还算新的autorun，挂的不少[MD5: 8B26F6]

显示全部楼层 · 发表于 2007-7-30 23:13:12

nod32挂了...

显示全部楼层 · 发表于 2007-7-30 23:15:31

KIS7.0 已检测到: 病毒 Worm.Win32.AutoRun.k URL: http://bbs.kafan.cn/attachment.php?aid=107046//n.exe

显示全部楼层 · 发表于 2007-7-30 23:16:04

--> n.exe
[DETECTION] Contains signature of the worm WORM/AutoRun.K.1
[INFO] The file was deleted!

显示全部楼层 · 发表于 2007-7-30 23:16:59

File Name :	n.exe
File Size :	225604 byte
File Type :	MS-DOS executable (EXE), OS/2 or MS Windows
MD5 :	8b26f627316bfc99f297b3262de53182
SHA1 :	da39a3ee5e6b4b0d3255bfef95601890afd80709

AntiVir	7.4.0.50	6.39.0.199	2007-07-30	WORM/AutoRun.K.1	2.182
Kaspersky	5.5.10	2007.07.30	2007-07-30	Worm.Win32.AutoRun.k	0.096
F-Secure	5.51.6100	2007.07.30.05	2007-07-30	Worm.Win32.AutoRun.k	2.473
VBA32	3.12.2.1	20070730.0054	2007-07-30	Worm.Win32.AutoRun.k	0.882
A-Squared	3.0.0.123	2007.07.29	2007-07-29	Worm.Win32.AutoRun.k	4.203
KingSoft	2007.6.20.249	2007.7.31	2007-07-31	Worm.AutoRun.k.225604	0.794
Symantec	1.3.0.24	20070729.005	2007-07-29	W32.Imaut.AA	0.275
Ikarus	T3.1.1.12	2007.07.30.69282	2007-07-30	Trojan.Win32.Autoit.ao	2.58
ClamAV	0.91.1	3820	2007-07-30	Trojan.Autorun-19	0.091
BitDefender	7.60825.702609	7.14109	2007-07-30	Trojan.Autoit.AK	2.529
F-Prot	3.16.16	2007.07.30	2007-07-30	Found nothing	1.456
mks_vir	2.01	2007.07.29	2007-07-29	Found nothing	2.018
CA (VET)	8.4.0.24	31.1.5016	2007-07-30	Found nothing	0.859
Sophos	545451	545451	2007-07-30	Found nothing	2.736
Ewido	4.0.0.2	2007.07.28	2007-07-28	Found nothing	2.167
McAfee	5.1.00	5085	2007-07-27	Found nothing	1.454
Norman	5.90.37	5.90	2007-07-30	Found nothing	5.575
VirusBuster	4.3.19:9	9.093.1/11.0	2007-07-30	Found nothing	1.651
NOD32	2.70.7	2429	2007-07-30	Found nothing	1.735
Dr.Web	4.33	2007.07.30	2007-07-30	Found nothing	4.697
Arcavir	1.0.4	200707301201	2007-07-30	Found nothing	1.493
Trend Micro	8.500-1001	4.623.00	2007-07-29	Found nothing	0.083
Avast	1.0.8	000762-2	2007-07-30	Found nothing	3.041
AVG	7.5.47.442	269.10.23/924	2007-07-28	Found nothing	1.284
Panda	9.00.00	2007.07.29	2007-07-29	Found nothing	3.914

显示全部楼层 · 发表于 2007-7-30 23:29:36

F:\样本.rar:<RAR>\n.exe : infected Worm.Win32.AutoRun.k

显示全部楼层 · 发表于 2007-7-30 23:35:27

重出江湖测试.

显示全部楼层 · 发表于 2007-7-30 23:35:35

程序:
G:\样本\样本\N.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\SCVHOST.EXE
2) C:\WINDOWS\HINHEM.SCR
3) C:\WINDOWS\SCVHOST.EXE
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-7-30 23:39:18

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2005-10-5
Start time: 2007-7-30 23:38
Engine(s): KAV engine (AVK 16.818), BD-Engine (BD 16.864)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: n.exe
In archive: C:\Documents and Settings\Admin\桌面\样本.rar
Status: Virus detected
Virus: Worm.Win32.AutoRun.k (KAV engine), Trojan.Autoit.AK (BD-Engine)
Object: 样本.rar
Path: C:\Documents and Settings\Admin\桌面
Status: Move file into quarantine
Virus: Worm.Win32.AutoRun.k (KAV engine), Trojan.Autoit.AK (BD-Engine)
Analysis complete: 2007-7-30 23:38
1 files checked
1 infected files detected
0 suspected files detected

panda出08正式版的套装了，谁去试试啊，看看牛不牛

显示全部楼层 · 发表于 2007-7-30 23:50:42

有key没有
有就去试

[病毒样本] 还算新的autorun，挂的不少[MD5: 8B26F6]

本帖子中包含更多资源

本帖子中包含更多资源