卡巴不报!MD5: FCC8C6

tiancun

大家来看看~`这是今天捉的~`好象是AV的变种~~最新专杀也被终结~卡巴也不报~~

SONGBOWEN

卡巴7飘了

小红伞：
Begin scan in 'C:\Documents and Settings\Administrator\My Documents\下载的文件\今天中的毒.rar'
C:\Documents and Settings\Administrator\My Documents\下载的文件\今天中的毒.rar
  [0] Archive type: RAR
  --> rommabp.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [WARNING]   The file was ignored!

BitDefender 2008：
Remaining issues:Object Name Threat Name Final Status
C:\Documents and Settings\Administrator\My Documents\下载的文件\今天中的毒.rar=]rommabp.exe Generic.Malware.SP!Pk!g.518BE9DB Infected

SONGBOWEN

根据小红伞的报告，应该是一个下载者……

tiancun

我的是卡巴6,不报~~~看样子真要换代了~~~

kp2006

Worm.Win32.AvKiller.bq

瑞星报准确

[ 本帖最后由 kp2006 于 2007-11-5 21:43 编辑 ]

SONGBOWEN

汗一个，真够BT的……

爱过昙花

NOD32直接干死

aerbeisi

检测到：木马程序 Trojan.BAT.KillAV.gb        URL: http://bbs.kafan.cn/attachment.php?aid=149430//rommabp.exe//#

SONGBOWEN

发一个SandBox的沙盘报告：
Hello,

Thanks for taking the time to submit your samples to the Norman
Sandbox Information Center.  Customer delight is our top priority at
Norman.  With that in mind we have developed Sandbox Solutions for
organizations that are committed to speedy analysis and debugging.

Norman Sandbox Solutions give your organization the opportunity to
analyze files immediately in your own environment.

To find out how to bring the power of Norman Sandbox into your test
environments follow the links below.

Norman Sandbox Solutions
http://www.norman.com/Product/Sandbox-products/

Norman Sandbox Analyzer
http://www.norman.com/Product/Sandbox-products/Analyzer/

Norman Sandbox Analyzer Pro
http://www.norman.com/Product/Sandbox-products/Analyzer-pro/

Norman SandBox Reporter
http://www.norman.com/Product/Sandbox-products/Reporter/

&#19979 : Not detected by Sandbox (Signature: Hupigon.gen114)


[ DetectionInfo ]
    * Sandbox name: NO_MALWARE
    * Signature name: Hupigon.gen114
    * Compressed: YES

[ General information ]
    * File might be compressed.
    * Decompressing ASPack.
    * File length:        32433 bytes.
    * MD5 hash: fcc8c662568a5021f1a719c837a0bb13.

[ Changes to filesystem ]
    * Deletes file C:\Program Files\Common Files\System\lxpbnfn.exe.
    * Deletes file C:\Program Files\Common Files\Microsoft Shared\cmvrsaw.exe.
    * Deletes directory C:\Program Files\Common Files\System\lxpbnfn.exe.
    * Deletes directory C:\Program Files\Common Files\Microsoft Shared\cmvrsaw.exe.
    * Creates file C:\Program Files\Common Files\System\lxpbnfn.exe.
    * Creates file C:\Program Files\Common Files\Microsoft Shared\cmvrsaw.exe.

[ Changes to registry ]
    * Deletes value "otcujrh" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run".
    * Deletes value "rommabp" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run".

[ Process/window information ]
    * Attempts to access service "wscsvc".
    * Attempts to access service "helpsvc".
    * Attempts to access service "wuauserv".
    * Attempts to access service "SharedAccess".

[ Signature Scanning ]
    * C:\Program Files\Common Files\System\lxpbnfn.exe (32433 bytes) : no signature detection.
    * C:\Program Files\Common Files\Microsoft Shared\cmvrsaw.exe (32433 bytes) : no signature detection.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

SONGBOWEN

应该是一个灰鸽子，不是AV……