南昌百特生物高新技术有限公司挂马Rising AV miss

显示全部楼层 · 发表于 2007-9-22 15:32:16

A-Squared	Found nothing
AntiVir	Found DR/Delphi.Gen
ArcaVir	Found nothing
Avast	Found Win32:Nilage-AI
AVG Antivirus	Found nothing
BitDefender	Found BehavesLike:Trojan.ShellHook (probable variant)
ClamAV	Found Trojan.Autorun-5
CPsecure	Found W32.AutoRun.gr
Dr.Web	Found Win32.HLLW.Autoruner.586
F-Prot Antivirus	Found Possibly a new variant of W32/Threat-HLLPEM-based!Maximus
F-Secure Anti-Virus	Found nothing
Fortinet	Found nothing
Kaspersky Anti-Virus	Found Virus.Win32.AutoRun.nv
NOD32	Found probably a variant of Win32/PSW.Delf.NHI (probable variant)
Norman Virus Control	Found Sandbox: W32/Malware; [ General information ] * Decompressing UPX. * Accesses executable file from resource section. * *Locates window "1616116 [class ListBox]" on desktop. *Locates window "1818118 [class ListBox]" on desktop. File length: 27696 bytes. [ Changes to filesystem ] * Deletes file ?I????O?I嗨?_. * Deletes file C:\Program Files\Internet Explorer\PLUGINS\NewTemp.bak. * Creates file C:\Program Files\Internet Explorer\PLUGINS\NewTemp.bak. * Deletes file C:\Program Files\Internet Explorer\PLUGINS\NewTemp.dll. * Creates file C:\Program Files\Internet Explorer\PLUGINS\NewTemp.dll. [ Network ] * Hooks into Shell explorer.
Panda Antivirus	Found nothing
Rising Antivirus	Found nothing
Sophos Antivirus	Found Mal/PWS-K, Mal/EncPk-AP
VirusBuster	Found Trojan.QQPass.Gen.3
VBA32	Found Trojan-PSW.Game.18 (paranoid heuristics) (probable variant)

显示全部楼层 · 发表于 2007-9-22 15:34:10

C:\ABC\364\364.exe - 特征码 'BehavesLikeTrojan.ShellHook' 被发现

显示全部楼层 · 发表于 2007-9-22 15:43:22

C:\Documents and Settings\Administrator\桌面\364.rar >>RAR >>364.exe - 可能是 Win32/PSW.Delf.NHI 木马的一个变种

显示全部楼层 · 发表于 2007-9-22 15:49:54

McAfee PWS-QQPass.dll

显示全部楼层 · 发表于 2007-9-22 17:54:25

Virus infection found

File which you are trying download contains virus. Loading has been interrupted.
Technical data:
Error name: Virus Alert
Virus description BehavesLike:Trojan.ShellHook
Error code: -1602
Requested URL: /attachment.php?aid=130674
Requested HTTP method: GET
Requested ContentType: application/octet-stream
Requested IP: 211.136.18.143

显示全部楼层 · 发表于 2007-9-22 18:05:27

老周开始挖掘南昌的样本来了。。

2007-9-22 18:05:12 引擎版本=5200.2160
2007-9-22 18:05:12 防病毒 DAT 版本=5125.0000
2007-9-22 18:05:12 EXTRA.DAT 中的检测项特征码数=无
2007-9-22 18:05:12 EXTRA.DAT 中的检测项特征码名称=无
2007-9-22 18:05:04 扫描已启动 3109AB0180954E2\星星按需扫描
2007-9-22 18:05:13 未采取操作星星 E:\病毒\364\364.exe\364.exe\000104f4.EXE PWS-QQPass.dll(特洛伊)

显示全部楼层 · 发表于 2007-9-22 18:37:11

奇怪了，我解出来的病毒地址是
hXXp://down.851733.cn/down.exe
hXXp://www.MLCRO-SOFT.com/Baidu.cab
hXXp://www.MLCRO-SOFT.com/Baidu.exe
不是LZ的那个

显示全部楼层 · 发表于 2007-9-22 18:47:43

hXXp://www.MLCRO-SOFT.com/Baidu.cab
hXXp://www.MLCRO-SOFT.com/Baidu.exe
这两个是一个东西来着

chou的站点还没看过……忙模板去了

显示全部楼层 · 发表于 2007-9-22 18:50:00

exe挂了
cab还活着
看eset的报告病毒真是享受啊

显示全部楼层 · 发表于 2007-9-22 18:58:37

恩 eset的美工真是一级棒啊

[病毒样本] 南昌百特生物高新技术有限公司挂马Rising AV miss

本帖子中包含更多资源

回复 9楼风野胤的帖子

[病毒样本] 南昌百特生物高新技术有限公司挂马Rising AV miss

本帖子中包含更多资源

回复 9楼 风野胤 的帖子

回复 9楼风野胤的帖子