看看卡7启发不27E22E

promised

woai_jolin

ca pass

wangjay1980

bu

Hello.
New malicious software was found in the attached file. not-a-virus:AdWare.Win32.Agent.bs
It's detection will be included in the next update. Thank you for your help.

Please quote all when answering. Do not forget to include you registration data.
-----------------
Regards, Maslennikov Denis
Virus Analyst, Kaspersky Lab.

Ph.: +7(495) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com


> Attachment: sc.zip

[ 本帖最后由 wangjay1980 于 2007-8-28 10:58 编辑 ]

FBAV

为PC护航风暴微塔
_____________________________________________
                                          
             风暴微塔反间谋
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]              
                            [内测版]      
                   http://www.v0day.com/  
----------------------------------------------
开始扫描……


正在检查启动……
[C:\Documents and Settings\Administrator\桌面\virus\sc\sc.exe]
                    …………引擎[3]发现Suspicious File
文件数:1   病毒数:1  比重:1
OK  扫描完毕！

tracydk

Starting the file scan:

Begin scan in 'F:\病毒样本\sc.zip'
F:\病毒样本\sc.zip
  [0] Archive type: ZIP
  --> sc.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was deleted!

wangjay1980

卡7的启发现在有个BUG，就是对某些修改的UPX扫不过去

wangjay1980

引擎[3]发现Suspicious File


再努力就可以IK二代了

风野胤

按名称说Panda二代比较合适

FBAV

我晕……

微点卫士

微点：
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SC.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:1829
远端地址:60.191.254.73(浙江·金华)
远端端口:80
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SC.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TEMPORARY INTERNET FILES\CONTENT.IE5\IL83EFWJ\WXPSETUP204[1].TXT
2) C:\DWNSETUP\WXPSETUP204.EXE
3) C:\DWNSETUP\WEBHELP.EXE
4) C:\WINDOWS.0\SYSTEM32\WEBHELP.EXE
5) C:\WINDOWS.0\SYSTEM32\WEBSHOW.DLL
6) C:\WINDOWS.0\SYSTEM32\DRIVERS\WEBSHOW.DRV
7) C:\WINDOWS.0\SYSTEM32\DRIVERS\WEBHELP.DRV
8) C:\DWNSETUP\WEBSHOW.DLL
是否删除木马程序及其衍生物?