一包质量还可以的样本

gzg

扫扫看

FBAV

MicroVita AntiSpyware 100 C
_____________________________________________
                                          
             风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]                  
                   http://221.10.254.214/
----------------------------------------------
开始扫描……


正在检查启动……
[C:\Documents and Settings\Administrator\桌面\Virus\autorunGEG\A0000264.EXE]
                    …………发现Spy！报告: [4]
文件信息:  大小:1211  MD5:f7bd87b88e591e4ac9b3553852740984


[C:\Documents and Settings\Administrator\桌面\Virus\autorunGEG\SYSTEM VOLUME INFORMATION.EXE]
                    …………发现Spy！报告: [4] [2]
文件信息:  大小:45056  MD5:354f75d662d7746d08f0ab49e3ed438e


[C:\Documents and Settings\Administrator\桌面\Virus\autorunGEG\RECYCLED.EXE]
                    …………发现Spy！报告: [4] [2]
文件信息:  大小:45056  MD5:354f75d662d7746d08f0ab49e3ed438e


[C:\Documents and Settings\Administrator\桌面\Virus\autorunGEG\autorun.bin]
                    …………发现Spy！报告: [4]
文件信息:  大小:959  MD5:62059131773bac3819b9af053349a50e


[C:\Documents and Settings\Administrator\桌面\Virus\autorunGEG\autorun.inf]
                    …………发现Spy！报告: [4]
文件信息:  大小:169  MD5:552bc445c3bbc71be24f2b83cf24bc17


[C:\Documents and Settings\Administrator\桌面\Virus\autorunGEG\autorun.reg]
                    …………发现Spy！报告: [4]
文件信息:  大小:560  MD5:2199bf73d6e84f9391bae1d8de41f014


[C:\Documents and Settings\Administrator\桌面\Virus\autorunGEG\autorun.txt]
                    …………发现Spy！报告: [4]
文件信息:  大小:959  MD5:62059131773bac3819b9af053349a50e


[C:\Documents and Settings\Administrator\桌面\Virus\autorunGEG\autorun.wsh]
                    …………发现Spy！报告: [4]
文件信息:  大小:72  MD5:a9900490cf34dee22f588255088c7d77


[C:\Documents and Settings\Administrator\桌面\Virus\autorunGEG\dtdsxsj.exe]
                    …………发现Spy！报告: [4] [1] [7] 映像劫持者
文件信息:  大小:65185  MD5:f7ff0578bea924ed69ff3e039a1d20b4


[C:\Documents and Settings\Administrator\桌面\Virus\autorunGEG\SXS2.EXE]
                    …………发现Spy！报告: [4] [1]
文件信息:  大小:2264  MD5:15a40b591bda48d04625e4b0e061ad08


[C:\Documents and Settings\Administrator\桌面\Virus\autorunGEG\MEEX.EXE]
                    …………发现Spy！报告: [4] [1] [7] 映像劫持者
文件信息:  大小:65185  MD5:f7ff0578bea924ed69ff3e039a1d20b4


[C:\Documents and Settings\Administrator\桌面\Virus\autorunGEG\UTRDHNP.EXE]
                    …………发现Spy！报告: [4] [1] [7] 映像劫持者
文件信息:  大小:65185  MD5:f7ff0578bea924ed69ff3e039a1d20b4


[C:\Documents and Settings\Administrator\桌面\Virus\autorunGEG\BGGMIXL.EXE]
                    …………发现Spy！报告: [4] [1] [7] 映像劫持者
文件信息:  大小:65185  MD5:f7ff0578bea924ed69ff3e039a1d20b4


[C:\Documents and Settings\Administrator\桌面\Virus\autorunGEG\谭咏麟专辑.EXE]
                    …………发现Spy！报告: [4] [2]
文件信息:  大小:45056  MD5:354f75d662d7746d08f0ab49e3ed438e


文件数:15   病毒数:14  比重:0.9333333333333
OK  扫描完毕！

  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎   
[2] 文件特征码引擎
[1] 文件启发式引擎

[ 本帖最后由 FBAV 于 2007-10-11 16:55 编辑 ]

kp2006

Win32:Perlovga
Win32:Trax [Wrm]
Win32:Trax [Wrm]
Win32:Delf-ERE [Wrm]
Win32:Small-EUP [Trj]
Win32:Delf-ERE [Wrm]
Win32:Delf-ERE [Wrm]
Win32:Delf-ERE [Wrm]
Win32:Trax [Wrm]

The EQs

C:\Documents and Settings\Don johnson\桌面\autorun.rar » RAR » A0000264.EXE - Win32/Perlovga.A virus
C:\Documents and Settings\Don johnson\桌面\autorun.rar » RAR » autorun.reg - VBS/Small.K virus
C:\Documents and Settings\Don johnson\桌面\autorun.rar » RAR » dtdsxsj.exe - a variant of Win32/Delf.NDF worm
C:\Documents and Settings\Don johnson\桌面\autorun.rar » RAR » SXS2.EXE - Win32/TrojanDownloader.Small.EFU trojan
C:\Documents and Settings\Don johnson\桌面\autorun.rar » RAR » MEEX.EXE - a variant of Win32/Delf.NDF worm
C:\Documents and Settings\Don johnson\桌面\autorun.rar » RAR » UTRDHNP.EXE - a variant of Win32/Delf.NDF worm
C:\Documents and Settings\Don johnson\桌面\autorun.rar » RAR » BGGMIXL.EXE - a variant of Win32/Delf.NDF worm

