两个，A897A4 B934BB

zane_xzz

费尔挂了

promised

C:\ABC\样本.rar:\joker.exe - 可疑代码段 被发现 (Level: 95)
C:\ABC\样本.rar:\1.exe - 特征码 'Trojan.Delf.NEB' 被发现
C:\ABC\样本.rar

        3 个文件被扫描
          (1 个压缩档 2 个文件)
        1 个特征码被侦测
        1 个可疑代码段被发现
        耗时: 0:03.454

snakebone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\1样本.rar'
C:\Documents and Settings\Administrator\桌面\
  1样本.rar
    [0] Archive type: RAR
    --> joker.exe
        [DETECTION] Contains signature of the SPR/QQStealer.A program
        [WARNING]   Infected files in archives cannot be repaired!
    --> 1.exe
        [DETECTION] Is the Trojan horse TR/PSW.Steal.27861
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      A backup was created as 'adce26d8.qua'  ( QUARANTINE )
        [INFO]      The file was deleted!

风野胤

joker少东西
1.exe nod pass

yym1988520

nis 1

aerbeisi

detected: virus Downloader (modification)        File: Ñù±¾.rar/1.exe

红心王子

Hack.Exploit.Win32.PHP168.a
Trojan.PSW.Win32.QQPass.qnj

woai_jolin

NORMAN ALL PASS

xxwpk007

已检测到: 病毒 Downloader (变种)        文件: G:\样本\样本\样本\1.exe

a256886572008

運行1.exe，發現下列行為，被EQ-Secure RC4攔截！

2007-07-21 16:28:37    创建文件      操作:允许
进程路径:D:\桌面\virus\A897A4\1.exe
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\C\Program Files\Common Files\Microsoft Shared\MSINFO\System16.jup
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*


2007-07-21 16:28:38    创建文件      操作:允许
进程路径:D:\桌面\virus\A897A4\1.exe
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\C\Program Files\Common Files\Microsoft Shared\MSINFO\System16.ins
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*

1.他會在C\Program Files\Common Files\Microsoft Shared\MSINFO\生成
   System16.jup
   System16.ins