《狙剑》有毒，过多数杀软已经上报8cdd9

qwerasdf123

红伞回应：Dear Sir or Madam,

Thank you for your email to Avira's virus lab.
Tracking number: INC00060943.


We received the following archive files:

File ID	Filename	Size (Byte)	Result
1104928	??5013(7.15).rar	122.41 KB	OK

A listing of files contained inside archives alongside their results can be found below:

File ID	Filename	Size (Byte)	Result
1104929	SnipeSword.exe	151.5 KB	MALWARE

Please find a detailed report concerning each individual sample below:

Filename

Result

SnipeSword.exe

MALWARE

The file 'SnipeSword.exe' has been determined to be 'MALWARE'.
Our analysts discovered that the file is a Trojan. In general this kind of programs contains harmful functionality called payload. Detection will be added to our virus definition file (VDF) with one of the next updates.
Alternatively you can see the analysis result here:
http://analysis.avira.com/samples/details.php?uniqueid=G8k13jBdLDxM1Z03NME2WO1vxNTqQDL6&incidentid=60943

An overview of all your submissions can be found here:
http://analysis.avira.com/samples/details.php?uniqueid=G8k13jBdLDxM1Z03NME2WO1vxNTqQDL6

Please note: The detection of Spy/Adware is not available in the product "AntiVir PersonalEdition Classic". Please address specific questions to support@avira.com
Kind regards
Avira Virus Lab

---------------------------------------------
Avira GmbH
Lindauer Str. 21, D-88069 Tettnang, Germany
Phone: +49 (0) 7542-500 0
Fax: +49 (0) 7542-525 10
Internet: http://www.avira.com

CEO: Tjark Auerbach
Headquarter: Tettnang
Commercial register: AG Ulm HRB 630992
---------------------------------------------

卡巴回应：
Hello.
New malicious software was found in the attached file.
It's detection will be included in the next update as Trojan.Win32.Agent.ath. Thank you for your help.
-----------------
Regards, Yury Nesmachny
Virus Analyst, Kaspersky Lab.

Ph.: +7(495) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com


> Attachment: SnipeSword.rar

>  password :  virus
>

A-Squared	Found nothing
AntiVir	Found nothing
ArcaVir	Found nothing
Avast	Found nothing
AVG Antivirus	Found nothing
BitDefender	Found nothing
ClamAV	Found nothing
Dr.Web	Found nothing
F-Prot Antivirus	Found nothing
F-Secure Anti-Virus	Found nothing
Fortinet	Found nothing
Kaspersky Anti-Virus	Found nothing
NOD32	Found probably a variant of Win32/Genetik (probable variant)
Norman Virus Control	Found nothing
Panda Antivirus	Found nothing
Rising Antivirus	Found nothing
Sophos Antivirus	Found Mal/Behav-044
VirusBuster	Found nothing
VBA32	Found Malware.Agent.107 (probable variant)

[ 本帖最后由 qwerasdf123 于 2007-7-18 21:26 编辑 ]

promised

C:\ABC\狙剑5013(7.15).rar:\SnipeSword.exe - 特征码 'Trojan-Proxy.Win32.Webber.U' 被发现
C:\ABC\狙剑5013(7.15).rar

        4 个文件被扫描
          (2 个压缩档 2 个文件)
        1 个特征码被侦测
        0 个可疑代码段被发现
        耗时: 0:05.094

3AV?不只的

[ 本帖最后由 promised 于 2007-7-16 22:02 编辑 ]

qwerasdf123

这个东西是我在http://bbs.kafan.cn/viewthread.php?tid=79940&extra=page%3D1
看到的
是推荐的杀毒辅助工具
到底是不是毒啊？
有联网动作，微点报河北廊坊地区
具体ip找不到了

qwerasdf123

Antivirus Version Last Update Result
AhnLab-V3 2007.7.14.0 2007.07.16 no virus found
AntiVir 7.4.0.42 2007.07.16 no virus found
Authentium 4.93.8 2007.07.13 no virus found
Avast 4.7.997.0 2007.07.16 no virus found
AVG 7.5.0.476 2007.07.15 no virus found
BitDefender 7.2 2007.07.16 no virus found
CAT-QuickHeal 9.00 2007.07.16 no virus found
ClamAV devel-20070416 2007.07.16 no virus found
DrWeb 4.33 2007.07.16 no virus found
eSafe 7.0.15.0 2007.07.10 Suspicious Trojan/Worm
eTrust-Vet 30.8.3787 2007.07.16 no virus found
Ewido 4.0 2007.07.14 no virus found
FileAdvisor 1 2007.07.16 no virus found
Fortinet 2.91.0.0 2007.07.16 no virus found
F-Prot 4.3.2.48 2007.07.13 no virus found
Ikarus T3.1.1.8 2007.07.16 Trojan-Proxy.Win32.Webber.U
Kaspersky 4.0.2.24 2007.07.16 no virus found
McAfee 5074 2007.07.13 no virus found
Microsoft 1.2704 2007.07.16 no virus found
NOD32v2 2399 2007.07.14 probably a variant of Win32/Genetik
Norman 5.80.02 2007.07.16 no virus found
Panda 9.0.0.4 2007.07.16 Suspicious file
Sophos 4.19.0 2007.07.16 Mal/Behav-044
Sunbelt 2.2.907.0 2007.07.14 no virus found
Symantec 10 2007.07.16 no virus found
TheHacker 6.1.6.147 2007.07.16 no virus found
VBA32 3.12.0.2 2007.07.16 suspected of Malware.Agent.107
VirusBuster 4.3.23:9 2007.07.15 no virus found
Webwasher-Gateway 6.0.1 2007.07.16 no virus found

以上是virustotal的扫描结果

woai_jolin

norman pass上报

wangjay1980

误报

woai_jolin

这个东西
SnipeSword.exe : Not detected by Sandbox (Signature: NO_VIRUS)


[ DetectionInfo ]
    * Sandbox name: NO_MALWARE
    * Signature name: NO_VIRUS

[ General information ]
    * File might be compressed.
    * Decompressing ASPack.
    * File length:       155136 bytes.
    * MD5 hash: 8cdd92a7ef513b5f4adefdb79ae481ab.

[ Process/window information ]
    * Creates a mutex GetMutx.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information
source only.

This file is not flagged as malicious by the Norman Sandbox Information
Center. However, we can not guarantee that the file is harmless. If
you still suspect the file to be malicious and if you urgently need to
know for sure, please submit it to your local Norman support department
for manual analysis.
加了一个普普通通的aspack

qwerasdf123

借贴求助高手
症状在此

http://bbs.kafan.cn/viewthread.php?tid=108871&extra=page%3D1

woai_jolin

原帖由 qwerasdf123 于 2007-7-16 22:09 发表
借贴求助高手
症状在此

http://bbs.kafan.cn/viewthread.php?tid=108871&extra=page%3D1

天啊
那是正常的

qwerasdf123

Begin scan in 'C:\Documents and Settings\Chen\Desktop\狙剑5013(7.15).rar'
C:\Documents and Settings\Chen\Desktop\狙剑5013(7.15).rar
  [0] Archive type: RAR
  --> SnipeSword.exe
      [DETECTION] Is the Trojan horse TR/Agent.ath
      [INFO]      A backup was created as '46d2200f.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!

[ 本帖最后由 qwerasdf123 于 2007-7-17 22:15 编辑 ]