这是毒吗？[MD5: 5DD0CB]

显示全部楼层 · 发表于 2007-7-25 17:33:41

RT
有HIPS的朋友帮忙试一下

显示全部楼层 · 发表于 2007-7-25 17:38:43

Antivirus Version Last Update Result AhnLab-V32007.7.25.02007.07.25no virus foundAntiVir7.4.0.442007.07.25TR/Crypt.NSPM.GenAuthentium4.93.82007.07.25Possibly a new variant of W32/PWStealer1!GenericAvast4.7.997.02007.07.25Win32:Agent-HGLAVG7.5.0.4762007.07.25Adware Generic2.HFRBitDefender7.22007.07.25Trojan.PWS.Agent.NDRCAT-QuickHeal9.002007.07.24(Suspicious) - DNAScanClamAV0.912007.07.25no virus foundDrWeb4.332007.07.25Trojan.Click.2085eSafe7.0.15.02007.07.24suspicious Trojan/WormeTrust-Vet31.1.50042007.07.25no virus foundEwido4.02007.07.24Adware.BaiduFileAdvisor12007.07.25no virus foundFortinet2.91.0.02007.07.25no virus foundF-Prot4.3.2.482007.07.25W32/PWStealer1!GenericF-Secure6.70.13030.02007.07.25Hupigon.gen66IkarusT3.1.1.82007.07.25Trojan-PWS.Win32.Agent.BUKaspersky4.0.2.242007.07.25no virus foundMcAfee50812007.07.24no virus foundMicrosoft1.27042007.07.25VirTool:Win32/Obfuscator.ANOD32v224182007.07.25a variant of Win32/Adware.Toolbar.BaiduNorman5.80.022007.07.24Hupigon.gen66Panda9.0.0.42007.07.24Suspicious fileSophos4.19.02007.07.17no virus foundSunbelt2.2.907.02007.07.25VIPRE.SuspiciousSymantec102007.07.25no virus foundTheHacker6.1.7.1522007.07.23no virus foundVBA323.12.2.12007.07.24no virus foundVirusBuster4.3.26:92007.07.24no virus foundWebwasher-Gateway6.0.12007.07.25Trojan.Crypt.NSPM.Gen

显示全部楼层 · 发表于 2007-7-25 17:40:37

扫描进行于：2007-7-25 17:40:25
日期： 25.7.2007 时间：17:40:26
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\Nerazzurri\桌面\kksi8s3.rar
C:\Documents and Settings\Nerazzurri\桌面\kksi8s3.rar >>RAR >>kksi8s3.exe - Win32/Adware.Toolbar.Baidu 应用程序的变种
已扫描的文件数目：2
已发现的病毒数目：1
活动的病毒数目：1
完成时间： 17:40:29 总扫描时间：3 秒 (00:00:03)

——————————————————
AVGAS也报了
都报的baidu.Toolbar

[ 本帖最后由 Kav6.0 于 2007-7-25 17:42 编辑 ]

显示全部楼层 · 发表于 2007-7-25 17:44:38

人家都说了要看动作……

显示全部楼层 · 发表于 2007-7-25 18:00:01

显示全部楼层 · 发表于 2007-7-25 19:50:54

费尔在线扫描说它是个间谍程序

显示全部楼层 · 发表于 2007-7-25 19:53:22

显示全部楼层 · 发表于 2007-7-25 19:55:40

动作
An attempt to send a message to a window has been detected.
Target Window: 0x40390
Image Name: Opera.exe

怎么会是鸽子

显示全部楼层 · 发表于 2007-7-25 19:55:39

sandbox的速度

显示全部楼层 · 发表于 2007-7-25 19:56:36

&#26679 : Not detected by Sandbox (Signature: Hupigon.gen66)

[ DetectionInfo ]
* Sandbox name: NO_MALWARE
* Signature name: Hupigon.gen66

[ General information ]
* Applications uses MSVBVM60.DLL (Visual Basic 6).
* Form uses id Form.
* Form uses id Timer.
* File length: 26636 bytes.
* MD5 hash: 5dd0cb1659745c3e78aaba6d697c646c.

[ Process/window information ]
* Creates a COM object with CLSID
{FCFB3D23-A0FA-1068-A738-08002B3371B5} : VBRuntime.
* Creates a COM object with CLSID
{E93AD7C1-C347-11D1-A3E2-00A0C90AEA82} : VBRuntime6.

(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information
source only.

[病毒样本] 这是毒吗？[MD5: 5DD0CB]

本帖子中包含更多资源

貌似鸽子一只

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源