9c5af3,VIP貌似是新的变种,NOD过!

显示全部楼层 · 发表于 2007-9-22 22:49:10

样本区好像发过,但我记得NOD可以杀VIP的,这个NOD却PASS了,搜索MD5没有重复

如果是重复样本就锁了吧

显示全部楼层 · 发表于 2007-9-22 22:54:16

多引擎上 avg报鸽子
AVG Antivirus Found BackDoor.Hupigon2.RHZ

显示全部楼层 · 发表于 2007-9-22 22:56:03

应该不是新的
detected: Trojan program Trojan-Downloader.Win32.Delf.cey URL: http://bbs.kafan.cn/attachment.php?aid=130910//vip.exe

显示全部楼层 · 发表于 2007-9-22 22:56:17

汗发现多引擎上有几个都报鸽子

显示全部楼层 · 发表于 2007-9-22 23:10:40

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 216
Paranoia Database - 5541
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\vip.exe

C:\Documents and Settings\uhthn\Desktop\vip.exe - Infected with SDB:MalwareSpy.Trojan-Downloader.Agent.ue - Deleted

1 Files scanned
1 Infected files found
0 Suspicious files found
0 Files cured
1 Files deleted

显示全部楼层 · 发表于 2007-9-23 00:16:16

NOD对鸽子好像不敏感

显示全部楼层 · 发表于 2007-9-23 00:23:43

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\vip.rar'
C:\Documents and Settings\Administrator\My Documents\
  vip.rar
[0] Archive type: RAR
--> vip.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-9-23 06:12:19

2007-9-23 6:12:16 1190499136 Administrator 2392 Sign of "Win32:Agent-IPV [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\vip.rar\vip.exe\[NsPack]" file

显示全部楼层 · 发表于 2007-9-23 07:17:05

原帖由 shaw530 于 2007-9-23 00:16 发表
NOD对鸽子好像不敏感

哪里是鸽子了
明明是下载者

显示全部楼层 · 发表于 2007-9-23 08:28:04

嗯是下载者那位误解我的意思了我是说多引擎上有人报鸽子

[病毒样本] 9c5af3,VIP貌似是新的变种,NOD过!

本帖子中包含更多资源