AVG找到的,过卡巴[MD5: 83D074]

eaco

驱逐舰也能杀

jlennon

红心王子

C:\Documents and Settings\Administrator\桌面\样本
.rar>>Finish.exe
Trojan.Theman.a

lsyer

简单的分析下
运行后调出CMD
C:\WINDOWS下生成0D3F565F-C3F3-47AA-ADFF-65D7472E8C95.bat
其内容为
@ECHO OFF
%WinDir%\devcon.exe update "C:\windows\inf\cpu.inf" ACPI\Processor
@Echo  END.
C:\WINDOWS下生成devcon.exe  试图添加服务
又调用C:\WINDOWS\system32\runonce.exe
再次调出CMD TEMP下生成Delself.bat  删除源文件Finish.exe

dragonkf

Start of the scan: 2007年7月25日  09:08

Starting the file scan:

Begin scan in 'E:\测试\样本.rar'
E:\测试\样本.rar
  [0] Archive type: RAR
  --> Finish.exe
      [DETECTION] Is the Trojan horse TR/Theman.A
      [INFO]      The file was deleted!


End of the scan: 2007年7月25日  09:08
Used time: 00:05 min

dragonkf

AhnLab-V3 2007.7.25.0 2007.07.24 no virus found AntiVir 7.4.0.44 2007.07.24 TR/Theman.A Authentium 4.93.8 2007.07.24 no virus found Avast 4.7.997.0 2007.07.25 Win32:Trojan-gen. {Other} AVG 7.5.0.476 2007.07.24 SHeur.AXP BitDefender 7.2 2007.07.25 Trojan.Theman.A CAT-QuickHeal 9.00 2007.07.24 (Suspicious) - DNAScan ClamAV devel-20070416 2007.07.24 no virus found DrWeb 4.33 2007.07.25 Trojan.StartPage.20014 eSafe 7.0.15.0 2007.07.24 Win32.Trojan eTrust-Vet 31.1.5003 2007.07.24 no virus found Ewido 4.0 2007.07.24 Trojan.Agent FileAdvisor 1 2007.07.25 no virus found Fortinet 2.91.0.0 2007.07.24 no virus found F-Prot 4.3.2.48 2007.07.25 no virus found F-Secure 6.70.13030.0 2007.07.25 no virus found Ikarus T3.1.1.8 2007.07.24 Trojan.Theman.A Kaspersky 4.0.2.24 2007.07.25 no virus found McAfee 5081 2007.07.24 no virus found Microsoft 1.2704 2007.07.25 no virus found NOD32v2 2417 2007.07.24 no virus found Norman 5.80.02 2007.07.24 no virus found Panda 9.0.0.4 2007.07.24 Generic Trojan Sophos 4.19.0 2007.07.17 no virus found Sunbelt 2.2.907.0 2007.07.25 Trojan.Theman.A Symantec 10 2007.07.25 no virus found TheHacker 6.1.7.152 2007.07.23 no virus found VBA32 3.12.2.1 2007.07.24 no virus found VirusBuster 4.3.26:9 2007.07.24 no virus found Webwasher-Gateway 6.0.1 2007.07.25 Trojan.Theman.A

tracydk

最近AVG的表现不错啊

AVG和小红伞报

jbj19771023

熊猫卫士杀。

a3275

Kaspersky Internet Security 7.0

The requested URL http://bbs.kafan.cn/attachment.php?aid=104592 is infected with Backdoor.Win32.Delf.apx virus