【MD5】059725

显示全部楼层 · 发表于 2007-7-28 22:28:13

一个藏在c:\windows\system32\drivers\scvhost.exe的病毒。

[ 本帖最后由 promised 于 2007-7-28 23:01 编辑 ]

显示全部楼层 · 发表于 2007-7-28 22:28:37

反病毒引擎版本最后更新扫描结果
AhnLab-V3 2007.7.28.0 2007.07.27 Win-Trojan/ArpCheat.11081
AntiVir 7.4.0.50 2007.07.28 TR/Drop.Spy.Pca.A.1
Authentium 4.93.8 2007.07.27 Possibly a new variant of W32/new-malware!Maximus
Avast 4.7.997.0 2007.07.27 Win32:Delf-DXA
AVG 7.5.0.476 2007.07.27 Generic4.IA
BitDefender 7.2 2007.07.28 Trojan.Spy.Pcapbased.A
CAT-QuickHeal 9.00 2007.07.28 Backdoor.Delf.awy
ClamAV 0.91 2007.07.28 Trojan.Delf-811
DrWeb 4.33 2007.07.28 Trojan.Sniff
eSafe 7.0.15.0 2007.07.24 Win32.Delf.awy
eTrust-Vet 31.1.5010 2007.07.28 Win32/Posertm
Ewido 4.0 2007.07.28 Logger.Pcap.a
FileAdvisor 1 2007.07.28 High threat detected
Fortinet 2.91.0.0 2007.07.28 W32/Delf.AWY!tr.bdr
F-Prot 4.3.2.48 2007.07.27 W32/Backdoor.BGBT
F-Secure 6.70.13030.0 2007.07.27 Backdoor.Win32.Delf.awy
Ikarus T3.1.1.8 2007.07.28 Backdoor.Win32.Delf.awy
Kaspersky 4.0.2.24 2007.07.28 Backdoor.Win32.Delf.awy
McAfee 5085 2007.07.27 Generic BackDoor
Microsoft 1.2704 2007.07.28 Backdoor:Win32/Delf!267C
NOD32v2 2426 2007.07.27 Win32/Delf.AWY
Norman 5.80.02 2007.07.27 W32/Delf.dam
Panda 9.0.0.4 2007.07.28 HackTool/ArpSpoof
Rising 19.33.52.00 2007.07.28 Trojan.Spy.Agent.dcq
Sophos 4.19.0 2007.07.26 Mal/HckPk-C
Sunbelt 2.2.907.0 2007.07.28 Backdoor.Win32.Delf.awy
Symantec 10 2007.07.28 Hacktool.Spoofer
TheHacker 6.1.7.155 2007.07.28 Backdoor/Delf.awy
VBA32 3.12.2.1 2007.07.27 Backdoor.Win32.Delf.awy
VirusBuster 4.3.26:9 2007.07.27 -
Webwasher-Gateway 6.0.1 2007.07.28 Trojan.Drop.Spy.Pca.A.1

显示全部楼层 · 发表于 2007-7-28 22:29:45

附加信息
File size: 11081 bytes
MD5: 059725b53772a916f11e27517edb6bf0
SHA1: 819423fbc56aec2c1f3663320f0d7a42cb9a6599
packers: FSG
Bit9 info: http://fileadvisor.bit9.com/serv ... 916f11e27517edb6bf0

显示全部楼层 · 发表于 2007-7-28 22:30:14

Begin scan in 'C:\Documents and Settings\Administrator\桌面\scvhost.rar'
C:\Documents and Settings\Administrator\桌面\scvhost.rar
  [0] Archive type: RAR
  --> scvhost.exe
   [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.1
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-7-28 22:30:33

nod

Scan performed at: 2007-7-28 22:29:41
Scanning Log
NOD32 version 2426 (20070727) NT
Command line: C:\Documents and Settings\Kevin\Desktop\病毒样本\scvhost.rar

Date: 28.7.2007  Time: 22:29:44
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Kevin\Desktop\病毒样本\scvhost.rar
C:\Documents and Settings\Kevin\Desktop\病毒样本\scvhost.rar ?RAR ?scvhost.exe - Win32/Delf.AWY trojan
Number of scanned files: 1
Number of threats found: 1
Time of completion: 22:29:44 Total scanning time: 0 sec (00:00:00)
_________
avira

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Kevin\Desktop\病毒样本\scvhost.rar'
C:\Documents and Settings\Kevin\Desktop\病毒样本\scvhost.rar
  [0] Archive type: RAR
  --> scvhost.exe
   [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.1
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-7-28 22:31:38

微点:
木马名称:Backdoor.Win32.Delf.bgs

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SCVHOST.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2007-7-28 22:33:27

KIS7.0 已检测到: 木马程序 Backdoor.Win32.Delf.awy 文件: C:\Documents and Settings\Administrator\桌面\scvhost.rar/scvhost.exe

显示全部楼层 · 发表于 2007-7-28 22:35:28

Begin scan in 'D:\scvhost.rar'
D:\scvhost.rar
  [0] Archive type: RAR
  --> scvhost.exe
   [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.1
   [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-7-28 22:35:44

显示全部楼层 · 发表于 2007-7-28 22:36:33

晕
这都通杀的东西··

[病毒样本] 【MD5】059725

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源