先抓个明显的vip[828D9E]

promised

vip.........
没花头

scottxzt

tonger2003

Kaspersky Anti-Virus 7.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=107866 is infected with Backdoor.Win32.Agent.ahj virus

rxy80

现原形了

Nerazzurri

nod

扫描进行于：2007-8-1 15:47:59
扫描日志
NOD32版本 2430 (20070731) NT
命令行： C:\Documents and Settings\D&G\桌面\病毒样本\vip.zip

日期： 1.8.2007  时间：15:48:03
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\D&G\桌面\病毒样本\vip.zip
C:\Documents and Settings\D&G\桌面\病毒样本\vip.zip >>ZIP >>vip.exe - 可能是 Win32/Agent.NEO 木马 的一个变种
已扫描的文件数目：1
已发现的病毒数目：1
完成时间： 15:48:03 总扫描时间：0 秒 (00:00:00)
__________
avira

Starting the file scan:

Begin scan in 'C:\Documents and Settings\D&G\桌面\病毒样本\vip.zip'
C:\Documents and Settings\D&G\桌面\病毒样本\vip.zip
  [0] Archive type: ZIP
  --> vip.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [INFO]      The file was deleted!

lsyer

--> vip.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [INFO]      The file was deleted!

sbbdms

江民不杀

zongkai

咖啡启发了,New Malware.dm

jingyanglf

Dr.web

C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2HGP9I62\vip[1].zip\vip.exe - infected with Trojan.Popwin.613

Archive contains an infected item

king6808

AhnLab-V3 2007.7.31.1 2007.08.01 -
AntiVir 7.4.0.54 2007.08.01 TR/Crypt.NSPM.Gen
Authentium 4.93.8 2007.07.31 -
Avast 4.7.1029.0 2007.07.31 Win32:Agent-JOF
AVG 7.5.0.476 2007.07.31 Agent.EIL
BitDefender 7.2 2007.08.01 GenPack:Generic.Popwin.64F2BF18
CAT-QuickHeal 9.00 2007.07.31 (Suspicious) - DNAScan
ClamAV 0.91 2007.08.01 -
DrWeb 4.33 2007.08.01 Trojan.Popwin.613
eSafe 7.0.15.0 2007.07.31 suspicious Trojan/Worm
eTrust-Vet 31.1.5022 2007.08.01 -
Ewido 4.0 2007.07.31 -
FileAdvisor 1 2007.08.01 -
Fortinet 2.91.0.0 2007.08.01 -
F-Prot 4.3.2.48 2007.07.31 -
F-Secure 6.70.13030.0 2007.08.01 Backdoor.Win32.Agent.ahj
Ikarus T3.1.1.8 2007.08.01 Trojan-PWS.Win32.Agent.BU
Kaspersky 4.0.2.24 2007.08.01 Backdoor.Win32.Agent.ahj
McAfee 5087 2007.07.31 W32/Winko.worm.gen
Microsoft 1.2704 2007.08.01 Backdoor:Win32/Popwin.gen!A
NOD32v2 2430 2007.07.31 probably a variant of Win32/Agent.NEO
Norman 5.80.02 2007.07.31 Hupigon.gen66
Panda 9.0.0.4 2007.08.01 Suspicious file
Prevx1 V2 2007.08.01 -
Rising 19.34.21.00 2007.08.01 Trojan.IMMSG.Win32.TBMSG.je
Sophos 4.19.0 2007.08.01 Mal/EncPk-AI
Sunbelt 2.2.907.0 2007.07.31 VIPRE.Suspicious
Symantec 10 2007.08.01 Trojan.Popwin
TheHacker 6.1.7.160 2007.08.01 Backdoor/Agent.ahj
VBA32 3.12.2.2 2007.07.31 suspected of Trojan-PSW.Game.63 (paranoid heuristics)
VirusBuster 4.3.26:9 2007.07.31 -
Webwasher-Gateway 6.0.1 2007.08.01 Trojan.Crypt.NSPM.Gen