[d5a2dd]网关截获的Downloader

flowerpig

微点报已知Downloader

File information

File Name :	qqchat_duote.exe
File Size :	614420 byte
File Type :	MS-DOS executable (EXE), OS/2 or MS Windows
MD5 :	d5a2dd8252307c5f4e91d86909eef868
SHA1 :	da39a3ee5e6b4b0d3255bfef95601890afd80709

Scanner results

Scanner results :	16% Scanner(4/25) found malware!
Scan time :	2007/07/31 13:07:50

A-Squared	3.0.0.123	2007.07.30	2007-07-30	Found nothing	6.596
AntiVir	7.4.0.54	6.39.0.200	2007-07-30	Found nothing	4.013
Arcavir	1.0.4	200707301637	2007-07-30	Found nothing	1.317
Avast	1.0.8	000762-4	2007-07-30	Found nothing	4.1
AVG	7.5.47.442	269.10.23/924	2007-07-28	Found nothing	2.314
BitDefender	7.60825.702781	7.14120	2007-07-31	Trojan.Downloader.Vb.AYE	7.746
CA (VET)	8.4.0.24	31.1.5018	2007-07-31	Found nothing	3.77
ClamAV	0.91.1	3828	2007-07-31	Found nothing	2.147
Dr.Web	4.33	2007.07.31	2007-07-31	Found nothing	5.332
Ewido	4.0.0.2	2007.07.30	2007-07-30	Found nothing	2.361
F-Prot	3.16.16	2007.07.30	2007-07-30	Found nothing	0.751
F-Secure	5.51.6100	2007.07.31.01	2007-07-31	Trojan-Downloader.Win32.VB.aye	0.448
Ikarus	T3.1.1.12	2007.07.30.69285	2007-07-30	Found nothing	1.851
Kaspersky	5.5.10	2007.07.31	2007-07-31	Trojan-Downloader.Win32.VB.aye	0.366
KingSoft	2007.6.20.249	2007.7.31	2007-07-31	Found nothing	0.979
McAfee	5.1.00	5086	2007-07-30	Found nothing	1.509
mks_vir	2.01	2007.07.30	2007-07-30	Found nothing	1.946
NOD32	2.70.7	2429	2007-07-30	probably a variant of Win32/Tr...	2.998
Norman	5.90.37	5.90	2007-07-30	Found nothing	8.915
Panda	9.00.00	2007.07.29	2007-07-29	Found nothing	4.929
Sophos	551740	551740	2007-07-31	Found nothing	2.629
Symantec	1.3.0.24	20070730.016	2007-07-30	Found nothing	0.285
Trend Micro	8.500-1001	4.625.00	2007-07-30	Found nothing	0.041
VBA32	3.12.2.2	20070730.1503	2007-07-30	Found nothing	0.772
VirusBuster	4.3.19:9	9.093.2/11.0	2007-07-30	Found nothing	1.275

NOTICE: It may be false positive by some scanners when they found a malware, so you should judge it by yourself.

544318625

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.DL.Win32.VB.aye   

MAC地址：00:0E:A6:38:EF:31

用户来源：互联网

软件版本：19.34.10

znwn20xs

已检测到: 木马程序 Trojan-Downloader.Win32.VB.aye        URL: http://bbs.kafan.cn/attachment.p ... //data.rar//vsf.rdu

gho

Kaspersky Internet Security 6.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=107327 is infected with Trojan-Downloader.Win32.VB.aye virus

king6808

AhnLab-V3 2007.7.31.1 2007.07.31 -
AntiVir 7.4.0.54 2007.07.30 -
Authentium 4.93.8 2007.07.30 -
Avast 4.7.997.0 2007.07.30 -
AVG 7.5.0.476 2007.07.30 -
BitDefender 7.2 2007.07.31 Trojan.Downloader.Vb.AYE
CAT-QuickHeal 9.00 2007.07.30 -
ClamAV 0.91 2007.07.31 -
DrWeb 4.33 2007.07.31 -
eSafe 7.0.15.0 2007.07.29 -
eTrust-Vet 31.1.5018 2007.07.31 -
Ewido 4.0 2007.07.30 -
FileAdvisor 1 2007.07.31 -
Fortinet 2.91.0.0 2007.07.31 -
F-Prot 4.3.2.48 2007.07.30 -
F-Secure 6.70.13030.0 2007.07.31 Trojan-Downloader.Win32.VB.aye
Ikarus T3.1.1.8 2007.07.31 -
Kaspersky 4.0.2.24 2007.07.31 Trojan-Downloader.Win32.VB.aye
McAfee 5086 2007.07.30 -
Microsoft 1.2704 2007.07.31 -
NOD32v2 2429 2007.07.30 probably a variant of Win32/TrojanDownloader.VB
Norman 5.80.02 2007.07.30 -
Panda 9.0.0.4 2007.07.31 -
Prevx1 V2 2007.07.31 -
Rising 19.34.11.00 2007.07.31 Trojan.DL.Win32.VB.aye
Sophos 4.19.0 2007.07.26 -
Sunbelt 2.2.907.0 2007.07.31 -
Symantec 10 2007.07.31 -
TheHacker 6.1.7.159 2007.07.31 -
VBA32 3.12.2.2 2007.07.30 -

dong820

symantec这么不争气，，我是不是该换掉它？？？

taihuxian

Virus: Trojan-Downloader.Win32.VB.aye

Virus found while downloading Web content.

Address: bbs.kafan.cn

微点卫士

微点:
木马名称:Trojan-Downloader.Win32.VB.dbh

程序:
C:\PROGRAM FILES\TEMP\VSF.RDU
是木马程序!
已成功阻止其运行,是否要删除此文件?

mingwang69

原帖由 dong820 于 2007-7-31 14:20 发表
symantec这么不争气，，我是不是该换掉它？？？

别换了吧，我喜欢symantec的流畅，大家都说nod32流畅，省资源，但很明显有感觉，解包的时候有exe，nod32查得很慢，symantec从来不会让我有这种感觉……而且有些病毒就算扫描不出来……到了监控也不一定会过……我装的是scs，现在又多放了个sns，感觉不错……

Silence

奇怪，mcafee检测不到？