残缺的唯美

Result: 3 malware found
Worm.Win32.Perlovga.a (virus)
C:\Users\Administrator\Desktop\autorun.rar\A0000264.EXE
Trojan.WinREG.AutoRun.a (virus)
C:\Users\Administrator\Desktop\autorun.rar\autorun.reg
Trojan-Downloader.Win32.Small.efu (virus)
C:\Users\Administrator\Desktop\autorun.rar\SXS2.EXE

傻猪猪米走鸡

2007-9-11 17:12:23        Real-time file system protection        file        D:\firefox下载的文件\autorun\BGGMIXL.EXE        a variant of Win32/Delf.NDF worm        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: f:\Program Files\WinRAR\WinRAR.exe.
2007-9-11 17:12:18        Real-time file system protection        file        D:\firefox下载的文件\autorun\UTRDHNP.EXE        a variant of Win32/Delf.NDF worm        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: f:\Program Files\WinRAR\WinRAR.exe.
2007-9-11 17:12:14        Real-time file system protection        file        D:\firefox下载的文件\autorun\MEEX.EXE        a variant of Win32/Delf.NDF worm        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: f:\Program Files\WinRAR\WinRAR.exe.
2007-9-11 17:12:11        Real-time file system protection        file        D:\firefox下载的文件\autorun\SXS2.EXE        Win32/TrojanDownloader.Small.EFU trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: f:\Program Files\WinRAR\WinRAR.exe.
2007-9-11 17:12:03        Real-time file system protection        file        D:\firefox下载的文件\autorun\dtdsxsj.exe        a variant of Win32/Delf.NDF worm        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: f:\Program Files\WinRAR\WinRAR.exe.
2007-9-11 17:11:56        Real-time file system protection        file        D:\firefox下载的文件\autorun\autorun.reg        VBS/Small.K virus        deleted - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: f:\Program Files\WinRAR\WinRAR.exe.
2007-9-11 17:11:53        Real-time file system protection        file        D:\firefox下载的文件\autorun\A0000264.EXE        Win32/Perlovga.A virus        deleted - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: f:\Program Files\WinRAR\WinRAR.exe.

欠妳緈諨

用AntiVirusKit扫描病毒
版本 16.0.7
病毒库签名 2007-10-9
开始时间: 2007-10-11 17:37
引擎: KAV 引擎 (AVK 17.8716), BD  引擎 (BD 17.5530)
启发式: 打开
压缩文件: 打开
系统区域: 打开

扫描系统区域...
扫描所选择的目录和文件...
对象: A0000264.EXE
        在压缩档案里: D:\病毒测试\未解压样本\autorun.rar
        Status: 已发现病毒
        病毒: Worm.Win32.Perlovga.a (KAV 引擎)
对象: autorun.reg
        在压缩档案里: D:\病毒测试\未解压样本\autorun.rar
        Status: 已发现病毒
        病毒: Trojan.WinREG.AutoRun.a (KAV 引擎)
对象: SXS2.EXE
        在压缩档案里: D:\病毒测试\未解压样本\autorun.rar
        Status: 已发现病毒
        病毒: Trojan-Downloader.Win32.Small.efu (KAV 引擎)

killloop

江民10个

浪滔天

卡巴 7.0.0.125 高启发
7个

已隔离: 病毒 Heur.Trojan.Generic (变种)        文件: F:\病毒样本\autorun.rar/BGGMIXL.EXE
已隔离: 病毒 Heur.Trojan.Generic (变种)        文件: F:\病毒样本\autorun.rar/UTRDHNP.EXE
已隔离: 病毒 Heur.Trojan.Generic (变种)        文件: F:\病毒样本\autorun.rar/MEEX.EXE
已隔离: 病毒 Heur.Trojan.Generic (变种)        文件: F:\病毒样本\autorun.rar/dtdsxsj.exe
已删除: 病毒 Worm.Win32.Perlovga.a        文件: F:\病毒样本\autorun.rar/A0000264.EXE//PE_Patch//MEW
已删除: 木马程序 Trojan-Downloader.Win32.Small.efu        文件: F:\病毒样本\autorun.rar/SXS2.EXE
已删除: 木马程序 Trojan.WinREG.AutoRun.a        文件: F:\病毒样本\autorun.rar/autorun.reg

yurius

symantec endpoint 10个

2007-10-11 20:35:46,W32.Traxg@mm,Quarantined,谭咏麟专辑.EXE
2007-10-11 20:35:46,W32.SillyFDC,Quarantined,BGGMIXL.EXE
2007-10-11 20:35:45,W32.SillyFDC,Quarantined,UTRDHNP.EXE
2007-10-11 20:35:45,W32.SillyFDC,Quarantined,MEEX.EXE
2007-10-11 20:35:45,Downloader,Quarantined,SXS2.EXE
2007-10-11 20:35:45,W32.SillyFDC,Quarantined,dtdsxsj.exe
2007-10-11 20:35:44,VBS.Runauto,Quarantined,autorun.reg
2007-10-11 20:35:43,W32.Traxg@mm,Quarantined,RECYCLED.EXE
2007-10-11 20:35:43,W32.Traxg@mm,Quarantined,SYSTEM VOLUME INFORMATION.EXE
2007-10-11 20:35:42,Trojan Horse,Quarantined,A0000264.EXE