5个网上老毒，应该都能报[MD5: 442794 C49C21 5965E6 D80B03 9A297D]

zane_xzz

5个网上老毒，应该都能报

woai_jolin

===================================================================================================
NVCOD On Demand Scanner 5.80.02

NSE revision 5.91.02
nvcbin.def revision 5.90.00 of 2007/07/16 18:21:00 (810345 variants)
nvcmacro.def revision 5.90.00 of 2007/06/29 06:32:19 (20341 variants)
Total number of variants: 830686
Command line: "@C:\Users\Jason\AppData\Local\Temp\~ODBC6B.tmp"
===================================================================================================

       Time  Filename                                                     Virus name
---------------------------------------------------------------------------------------------------
- Scanning files matching: D:\v\update(1).exe
       31 ms D:\v\update(1).exe                                           Security Risk W32/Suspicious_U.gen ()
- Scanning files matching: D:\v\2003.exe
     6406 ms D:\v\2003.exe                                               
- Scanning files matching: D:\v\cab.exe
       15 ms D:\v\cab.exe                                                 Virus W32/Viking.EQ ()
- Scanning files matching: D:\v\flash.exe
       16 ms D:\v\flash.exe                                               Trojan W32/AutoRun.Q ()
- Scanning files matching: D:\v\update.exe
       16 ms D:\v\update.exe                                              Trojan W32/OnLineGames.HJU ()
- File D:\v\update(1).exe quarantined.
- File D:\v\update(1).exe deleted.
- File D:\v\cab.exe quarantined.
- Virus W32/Viking.EQ () removed.
- File D:\v\flash.exe quarantined.
- File D:\v\flash.exe deleted.
- File D:\v\update.exe quarantined.
- File D:\v\update.exe deleted.

===================================================================================================

The scanning started: 2007/07/17 13:18:03
               ended: 2007/07/17 13:18:10
Logged on as        : Jason
on hostname         : JASON-PC

Scanning results:
   Total number of files found..............................:       5
   Number of files scanned..................................:       5
   Number of files/directories skipped due to exclude list..:       0
   Number of files that could not be opened.................:       0
   Number of archive files unpacked.........................:       0
   Number of archive files not unpacked.....................:       0
   Number of infections.....................................:       4

Copyright (c) 1993-2005 Norman ASA.

yitp

微点还是有3个说是未知病毒,加壳
病毒资料库太小

woai_jolin

Norman唯一一个不报的2003.exe
sandbox分析
2003.exe : Not detected by Sandbox (Signature: NO_VIRUS)


[ DetectionInfo ]
    * Sandbox name: NO_MALWARE
    * Signature name: NO_VIRUS

[ General information ]
    * File length:       101888 bytes.
    * MD5 hash: 4427941fd0e6845e3ec2d8764c5eb1ae.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information
source only.

This file is not flagged as malicious by the Norman Sandbox Information
Center. However, we can not guarantee that the file is harmless. If
you still suspect the file to be malicious and if you urgently need to
know for sure, please submit it to your local Norman support department
for manual analysis.

promised

C:\ABC\样本\2003.exe - 特征码 'Packed.Win32.Klone.af' 被发现
C:\ABC\样本\cab.exe - 特征码 'Trojan-Spy.Win32.Agent.hz' 被发现
C:\ABC\样本\flash.exe - 特征码 'BehavesLikeWin32.ExplorerHijack' 被发现
C:\ABC\样本\update(1).exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\样本\update.exe - 特征码 'Trojan-PWS.Win32.Delf.qc' 被发现

The EQs

Scan performed at: 2007-7-17 13:19:12
Scanning Log
NOD32 version 2401 (20070716) NT
Command line: C:\Documents and Settings\EQ2\桌面\样本
Operating memory - is OK

Date: 17.7.2007  Time: 13:19:20
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\样本\
C:\Documents and Settings\EQ2\桌面\样本\cab.exe - probably a variant of Win32/PSW.Maran trojan
C:\Documents and Settings\EQ2\桌面\样本\flash.exe - a variant of Win32/Delf.BO worm
C:\Documents and Settings\EQ2\桌面\样本\update(1).exe - Win32/Pacex.Gen virus
C:\Documents and Settings\EQ2\桌面\样本\update.exe - probably unknown NewHeur_PE virus [7]
Number of scanned files: 5
Number of threats found: 4
Number of files cleaned: 4
Time of completion: 13:19:29 Total scanning time: 9 sec (00:00:09)

Notes:
[7] File is probably infected with an unknown virus.

FBAV

风暴胜者V2 贺岁精简网络版本
_________您的安全是我们的责任_______________
作者：Sanhuan222@163.com   TM:469428271
个人Blog：http://hi.baidu.com/迅者/



===============================================
   ___________病毒查杀结果__________________


===============================================

2007年5月17日13时28分15秒 开始查杀C:\Documents and Settings\Administrator\桌面\virus\样本
C:\Documents and Settings\Administrator\桌面\virus\样本\flash.exe 发现未知可疑文件:Win32.NkHack.jectd3 操作:阻止运行
C:\Documents and Settings\Administrator\桌面\virus\样本\cab.exe 发现未知可疑文件:Win32.NkHack.Upack.A 操作:阻止运行
C:\Documents and Settings\Administrator\桌面\virus\样本\update.exe 发现未知可疑文件:Win32.Nop myex 操作:阻止运行
****************************
您应该引起注意的文件:

-----------------------------------------


=========================================

_________文件性质分析结果________________
"带壳"仅指文件性质,仅供专业人员分析使用。


C:\Documents and Settings\Administrator\桌面\virus\样本\mminstall[1].exe 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\virus\样本\flash.exe 带壳文件:UPX加壳
-----------------------------------------

2007年5月17日13时28分16秒收起线程…100% 查杀完毕！
扫描文件：4查杀病毒：3

shenrenrenren

卡巴没报2003那个，加了那玩意。

promised

Hying的东西

红心王子

C:\Documents and Settings\Administrator\桌面\样本
.part1.rar>>flash.exe>>upx_c           Trojan.Win32.Agent.blo
C:\Documents and Settings\Administrator\桌面\样本
.part1.rar>>cab.exe>>upack0.32        Trojan.PSW.Win32.OnlineGames.cvo
C:\Documents and Settings\Administrator\桌面\样本
.part1.rar>>update.exe              Trojan.PSW.Win32.OnLineGames.bq