[MD5: 0F0CA1 690E6F]

tonger2003

The EQs

Scan performed at: 2007-7-22 22:12:33
Scanning Log
NOD32 version 2411 (20070721) NT
Command line: C:\Documents and Settings\EQ2\桌面\样本.zip
Operating memory - is OK

Date: 22.7.2007  Time: 22:12:39
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\样本.zip
C:\Documents and Settings\EQ2\桌面\样本.zip ?ZIP ?NewTemp.dll - probably a variant of Win32/PSW.OnLineGames.NBR trojan
C:\Documents and Settings\EQ2\桌面\样本.zip ?ZIP ?PegeFile.pif - probably a variant of Win32/PSW.Delf.NHI trojan
Number of scanned files: 3
Number of threats found: 2
Number of files cleaned: 1
Time of completion: 22:12:39 Total scanning time: 0 sec (00:00:00)

promised

C:\ABC\样本\NewTemp.dll - 特征码 'Win32.SuspectCrc' 被发现
C:\ABC\样本\PegeFile.pif - 特征码 'Trojan-PWS.Win32.Delf.mc' 被发现

        2 个文件被扫描
          (0 个压缩档 0 个文件)
        2 个特征码被侦测
        0 个可疑代码段被发现
        耗时: 0:00.078

quansen83

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本.zip'
C:\Documents and Settings\Administrator\桌面\样本.zip
  [0] Archive type: ZIP
  --> NewTemp.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> PegeFile.pif
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
      [INFO]      The file was deleted!

风雪

费尔过。

scottxzt

样本.zip\NewTemp.dll;D:\Documents and Settings\dell\桌面\样本.zip;Trojan.DownLoader.origin;;
样本.zip\PegeFile.pif;D:\Documents and Settings\dell\桌面\样本.zip;Win32.HLLW.Autoruner.249;;

goal

C:\Documents and Settings\GOAL\桌面\样本.zip >>ZIP >>NewTemp.dll - 可能是 Win32/PSW.OnLineGames.NBR 木马 的一个变种
C:\Documents and Settings\GOAL\桌面\样本.zip >>ZIP >>PegeFile.pif - 可能是 Win32/PSW.Delf.NHI 木马 的一个变种

微点卫士

好厉害,解压出来后居然隐藏掉了,看不见的,微点无法检测
在压缩包内pagefile.pif被压缩包提示有潜在危险,关闭

wangjay1980

Hello,

NewTemp.dll, PegeFile.pif_ - Trojan-PSW.Win32.Delf.wh

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vladimir Lebedev
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

taitan001

F:\样本.zip:<ZIP>\NewTemp.dll : is suspected of Trojan-PSW.Game.18 (paranoid heuristics)
F:\样本.zip:<ZIP>\PegeFile.pif : is suspected of Trojan-PSW.Game.18 (paranoid heuristics)