123【MD5：dc6cf2】

bluenice

NOD32明明报了，为什么帖的多引擎扫描不报？

The EQs

nod32不支持这个压缩包。。。必须得解压后才能发现。。。。

[ 本帖最后由 EQ2 于 2007-7-16 11:36 编辑 ]

蓝色牛仔裤

看Webwashe的报法就是红伞引擎报的。。。
红伞不解包。。Ikarus也是。。。

D:\Z.Virus\123\123\
  ie.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPI.Gen
      [WARNING]   The file was ignored!


D:\Z.Virus\123\123\avp.exe
D:\Z.Virus\123\123\ie.exe - Signature 'Backdoor.Win32.Agent.ahj' found

   2 Files scanned
      (0 Archives with 0 files)
    1 Signature found
    0 Suspect code-parts found
    Used time: 0:00.047

[ 本帖最后由 蓝色牛仔裤 于 2007-7-16 11:46 编辑 ]

jyxtay

[:27:] AVAST!报Win32:Delf-DNR [Trj]特洛伊木马

蓝色牛仔裤

avp.exe最主要是生成了这个批处。

1. Set date=%date%  
   
2. date 2004-10-09
   
3. @Echo Off & setlocal enableextensions
   
4. Ec
   o Ws cript.Sleep 1000 >
   
5. Set /a i = 5
   
6. :Timeout
   
7. If %i% == 0 Goto Next
   
8. setlo
   al
   
9. Set /a i = %i% - 1
   
10. cs cript //nologo fyzero.vbs  
    
11. Goto Timeout
    
12. Goto End
    
13. :Next  
    
14. dcte %date%

复制代码

风雪

1184558734,2007-7-16 12:05:34,Trojan.BAT.KillAV.ec.likf.for,木马,mygood,D:\3\新建文件夹\新建文件夹\123.zip>>123.exe>>emb-0.cab>>avp.exe,Manual scan
1184558734,2007-7-16 12:05:34,Heuri.Possible/Packed,启发式扫描,mygood,D:\3\新建文件夹\新建文件夹\123.zip>>123.exe>>emb-0.cab>>ie.exe,Manual scan
费尔

woai_jolin

原帖由 红心王子 于 2007-7-16 11:15 发表
看 norman的扫描结果超强  [:27:] [:27:]

Scan taken on 16 Jul 2007 03:13:48 (GMT) A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found ...

那是norman的sandbox分析结果
===================================================================================================
NVCOD On Demand Scanner 5.80.02
NSE revision 5.91.02
nvcbin.def revision 5.90.00 of 2007/07/13 18:54:26 (807131 variants)
nvcmacro.def revision 5.90.00 of 2007/06/29 06:32:19 (20341 variants)
Total number of variants: 827472
Command line: "@C:\Users\Jason\AppData\Local\Temp\~ODDA97.tmp"
===================================================================================================
       Time  Filename                                                     Virus name
---------------------------------------------------------------------------------------------------
- Scanning files matching: D:\virus\123.zip
     22171 ms D:\virus\123.zip : 123.exe                                   Virus W32/Hupigon.gen67 ( [ General information ]
    * **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
    * Creating several executable files on hard-drive.
    * File length:        83456 bytes.
[ Changes to filesystem ]
    * Deletes directory C:\WINDOWS\TEMP\IXP0.TMP.
    * Creates directory C:\WINDOWS\TEMP\IXP0.TMP.
    * Creates file C:\WINDOWS\TEMP\IXP0.TMP\TMP4351$.TMP.
    * Creates file C:\WINDOWS\TEMP\IXP0.TMP\avp.exe.
    * Creates file C:\WINDOWS\TEMP\IXP0.TMP\ie.exe.
    * Deletes file C:\WINDOWS\TEMP\IXP0.TMP\ie.exe.
    * Deletes file C:\WINDOWS\TEMP\IXP0.TMP\avp.exe.
    * Deletes file C:\WINDOWS\TEMP\IXP0.TMP\TMP4351$.TMP.
    * Deletes directory C:\WINDOWS\TEMP\IXP0.TMP\.
    * Creates file C:\WINDOWS\winllogon.exe.
    * Creates file C:\WINDOWS\Deleteme.bat.
[ Changes to registry ]
    * Creates key "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce".
    * Sets value "wextract_cleanup0"="rundll32.exe C:\WINDOWS\SYSTEM32\advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\TEMP\IXP0.TMP\"" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce".
    * Deletes value "wextract_cleanup0" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce".
    * Creates key "HKLM\System\CurrentControlSet\Services\IE_WinServerName".
    * Sets value "ImagePath"="C:\WINDOWS\winllogon.exe" in key "HKLM\System\CurrentControlSet\Services\IE_WinServerName".
    * Sets value "DisplayName"="Windows CreaterIE" in key "HKLM\System\CurrentControlSet\Services\IE_WinServerName".
[ Process/window information ]
    * Attempts to access service "IE_WinServerName".
    * Creates service "IE_WinServerName (Windows CreaterIE)" as "C:\WINDOWS\winllogon.exe".
)
        0 ms D:\virus\123.zip                                            
        0 ms D:\virus\123.zip:Zone.Identifier                           
- File D:\virus\123.zip quarantined.
===================================================================================================
The scanning started: 2007/07/16 14:07:01
               ended: 2007/07/16 14:07:24
Logged on as        : Jason
on hostname         : JASON-PC
Scanning results:
   Total number of files found..............................:       3
   Number of files scanned..................................:       3
   Number of files/directories skipped due to exclude list..:       0
   Number of files that could not be opened.................:       0
   Number of archive files unpacked.........................:       1
   Number of archive files not unpacked.....................:       0
   Number of infections.....................................:       1
Copyright (c) 1993-2005 Norman ASA.