大家给看一下[D2A54A]

绅博周幸

a-squared	3.0.0.123	2007.07.27	2007-07-27	没有检测到病毒	3.812
Arcavir	1.0.4	200707292159	2007-07-29	没有检测到病毒	1.162
AVAST	1.0.8	000762-1	2007-07-30	Win32:Hupigon-ACA	3.057
AVG	7.5.47.442	269.10.23/924	2007-07-28	没有检测到病毒	1.248
BitDefender	7.60825.702582	7.14106	2007-07-30	没有检测到病毒	3.473
CA (VET)	8.4.0.24	31.1.5016	2007-07-30	没有检测到病毒	0.837
ClamAV	0.91.1	3819	2007-07-30	没有检测到病毒	0.071
ewido	4.0.0.2	2007.07.28	2007-07-28	没有检测到病毒	2.099
F-SECURE	5.51.6100	2007.07.30.02	2007-07-30	Trojan-PSW.Win32.QQPass.vl	2.345
IKARUS	T3.1.1.12	2007.07.30.69282	2007-07-30	Backdoor.Win32.IRCBot.CT	1.297
MKS_VIR	2.01	2007.07.29	2007-07-29	没有检测到病毒	2.102
NOD32	2.70.7	2428	2007-07-30	probably unknown NewHeur_PE vi...	9.956
SOPHOS	544064	544064	2007-07-30	没有检测到病毒	2.576
VBA32	3.12.2.1	20070730.0054	2007-07-30	没有检测到病毒	1.099
VirusBuster	4.3.19:9	9.092.4/11.0	2007-07-30	没有检测到病毒	0.904
冰岛杀毒	3.16.16	2007.07.27	2007-07-27	没有检测到病毒	0.776
卡巴斯基	5.5.10	2007.07.30	2007-07-30	Trojan-PSW.Win32.QQPass.vl	0.061
大蜘蛛	4.33	2007.07.30	2007-07-30	Trojan.PWS.Qqpass.258	5.653
小红伞	7.4.0.50	6.39.0.197	2007-07-30	HEUR/Malware	2.245
熊猫卫士	9.00.00	2007.07.29	2007-07-29	Suspicious file	3.938
诺曼	5.90.37	5.90	2007-07-27	没有检测到病毒	9.583
赛门铁克	1.3.0.24	20070729.005	2007-07-29	Infostealer	0.415
趋势	8.500-1001	4.623.00	2007-07-29	没有检测到病毒	0.138
迈克菲	5.1.00	5085	2007-07-27	没有检测到病毒	4.05
金山毒霸	2007.6.20.249	2007.7.30	2007-07-30	没有检测到病毒

[ 本帖最后由 promised 于 2007-7-30 17:29 编辑 ]

sbbdms

江民没检测到

qwerasdf123

Analysis Summary:

Analysis Date 7/30/2007 5:02:32 AM
Sandbox Version 2.0.6
Filename d2a54a13d43450d814936c203fc7f384.exe

Technical Details:

Analysis Number 1
Parent ID 0
Process ID 580
Filename c:\temp\d2a54a13d43450d814936c203fc7f384.exe
Filesize 200185 bytes
MD5 d2a54a13d43450d814936c203fc7f384
Start Reason AnalysisTarget
Termination Reason Timeout
Start Time 00:00.125
Stop Time 01:00.609
Detection (Authentium Command Antivirus)
(BitDefender Antivirus)
(CounterSpy)
(Microsoft Malware Protection)
Virus (Norton AntiVirus)

