-Secure Anti-Virus  Found nothing
Fortinet  Found W32/AgoBot.U!worm  
Kaspersky Anti-Virus  Found nothing
NOD32  Found probably unknown NewHeur_PE (probable variant)  
Norman Virus Control  Found nothing
Panda Antivirus  Found nothing
Rising Antivirus  Found nothing
Sophos Antivirus  Found nothing
VirusBuster  Found nothing
VBA32  Found nothing

Hello,

FFGI II.exek - Trojan.Win32.VB.bcf

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vladimir Krylov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: ffgi ii.rar

[ 本帖最后由 wangjay1980 于 2007-7-11 23:19 编辑 ]

tracydk

Starting the file scan:

Begin scan in 'F:\病毒样本\ffgi_ii.rar'
F:\病毒样本\ffgi_ii.rar
  [0] Archive type: RAR
  --> FFGI II.exe
      [DETECTION] Contains signature of the worm WORM/VB.NLQ
      [INFO]      The file was deleted!

moonsilver

RS pass

tracydk

AhnLab-V3 2007.7.11.1 20070711 no virus found
AntiVir 7.4.0.39 20070711 Worm/VB.NLQ
Authentium 4.93.8 20070710 no virus found
Avast 4.7.997.0 20070711 no virus found
AVG 7.5.0.476 20070710 Worm/Agobot.DAI
BitDefender 7.2 20070711 Win32.Worm.VB.NLQ
CAT-QuickHeal 9.00 20070711 (Suspicious) - DNAScan
ClamAV devel-20070416 20070711 no virus found
DrWeb 4.33 20070711 no virus found
eSafe 7.0.15.0 20070710 no virus found
eTrust-Vet 30.8.3779 20070711 no virus found
Ewido 4.0 20070711 no virus found
FileAdvisor 1 20070711 no virus found
Fortinet 2.91.0.0 20070711 W32/AgoBot.U!worm
F-Prot 4.3.2.48 20070710 no virus found
Ikarus T3.1.1.8 20070711 Backdoor.Win32.Rbot.bpb
Kaspersky 4.0.2.24 20070711 no virus found
McAfee 5071 20070710 W32/Gaobot.worm.gen.u
Microsoft 1.2704 20070711 no virus found
NOD32v2 2392 20070711 probably unknown NewHeur_PE virus
Norman 5.80.02 20070711 no virus found
Panda 9.0.0.4 20070711 no virus found
Sophos 4.19.0 20070706 no virus found
Sunbelt 2.2.907.0 20070711 no virus found
Symantec 10 20070711 Trojan.Packed.16
TheHacker 6.1.6.144 20070709 no virus found
VBA32 3.12.0.2 20070710 no virus found
VirusBuster 4.3.23:9 20070710 no virus found
Webwasher-Gateway 6.0.1 20070711 Worm.VB.NLQ

taihuxian

BitDefender

This web page has been blocked by BitDefender Antivirus Real-time Protection!

The blocked web page included objects that were either infected or likely to be infected with a virus. Your system has NOT been infected.
http://www.bitdefender.com/vfind/?q=Win32.Worm.VB.NLQ