一只小鸟

显示全部楼层 · 发表于 2007-9-14 12:23:09

文件: C:\Documents and Settings\moonsilver\桌面\scvhost.exe
大小: 477184 字节
文件版本: 1.0.0.0
修改时间: 2007年9月14日, 12:12:27
MD5: 232D1B7DEFDAF1CE30A00A5424D2EC13
SHA1: BEFFA6882C39C3E699775B58D92EE93A17747D35
CRC32: ED9B7F2B

显示全部楼层 · 发表于 2007-9-14 12:24:08

被伞打飞了

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\scvhost.rar'
C:\Documents and Settings\Administrator\My Documents\
  scvhost.rar
[0] Archive type: RAR
--> scvhost.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-9-14 12:25:37

免杀做的很好，捉到的时候还是活的~

显示全部楼层 · 发表于 2007-9-14 12:26:05

不是吧，这小鸟的威力也太大了。。

File:	scvhost.exe
Status:	POSSIBLY INFECTED/MALWARE(Note: this file was only classified as malware by scanners known togenerate more false positives than the average scanner. Do not considerthese results definately accurate. Also, because of this, results ofthis scan will not be recorded in the database.)
MD5:	232d1b7defdaf1ce30a00a5424d2ec13
Packers detected:	-
Bit9 reports:	File not found

Scanner results
Scan taken on 14 Sep 2007 04:24:55 (GMT)
A-Squared	Found nothing
AntiVir	Found HEUR/Malware
ArcaVir	Found nothing
Avast	Found nothing
AVG Antivirus	Found nothing
BitDefender	Found nothing
ClamAV	Found nothing
CPsecure	Found nothing
Dr.Web	Found nothing
F-Prot Antivirus	Found nothing
F-Secure Anti-Virus	Found nothing
Fortinet	Found nothing
Kaspersky Anti-Virus	Found nothing
NOD32	Found nothing
Norman Virus Control	Found nothing
Panda Antivirus	Found nothing
Rising Antivirus	Found nothing
Sophos Antivirus	Found nothing
VirusBuster	Found nothing
VBA32	Found nothing

显示全部楼层 · 发表于 2007-9-14 12:26:38

死鸟，鉴定完毕

显示全部楼层 · 发表于 2007-9-14 12:27:58

运行了两遍一点反应都没有

显示全部楼层 · 发表于 2007-9-14 12:28:41

活的启动服务ServiceCopyreit10
挂起进程svchost.exe
还顺便给了个小网马

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
New Document
配置文件
<!--
弹出的时间分钟。
设置一个合理的弹出时间，
请更改value的值来改变弹出时间。
默认为20分钟。
-->
<!--
弹出的网址
按照以下格式设置要弹出的网址。
请将最需要弹出的网址放到最前边，插件将按顺序弹出这些地址。
最多可以设置100个弹出网址。
-->
http://www.ittool.cn/tanwo.htm
http://www.ittool.cn/google/
http://www.ittool.cn/tanwo.htm
http://www.ittool.cn/
<!--
下载列表
-->
http://www.ittool.cn/down/d1a.exe

复制代码

[ 本帖最后由 mofunzone 于 2007-9-13 20:29 编辑 ]

显示全部楼层 · 发表于 2007-9-14 12:28:58

难道又是尸体启发，死活都上报

[ 本帖最后由 wangjay1980 于 2007-9-14 12:30 编辑 ]

显示全部楼层 · 发表于 2007-9-14 12:29:26

Thank you for your submission. Below you can see the current status of the uploaded files.

--------------------------------------------------------------------------------

We received the following archive files:

File ID  Filename  Size (Byte) Result
1310930  scvhost.rar 193.72 KB OK

A listing of files contained inside archives alongside their results can be found below:

File ID  Filename  Size (Byte) Result
1310931  scvhost.exe  466 KB  UNDER ANALYSIS

Please find a detailed report concerning each individual sample below:

Filename Result
scvhost.exe  UNDER ANALYSIS

The file 'scvhost.exe' has been determined to be 'UNDER ANALYSIS'.

--------------------------------------------------------------------------------
Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.

显示全部楼层 · 发表于 2007-9-14 12:31:06

UNDER ANALYSIS
是什么意思

[病毒样本] 一只小鸟

本帖子中包含更多资源