DLL-Handling Loaded DLLs
C:\WINDOWS\System32\ntdll.dll
\ C:\WINDOWS\system32\kernel32.dll
\ C:\WINDOWS\system32\USER32.DLL
\ C:\WINDOWS\system32\GDI32.dll
\ C:\WINDOWS\system32\ADVAPI32.dll
\ C:\WINDOWS\system32\RPCRT4.dll
\ C:\WINDOWS\system32\SHELL32.DLL
\ C:\WINDOWS\system32\msvcrt.dll
\ C:\WINDOWS\system32\SHLWAPI.dll
\ C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1612_x-ww_7c379b08\
\ C:\WINDOWS\system32\comctl32.dll
\ C:\WINDOWS\system32\oleaut32.dll
\ C:\WINDOWS\system32\OLE32.DLL
\ C:\WINDOWS\System32\wsock32.dll
\ C:\WINDOWS\System32\WS2_32.dll
\ C:\WINDOWS\System32\WS2HELP.dll
\ C:\WINDOWS\System32\pstorec.dll
\ C:\WINDOWS\System32\ATL.DLL
\ C:\WINDOWS\System32\Wship6.dll
\ C:\WINDOWS\System32\iphlpapi.dll
\ C:\WINDOWS\System32\Secur32.dll
\ USER32.DLL
\ ADVAPI32.DLL
\ .\UxTheme.dll
\  

Filesystem New Files
C:\WINDOWS\System32\SVKP.sys

Opened Files
\\.\SVKP

Chronological order
Create File: C:\WINDOWS\System32\SVKP.sys
Open File: \\.\SVKP (OPEN_EXISTING)


Service Management Open Service Manager - Name: "SCM"

System Info Get System Directory
Get System Time

Window Enum Windows


Analysis Number 2
Parent ID 0
Process ID 712
Filename  
Filesize -1 bytes
MD5  
Start Reason SCM
Termination Reason Unknown
Start Time 00:02.812
Stop Time 00:00.000

qwerasdf123

貌似运行以后自己挂了

king6808

-V3 2007.7.28.0 2007.07.30 -
AntiVir 7.4.0.50 2007.07.30 HEUR/Malware
Authentium 4.93.8 2007.07.27 -
Avast 4.7.997.0 2007.07.30 Win32:Hupigon-ACA
AVG 7.5.0.476 2007.07.30 -
BitDefender 7.2 2007.07.30 -
CAT-QuickHeal 9.00 2007.07.28 (Suspicious) - DNAScan
ClamAV 0.91 2007.07.30 -
DrWeb 4.33 2007.07.30 Trojan.PWS.Qqpass.258
eSafe 7.0.15.0 2007.07.29 Suspicious Trojan/Worm
eTrust-Vet 31.1.5016 2007.07.30 -
Ewido 4.0 2007.07.29 -
FileAdvisor 1 2007.07.30 -
Fortinet 2.91.0.0 2007.07.30 -
F-Prot 4.3.2.48 2007.07.27 -
F-Secure 6.70.13030.0 2007.07.30 Trojan-PSW.Win32.QQPass.vl
Ikarus T3.1.1.8 2007.07.30 Backdoor.Win32.IRCBot.CT
Kaspersky 4.0.2.24 2007.07.30 Trojan-PSW.Win32.QQPass.vl
McAfee 5085 2007.07.27 -
Microsoft 1.2704 2007.07.30 -
NOD32v2 2428 2007.07.30 probably unknown NewHeur_PE virus
Norman 5.80.02 2007.07.27 -
Panda 9.0.0.4 2007.07.29 Suspicious file
Rising 19.34.01.00 2007.07.30 Trojan.PSW.QQPass.qot
Prevx1 V2 2007.07.30 -
Sophos 4.19.0 2007.07.26 -
Sunbelt 2.2.907.0 2007.07.28 VIPRE.Suspicious
Symantec 10 2007.07.30 Infostealer
TheHacker 6.1.7.158 2007.07.30 -
VBA32 3.12.2.1 2007.07.30 -
VirusBuster 4.3.26:9 2007.07.29 -
Webwasher-Gateway 6.0.1 2007.07.30 Heuristic.Malware

woai_jolin

微点卫士

运行起来好卡哦,我的微点挂了
在SYSTEM32下生成一个SYS,微点没有拦截,上报

tracydk

lsyer

--> AVK2004Æƽⲹ¶¡.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!

雨伞一次又一次伤害我~

gho

Kaspersky Internet Security 6.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=106925 is infected with Trojan-PSW.Win32.QQPass.vl virus