3个江苏下载者变种[7D7308 FC6C62 EB7BDE]

promised

bjfhj

没有样本？？？？？？？

jimmyleo

Begin scan in 'D:\Download\T3\virus1\2.exe'
D:\Download\T3\virus1\2.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '471038b3.qua'!
Begin scan in 'D:\Download\T3\virus1\70145.exe'
D:\Download\T3\virus1\70145.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '46dc38b5.qua'!
Begin scan in 'D:\Download\T3\virus1\70200.exe'
D:\Download\T3\virus1\70200.exe
      [DETECTION] Contains suspicious code HEUR/Malware

微点卫士

金山挂,费尔挂!!!

微点:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\2.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:3170
远端地址:58.211.7.59(江苏·苏州)
远端端口:80
2.EXE运行即退出,除了要联网没什么动作饿

C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\70145.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:3266
远端地址:58.211.7.59(江苏·苏州)
远端端口:80
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\70200.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:3280
远端地址:58.211.7.59(江苏·苏州)
远端端口:80.
怎么都是运行即退出饿

xxwpk007

卡巴 pass

红心王子

不杀

BD报的非常之BT，深度扫描报了出来，ikarus这次挂了

FS再次发威表现不错，卡巴失守，最近样本区测试，

个人感觉卡巴的表现和FS比起来逊色了很多

AhnLab-V3	2007.7.28.0	2007.07.27	-
AntiVir	7.4.0.50	2007.07.27	HEUR/Malware
Authentium	4.93.8	2007.07.27	W32/Downloader.gen14 - Packed
Avast	4.7.997.0	2007.07.27	Win32:Small-GVU
AVG	7.5.0.476	2007.07.27	Downloader.Generic5.IAR
BitDefender	7.2	2007.07.28	DeepScan:Generic.Malware.dld!!.54647CCE
CAT-QuickHeal	9.00	2007.07.28	-
ClamAV	0.91	2007.07.28	-
DrWeb	4.33	2007.07.28	-
eSafe	7.0.15.0	2007.07.24	suspicious Trojan/Worm
eTrust-Vet	31.1.5010	2007.07.28	-
Ewido	4.0	2007.07.28	-
FileAdvisor	1	2007.07.28	-
Fortinet	2.91.0.0	2007.07.28	-
F-Prot	4.3.2.48	2007.07.27	W32/Downloader.gen14
F-Secure	6.70.13030.0	2007.07.27	W32/Downloader
Ikarus	T3.1.1.8	2007.07.28	-
Kaspersky	4.0.2.24	2007.07.28	-
McAfee	5085	2007.07.27	-
Microsoft	1.2704	2007.07.28	-
NOD32v2	2426	2007.07.27	probably a variant of Win32/TrojanDownloader.QQHelper.NDD
Norman	5.80.02	2007.07.27	W32/Downloader
Panda	9.0.0.4	2007.07.28	Suspicious file
Rising	19.33.52.00	2007.07.28	-
Sophos	4.19.0	2007.07.26	Mal/Behav-125
Sunbelt	2.2.907.0	2007.07.28	-
Symantec	10	2007.07.28	-
TheHacker	6.1.7.155	2007.07.28	-
VBA32	3.12.2.1	2007.07.27	-
VirusBuster	4.3.26:9	2007.07.27	-
Webwasher-Gateway	6.0.1	2007.07.28	Heuristic.Malware

jimmyleo

D:\download\t3\virus1\2.exe
D:\download\t3\virus1\70200.exe
D:\download\t3\virus1\70145.exe

        3 Files scanned
          (0 Archives with 0 files)
        0 Signatures found
        0 Suspect code-parts found
        Used time: 0:00.200

ik是解包失败—……

[ 本帖最后由 jimmyleo 于 2007-7-28 20:49 编辑 ]

woai_jolin

fscs pass

hj5abc

Scanned disks, folders and files: F:\virus1\
F:\virus1\70145.exe - probably a variant of Win32/TrojanDownloader.QQHelper.NDD trojan

红心王子

原帖由 woai_jolin 于 2007-7-28 20:51 发表
fscs pass

怎么VT上的FS报了[:26:]