7个生成物和原样本

Redevil

RT

FBAV

MicroVita AntiSpyware 100 C
_____________________________________________
                                          
             风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]                  
                   http://221.10.254.214/
----------------------------------------------
开始扫描……


正在检查启动……
[C:\Documents and Settings\Administrator\桌面\Virus\v\病毒样本\1.DAT]
                    …………发现Spy！报告: [4]
文件信息:  大小:40960  MD5:325041078a7777794796cfe181632cac


[C:\Documents and Settings\Administrator\桌面\Virus\v\病毒样本\11.DAT]
                    …………发现Spy！报告: [4]
文件信息:  大小:66560  MD5:89fe32de8587b0dfd76efce00396eb56


[C:\Documents and Settings\Administrator\桌面\Virus\v\病毒样本\12.DAT]
                    …………发现Spy！报告: [4]
文件信息:  大小:65536  MD5:6c9ef9842ebc18ae8371828b7bec7faa


[C:\Documents and Settings\Administrator\桌面\Virus\v\病毒样本\3.DAT]
                    …………发现Spy！报告: [4]
文件信息:  大小:221184  MD5:f7c35a5c7566bcea6aab038ac210b181


[C:\Documents and Settings\Administrator\桌面\Virus\v\病毒样本\4.DAT]
                    …………发现Spy！报告: [4]
文件信息:  大小:9842  MD5:512751860202f24344837fcf11f28214


[C:\Documents and Settings\Administrator\桌面\Virus\v\病毒样本\HELP.EXE]
                    …………发现Spy！报告: [4]
文件信息:  大小:82432  MD5:80152a0d0be4872e0b901613c5ef92c8


文件数:6   病毒数:6  比重:1
OK  扫描完毕！

  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎   
[2] 文件特征码引擎
[1] 文件启发式引擎

[ 本帖最后由 FBAV 于 2007-10-9 17:13 编辑 ]

kp2006

kv不报

promised

help.exe有空的可以拿去分析一下
有点花头

wangjay1980

detected: virus Heur.Invader (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\200710914381325214.rar/²¡¶¾Ñù±¾\HELP.EXE
detected: virus Heur.Invader (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\v.rar/c_20996.nls

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\200710914381325214.rar'
C:\Users\morgan\Documents\
  200710914381325214.rar
    [0] Archive type: RAR
    --> ²¡¶¾Ñù±¾\1.DAT
    --> ²¡¶¾Ñù±¾\11.DAT
    --> ²¡¶¾Ñù±¾\12.DAT
    --> ²¡¶¾Ñù±¾\3.DAT
    --> ²¡¶¾Ñù±¾\4.DAT
    --> ²¡¶¾Ñù±¾\HELP.EXE
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!
Begin scan in 'C:\Users\morgan\Documents\v.rar'
C:\Users\morgan\Documents\
  v.rar
    [0] Archive type: RAR
    --> notepad.exe
    --> calc.exe
    --> c_20911.nls
    --> c_20996.nls
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> c_20718.nls
    --> c_20819.nls
    --> userinit.exe
        [WARNING]   The file was ignored!


End of the scan: 2007年10月9日  07:47
Used time: 00:06 min

The scan has been done completely.

      0 Scanning directories
     15 Files were scanned
      0 viruses and/or unwanted programs were found
      2 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     15 Files not concerned
      2 Archives were scanned
      4 Warnings
      0 Notes