[MD5: C1CCE5]卡7未报，疑为病毒

walkingmu

在我MP3里发现的，根据autorun.inf看应该是病毒，不过卡7未报，virustotal也只有少量报的，上传上来大家看看

文件 hook.rar 接收于 2007.10.09 12:07:09 (CET)

反病毒引擎	版本	最后更新	扫描结果
AhnLab-V3	2007.10.9.1	2007.10.09	-
AntiVir	7.6.0.20	2007.10.09	-
Authentium	4.93.8	2007.10.08	-
Avast	4.7.1051.0	2007.10.08	-
AVG	7.5.0.488	2007.10.09	-
BitDefender	7.2	2007.10.09	-
CAT-QuickHeal	9.00	2007.10.08	-
ClamAV	0.91.2	2007.10.09	-
DrWeb	4.44.0.09170	2007.10.09	-
eSafe	7.0.15.0	2007.10.08	-
eTrust-Vet	31.2.5198	2007.10.09	-
Ewido	4.0	2007.10.08	-
FileAdvisor	1	2007.10.09	-
Fortinet	3.11.0.0	2007.10.09	-
F-Prot	4.3.2.48	2007.10.08	-
F-Secure	6.70.13030.0	2007.10.09	-
Ikarus	T3.1.1.12	2007.10.09	-
Kaspersky	7.0.0.125	2007.10.09	-
McAfee	5136	2007.10.08	Generic!atr
Microsoft	1.2908	2007.10.09	-
NOD32v2	2579	2007.10.09	-
Norman	5.80.02	2007.10.08	-
Panda	9.0.0.4	2007.10.08	-
Prevx1	V2	2007.10.09	Heuristic: Suspicious Self Modifying File
Rising	19.44.12.00	2007.10.09	-
Sophos	4.22.0	2007.10.09	-
Sunbelt	2.2.907.0	2007.10.08	-
Symantec	10	2007.10.09	-
TheHacker	6.2.6.080	2007.10.09	-
VBA32	3.12.2.4	2007.10.08	-
VirusBuster	4.3.26:9	2007.10.08	-
Webwasher-Gateway	6.0.1	2007.10.09	-
附加信息
File size: 24460 bytes
MD5: c1cce5ddb35fea1eec68cbeff241898c
SHA1: d0e4dda3ce2165f2b9a1da34a6aa1e571c636a24

promised

喜欢无壳样本
粗看了一下可能和盗QQ有关

[ 本帖最后由 promised 于 2007-10-9 20:42 编辑 ]

qigang

RX无反应哦。

promised

Hello,

autorun.inf

No malicious code was found in this file.

hook.exed - Virus.Win32.AutoRun.sy

This file is already detected. Please update your antivirus bases.

HookProc.dll - Virus.Win32.AutoRun.sy

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Denis Maslennikov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

wangjay1980

看来不用偶上报了

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 352
Paranoia Database - 6972
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\hook

C:\Documents and Settings\uhthn\Desktop\hook\autorun.inf - OK
C:\Documents and Settings\uhthn\Desktop\hook\hook.exe - Infected Virus.autorun.7
C:\Documents and Settings\uhthn\Desktop\hook\HookProc.dll - Suspected Trojan-Downloader.Agent.1

3 Files scanned
1 Infected files found
1 Suspected files found
0 Files cured
1 Files deleted

残缺的唯美

The requested URL http://bbs.kafan.cn/attachment.php?aid=137460 is infected with Virus.Win32.AutoRun.sy virus   
卡巴的处理速度很快