一个毒网抓来的[MD5: E365CB]

zane_xzz

借花献佛，http://bbs.kafan.cn/viewthread.php?tid=112349&extra=page%3D1&page=1
这个帖子毒网的一个

The EQs

Scan performed at: 2007-7-27 17:24:07
Scanning Log
NOD32 version 2424 (20070726) NT
Command line: C:\Documents and Settings\EQ2\桌面\样本.rar
Operating memory - is OK

Date: 27.7.2007  Time: 17:24:13
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\样本.rar
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?1.exe - probably a variant of Win32/Genetik trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 17:24:13 Total scanning time: 0 sec (00:00:00)

xxwpk007

Kaspersky Internet Security 7.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=105741 is infected with Trojan-Downloader.Win32.Delf.bpb virus

snakebone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本.rar'
C:\Documents and Settings\Administrator\桌面\
  样本.rar
    [0] Archive type: RAR
    --> 1.exe
        [DETECTION] Contains suspicious code HEUR/Crypted
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      A backup was created as '46d8227c.qua'  ( QUARANTINE )
        [INFO]      The file was deleted!

yashoo

jimmyleo

D:\download\t3\1.rar:\1.exe - Signature 'Trojan-Downloader.Win32.Delf.ald' found
D:\download\t3\1.rar

        2 Files scanned
          (1 Archive with 1 file)
        1 Signature found
        0 Suspect code-parts found
        Used time: 0:06.239

微点卫士

金山挂,费尔启发报壳

微点:
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\SYSDOWN.VXD
是否删除木马程序及其衍生物?

1688388728

Kaspersky Internet Security 7.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=105741 is infected with Trojan-Downloader.Win32.Delf.bpb virus

eaco

江民挂

红心王子

C:\Documents and Settings\Administrator\桌面\样本
.rar>>1.exe>>nspack
Trojan.DL.Win32.Agent.xds