再发几个病毒[MD5: 42CCE5 71B0E8 9B16F0]

gzg

大家一起来测测

[ 本帖最后由 promised 于 2007-7-30 20:56 编辑 ]

欠妳緈諨

AVAST1只

红心王子

那个sd.exe好像是死的

KV的监控都做出了提示，建议操作不运行，属于危险程序

quansen83

费尔木马一只

1688388728

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\9ZJO5KCR\classB[1].part1.rar\classA.exe - infected with BackDoor.Pigeon.origin

Archive contains an infected item

xxwpk007

程序:
G:\样本\样本\CLASSB[1]\CLASSA.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\SILLENT
是否删除木马程序及其衍生物?

程序:
G:\样本\样本\CLASSB[1]\SD.EXE
木马程序生成以下文件:
1) C:\WINDOWS\G_TELEPHON.EXE
是否删除木马程序及其衍生物?

[ 本帖最后由 xxwpk007 于 2007-7-30 21:37 编辑 ]

微点卫士

微点:
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\CLASSA.EXE
可疑程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\SILLENT
2) C:\WINDOWS.0\DELETE.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\CLASSA.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\SILLENT
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\CLASSA.EXE
木马程序生成以下文件:
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\CLASSA.EXE
可疑程序生成以下文件:
1) C:\WINDOWS.0\DELETE.BAT
是否删除可疑程序?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SD.EXE
可疑程序生成以下文件:
1) C:\WINDOWS.0\G_TELEPHON.EXE
2) C:\WINDOWS.0\DELETE.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SD.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\G_TELEPHON.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SD.EXE
可疑程序生成以下文件:
1) C:\WINDOWS.0\DELETE.BAT
是否删除可疑程序?
classB,有衍生物,微点不拦截,上报

taihuxian

Virus: Win32:Delf-EDY [Trj]

Virus found while downloading Web content.

Address: bbs.kafan.cn

浪滔天

卡巴 7.0.0.125 启发报两个病毒变种

mofunzone

File:	classA.exe
Status:	INFECTED/MALWARE
MD5:	71b0e8298ee72a75370d88621bd8b177
Packers detected:	PE-ARMOR, PE_PATCH.MASKPE
Bit9 reports:	File not found
Scanner results
Scan taken on 30 Jul 2007 14:32:41 (GMT)
A-Squared	Found nothing
AntiVir	Found nothing
ArcaVir	Found nothing
Avast	Found Win32:Delf-EDY
AVG Antivirus	Found nothing
BitDefender	Found GenPack:Generic.Graybird.64960AAD
ClamAV	Found Trojan.Gadgo.20
CPsecure	Found BackDoor.W32.Hupigon.qs
Dr.Web	Found nothing
F-Prot Antivirus	Found nothing
F-Secure Anti-Virus	Found nothing
Fortinet	Found nothing
Kaspersky Anti-Virus	Found nothing
NOD32	Found nothing
Norman Virus Control	Found nothing
Panda Antivirus	Found nothing
Rising Antivirus	Found nothing
Sophos Antivirus	Found Mal/Packer
VirusBuster	Found nothing
VBA32	Found Trojan-Spy.Banker.68 (probable variant)

File:	classB.exe
Status:	INFECTED/MALWARE
MD5:	9b16f05bc7fe345ea92d528da7fcc444
Packers detected:	-
Bit9 reports:	File not found
Scanner results
Scan taken on 30 Jul 2007 14:35:19 (GMT)
A-Squared	Found nothing
AntiVir	Found nothing
ArcaVir	Found nothing
Avast	Found nothing
AVG Antivirus	Found nothing
BitDefender	Found nothing
ClamAV	Found nothing
CPsecure	Found nothing
Dr.Web	Found nothing
F-Prot Antivirus	Found W32/Trojan.ANKW
F-Secure Anti-Virus	Found nothing
Fortinet	Found nothing
Kaspersky Anti-Virus	Found nothing
NOD32	Found nothing
Norman Virus Control	Found Sandbox: W32/Malware; [ General information ] * Attempts to run Visual Basic Script (VBS). * File length: 102886 bytes. [ Changes to filesystem ] * Creates directory C:. * Creates directory C:\WINDOWS. * Creates directory C:\WINDOWS\TEMP. * Creates directory C:\WINDOWS\TEMP\RarSFX0. * Creates file C:\WINDOWS\TEMP\RarSFX0\__tmp_rar_sfx_access_check_74988. * Deletes file __tmp_rar_sfx_access_check_74988. * Creates file C:\WINDOWS\TEMP\RarSFX0\reg.vbs. * Creates file C:\WINDOWS\TEMP\RarSFX0\class.bat. [ Changes to registry ] * Creates key "HKCU\Software\WinRAR SFX". * Sets value "C%%WINDOWS"="C:\WINDOWS\TEMP\RarSFX0" in key "HKCU\Software\WinRAR SFX". [ Process/window information ] * Attemps to NULL C:\WINDOWS\TEMP\RarSFX0\reg.vbs NULL.
Panda Antivirus	Found nothing
Rising Antivirus	Found nothing
Sophos Antivirus	Found nothing
VirusBuster	Found nothing
VBA32	Found nothing

File:	sd.exe
Status:	INFECTED/MALWARE
MD5:	42cce52dfc9bd9da4d0d6626064398c6
Packers detected:	-
Bit9 reports:	File not found
Scanner results
Scan taken on 30 Jul 2007 14:38:15 (GMT)
A-Squared	Found nothing
AntiVir	Found nothing
ArcaVir	Found nothing
Avast	Found nothing
AVG Antivirus	Found Klone
BitDefender	Found GenPack:Generic.Graybird.1E83200C
ClamAV	Found nothing
CPsecure	Found nothing
Dr.Web	Found BackDoor.Pigeon.5314
F-Prot Antivirus	Found Possibly a new variant of W32/Trojan-Hupigon-based!Maximus
F-Secure Anti-Virus	Found nothing
Fortinet	Found nothing
Kaspersky Anti-Virus	Found nothing
NOD32	Found nothing
Norman Virus Control	Found W32/Hupigon.gen52
Panda Antivirus	Found nothing
Rising Antivirus	Found nothing
Sophos Antivirus	Found nothing
VirusBuster	Found nothing
VBA32	Found Trojan-Spy.Banker.68 (probable variant)