一个样本 间接看出卡巴中国是是什么效率了……C8356F

yyg747

昨天有个exe在system32文件夹下突然访问网络，名称为my-70130.exe  极为可疑， 阻止后，上报卡巴中国
收到回信如下


您好！
    我们已经收到了您的邮件,正在分析处理中.谢谢您对卡巴斯基公司的支持.


                                      致
礼！


                            virus@kaspersky.com.cn

等到今天中午还是没有答复……

没辙，又上报卡巴总部，15分钟后收到回信，如下

Hello,

my_70130.exe - Trojan-Downloader.Win32.Small.evq

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Dmitry Shvetsov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.


看别人的效率，心寒啊

[ 本帖最后由 promised 于 2007-7-29 13:14 编辑 ]

Cloud018

中国的还要送给总部的，那要乘船、坐飞机、坐火车...开玩笑...

qqq000@qq.com

这是自动回复

mofunzone

File:	my_70130.rar
Status:	INFECTED/MALWARE
MD5:	1e40b9045980c48da86bbb14d613cc9b
Packers detected:	-
Bit9 reports:	File not found
Scanner results
Scan taken on 29 Jul 2007 05:13:53 (GMT)
A-Squared	Found nothing
AntiVir	Found HEUR/Malware
ArcaVir	Found nothing
Avast	Found nothing
AVG Antivirus	Found Downloader.Generic5.JOG
BitDefender	Found nothing
ClamAV	Found nothing
CPsecure	Found nothing
Dr.Web	Found Trojan.DownLoader.26006
F-Prot Antivirus	Found nothing
F-Secure Anti-Virus	Found nothing
Fortinet	Found nothing
Kaspersky Anti-Virus	Found nothing
NOD32	Found a variant of Win32/TrojanDownloader.QQHelper.NDD
Norman Virus Control	Found nothing
Panda Antivirus	Found nothing
Rising Antivirus	Found nothing
Sophos Antivirus	Found Mal/Behav-125
VirusBuster	Found nothing
VBA32	Found nothing

promised

江苏老客户

yyg747

不好意思啊   很久没发过样本~~忘了MD5 了   

微点卫士

金山 费尔都挂了

微点:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MY_70130.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:2559
远端地址:58.211.7.36(江苏·苏州)
没可疑动作的么
远端端口:80

rasis

my_70130.rar
  [0] Archive type: RAR
  --> my_70130.exe
      [DETECTION] Contains suspicious code HEUR/Malware

jimmyleo

苏州老客户似乎没有把antivir放在眼里啊~

jxxfcwb

Begin scan in 'D:\my_70130.rar'
D:\my_70130.rar
  [0] Archive type: RAR
  --> my_70130.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!