来些经典货

gzg

说明一下第一个附件:会感染C;\,D:\,E:\,F:\下所有PE文件,无自启动...其他行为就是将首业改为
http://www.starcraft2.com


第二个附件:未知样本

浪滔天

卡巴 7.0.0.125 高启发

第一个扫描过
第二个：
已检测到: 木马程序 Trojan.BAT.KillAV.ec        URL: http://bbs.kafan.cn/attachment.php?aid=128564//151D105.EXE//ASPack//#

残缺的唯美

nod32 第一个pass
2007-9-16 22:21:37        Scanning Log
2007-9-16 22:21:37        Version of virus signature database: 2532 (20070916)
2007-9-16 22:21:37        Date: 16.9.2007  Time: 22:21:37
2007-9-16 22:21:37        Scanned disks, folders and files: D:\Documents and Settings\EKINCHENG\桌面\9.16桌面.rar
2007-9-16 22:21:39        D:\Documents and Settings\EKINCHENG\桌面\9.16桌面.rar » RAR » 151D105.EXE - a variant of Win32/Agent.NEO trojan
2007-9-16 22:21:39        Number of scanned files: 3
2007-9-16 22:21:39        Number of threats found: 1
2007-9-16 22:21:39        Time of completion: 22:21:39  Total scanning time: 2 sec (00:00:02)

欠妳緈諨

AVAST也报第二个

ouzhi1

费尔在线扫描
第一个报后门
第二个报木马

[ 本帖最后由 ouzhi1 于 2007-9-16 22:39 编辑 ]

zzx129

Virus infection found

File which you are trying download contains virus. Loading has been interrupted.
Technical data:
Error name: Virus Alert
Virus description Win32.Worm.Winko.I, Win32.Worm.Winko.I
Error code: -1602
Requested URL: /attachment.php?aid=128564
Requested HTTP method: GET
Requested ContentType: application/octet-stream
Requested IP: 211.136.18.143

zzx129

Virus infection found

File which you are trying download contains virus. Loading has been interrupted.
Technical data:
Error name: Virus Alert
Virus description Win32.Worm.Nuj.A
Error code: -1602
Requested URL: /attachment.php?aid=128563
Requested HTTP method: GET
Requested ContentType: application/octet-stream
Requested IP: 211.136.18.143

Nblock

微点拦截处理成功！

1688388728

2007-09-16 23:40:13    加载库文件      操作:阻止
进程路径:D:\病毒库\9[1].16AvpDownloader\AvpDownloader.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\E_4\krnln.fnr
触发规则:所有程序规则->禁止程序->%systemdrive%\*\Temp*\*

曲中求

红伞第一个包里的pass

第二个包：

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\9[1].16桌面.rar'
C:\Documents and Settings\Administrator\桌面\9[1].16桌面.rar
  [0] Archive type: RAR
  --> 52422D1B.DLL
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Exaal.45056 Backdoor server programs
  --> 151D105.EXE
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Exaal.45056 Backdoor server programs
      [WARNING]   The file was ignored!