[MD5: 3C65B2],在奇虎论坛整来的病毒样本

walkingmu

过卡7
上报给卡巴是不是直接压缩成rar文件后发邮件给newvirus@kaspersky.com就可以了？

29159011

是
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\2\2.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\SVKP.SYS
2) C:\WINDOWS\HACKER.COM.CN.EXE
是否删除木马程序及其衍生物?

微点卫士

为什么我蓝屏了 。天妒英才啊

风野胤

32S
Scanning Log
Version of virus signature database: 2590 (20071012)
Date: 13.10.2007  Time: 18:30:09
Scanned disks, folders and files: R:\2.rar
R:\2.rar » RAR » 2.exe - a variant of Win32/Hupigon trojan
Number of scanned objects: 1
Number of threats found: 1
Time of completion: 18:30:41  Total scanning time: 32 sec (00:00:32)

The EQs

偶26S搞定。。。。

ykz1991

那么长时间
怎么不用probably，Generic搞定了

风野胤

原帖由 ykz1991 于 2007-10-13 18:56 发表
那么长时间
怎么不用probably，Generic搞定了

恩
已经猜到红伞报的是什么了。。。。。。
以上
居然有人捕风捉影地怀疑nod报壳
而无视某些杀软明目张胆地报壳
不能理解了。。。。。。。。。。

promised

C:\ABC\2.rar:\2.exe - 特征码 'Virus.Packed.Win32.Klone.af' 被发现
C:\ABC\2.rar

        2 文件被扫描
          (1 压缩档 1 文件)
        1 特征码被侦测
        0 可疑代码段被发现
        耗时: 0:00.187

timhas266

Start of the scan: Saturday, 13 October, 2007  19:16

Starting the file scan:

Begin scan in 'C:\Documents and Settings\tim\桌面\樣本\2.rar'
C:\Documents and Settings\tim\桌面\樣本\2.rar
  [0] Archive type: RAR
  --> 2.exe
      [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/SVKP). Please verify the origin of the file
      [INFO]      A backup was created as '4782a936.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!


End of the scan: Saturday, 13 October, 2007  19:16
Used time: 00:02 min

The scan has been done completely.

      0 Scanning directories
      3 Files were scanned
      1 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

wangfeng66

D:\opr02FYU.rar\2.exe - infected with BackDoor.Pigeon.4928

Archive contains an infected item

DRWEB 4.44  Kill