下载者过卡巴主动防御，[b454932d9]

绅博周幸

介绍上是这么说的，具体大家试验一下吧

a-squared	3.0.0.123	2007.09.06	2007-09-06	-	3.971
Arcavir	1.0.4	200709061952	2007-09-06	-	1.305
AVAST	1.0.8	000773-1	2007-09-06	-	3.228
AVG	7.5.48.442	269.13.7/992	2007-09-06	Downloader.Generic6.BSL	1.674
BitDefender	7.60825.864706	7.14649	2007-09-07	BehavesLike:Trojan.Downloader (suspected)	5.341
CA (VET)	8.4.0.24	31.1.5116	2007-09-07	-	2.352
ClamAV	0.91.1	4173	2007-09-07	-	0.033
Comodo	2.11	2.0.0.276	2007-09-06	-	1.132
ewido	4.0.0.2	2007.09.06	2007-09-06	-	2.830
F-SECURE	5.51.6100	2007.09.07.01	2007-09-07	-	0.041
IKARUS	T3.1.1.12	2007.09.06.69461	2007-09-06	Trojan-Downloader.Win32.Small.dbv	1.429
MKS_VIR	2.01	2007.09.06	2007-09-06	-	2.956
NOD32	2.70.8	2511	2007-09-07	probably unknown NewHeur_PE virus	0.077
nProtect	2007-09-07.00	909334	2007-09-07	BehavesLike:Trojan.Downloader	17.182
QuickHeal	9.00	2007.09.06	2007-09-06	-	4.746
SOPHOS	2.49.1	4.21	2007-09-07	Mal/Heuri-E	2.595
The Hacker	6.1.9	v00180	2007-09-06	-	0.700
VBA32	3.12.2.4	20070906.0441	2007-09-06	Win32.Trojan.Downloader (http://...) (suspicious)	0.761
VirusBuster	4.3.19:9	9.102.1/11.0	2007-09-06	-	0.963
冰岛杀毒	3.16.16	2007.09.07	2007-09-07	W32/NewMalware-LSU-based!Maximus	0.431
卡巴斯基	5.5.10	2007.09.07	2007-09-07	-	0.050
大蜘蛛	4.33	2007.09.07	2007-09-07	DLOADER.Trojan	6.983
小红伞	7.6.0.5	6.39.1.100	2007-09-06	TR/Delphi.Downloader.Gen	2.619
江民杀毒	10.00.650	2007.09.06	2007-09-06	-	0.821
熊猫卫士	9.04.03.0001	2007.09.06	2007-09-06	-	4.390
瑞星	19.0	19.39.40.00	2007-09-06	-	7.433
诺曼	5.91.07	5.90	2007-09-06	W32/Downloader.BPF	4.628
赛门铁克	1.3.0.24	20070906.009	2007-09-06	-	2.166
趋势	8.500-1001	4.699.00	2007-09-06	-	0.037
迈克菲	5.2.00	5114	2007-09-06	-	1.020
金山毒霸	2007.6.20.249	2007.9.7	2007-09-07	-	1.192

Nblock

运行即退出 试图修改无害程序mm.exe  修改多次微点报警

[ 本帖最后由 Nblock 于 2007-9-7 15:44 编辑 ]

平淡

楼上的不要纯表情回复

驱逐舰

[ 本帖最后由 平淡 于 2007-9-7 13:05 编辑 ]

绅博周幸

诺曼沙盘

du.exe : INFECTED with W32/Downloader (Signature: W32/Downloader.BPF)


[ DetectionInfo ]
    * Sandbox name: W32/Downloader
    * Signature name: W32/Downloader.BPF
    * Compressed: NO

[ General information ]
    * Drops files in %WINSYS% folder.
    * Creating several executable files on hard-drive.
    * File length:        18543 bytes.
    * MD5 hash: b454932d93c0257dcde0c438e7190f4e.

[ Changes to filesystem ]
    * Creates file C:\windows\system32\mm.exe.
    * Creates file C:\ghost.exe.

[ Network services ]
    * Downloads file from http://www.microsofttw.com/gto/ubs.exe as
c:\windows\system32\mm.exe.
    * Connects to "www.microsofttw.com" on port 80 (TCP).
    * Opens URL: www.microsofttw.com/gto/ubs.exe.
    * Downloads file from http://suifengvip.cn/mm/hm.exe as
c:\ghost.exe.
    * Connects to "suifengvip.cn" on port 80 (TCP).
    * Opens URL: suifengvip.cn/mm/hm.exe.

[ Security issues ]
    * Starting downloaded file - potential security problem.

[ Signature Scanning ]
    * C:\windows\system32\mm.exe (4096 bytes) : no signature detection.
    * C:\ghost.exe (4096 bytes) : no signature detection.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information
source only.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

微点卫士

微点：
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DU.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:1387
远端地址:60.169.0.185(安徽)
远端端口:80

上报去喽

loveows

卡巴主动防御报往外有连接，但不报毒

solcroft

反正过不了老鹰

wangjay1980

detected: virus Heur.Downloader (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\du.rar/du.exe

loveows

13:07分卡巴能杀

flo

卡7：
检测到：病毒 Heur.Downloader (修改)        URL: http://bbs.kafan.cn/attachment.php?aid=124689//du.exe

最为朴素的下载者，简单得不能再简单，HIPS反而不太能行，这时候就要靠启发了 ~~