某帖挖的[MD5: 4BEE5C 67049D DD2AAE]

promised

The EQs

C:\Documents and Settings\Don johnson\桌面\样本5.rar » RAR » svcos.exe - probably a variant of Win32/Genetik trojan

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\样本5.rar'
C:\Users\morgan\Documents\
  样本5.rar
  样本5.rar:Zone.Identifier
    [0] Archive type: RAR
    --> svcos.exe
        [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> user320.dll
        [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> use1.dll
        [WARNING]   The file was ignored!

微点卫士

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SVCOS.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\KVMONXP1.EXE
2) C:\PROGRAM FILES\INTERNET EXPLORER\USER32.DLL
3) C:\PROGRAM FILES\INTERNET EXPLORER\USE1.DLL
是否删除木马程序及其衍生物?

木马名称:未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\复件 USE1.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

promised

C:\ABC\样本5.rar:\svcos.exe - 特征码 'Trojan-Spy.Win32.Delf.PD' 被发现
C:\ABC\样本5.rar:\user320.dll - 特征码 'Virus.Win32.Delf.ECV' 被发现
C:\ABC\样本5.rar:\use1.dll - 特征码 'Trojan-Downloader.Win32.Delf.bcm' 被发现
C:\ABC\样本5.rar

        4 文件被扫描
          (1 压缩档 3 文件)
        3 特征码被侦测
        0 可疑代码段被发现
        耗时: 0:00.031

kp2006

kv2008报2个

http://bbs.kafan.cn/attachment.php?aid=139128->svcos.exe                       trojandownloader.agent.foq   2007-10-13 下午 03:19:22 已删除        
http://bbs.kafan.cn/attachment.php?aid=139128->use1.dll                        trojandownloader.delf.ejl    2007-10-13 下午 03:19:28 已删除

[ 本帖最后由 kp2006 于 2007-10-13 15:23 编辑 ]

29159011

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本5\SVCOS.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\KVMONXP1.EXE
2) C:\PROGRAM FILES\INTERNET EXPLORER\USER32.DLL
3) C:\PROGRAM FILES\INTERNET EXPLORER\USE1.DLL
是否删除木马程序及其衍生物?

残缺的唯美

Result: 3 malware found
Trojan-Downloader.Win32.Delf.cgy (virus)
C:\Users\Administrator\Desktop\Ñù±¾5.rar\svcos.exe
C:\Users\Administrator\Desktop\Ñù±¾5.rar\user320.dll
C:\Users\Administrator\Desktop\Ñù±¾5.rar\use1.dll

wangjay1980

detected: Trojan program Trojan-Downloader.Win32.Delf.cgy        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾5.rar/svcos.exe//PE_Patch//UPack
detected: Trojan program Trojan-Downloader.Win32.Delf.cgy        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾5.rar/user320.dll
detected: Trojan program Trojan-Downloader.Win32.Delf.cgy        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾5.rar/use1.dll

timhas266

Start of the scan: Saturday, 13 October, 2007  20:58

Starting the file scan:

Begin scan in 'C:\Documents and Settings\tim\桌面\樣本'
C:\Documents and Settings\tim\桌面\樣本\欴掛5.rar
  [0] Archive type: RAR
  --> svcos.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> user320.dll
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      A backup was created as '4746248e.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!


End of the scan: Saturday, 13 October, 2007  20:58
Used time: 00:01 min

The scan has been done completely.

      1 Scanning directories
      5 Files were scanned
      2 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes