似毒不是毒?

千里同风

同名程序生成的，微点警报，估计是护马使者。解密virus

mofunzone

antivir居然飞了。。已上报
File:           fishpe.sys
Status:        
INFECTED/MALWARE
MD5:         24e516a88fee03fb832232d9bab4cfa7
Packers detected:        
-
Bit9 reports:         High threat detected (more info)
Scanner results
Scan taken on 14 Nov 2007 06:10:30 (GMT)
A-Squared        
Found nothing
AntiVir        
Found nothing
ArcaVir        
Found Trojan.Rootkit.Pefish.A
Avast        
Found Win32:Agent-IBC
AVG Antivirus        
Found Hider.AA
BitDefender        
Found Trojan.Rootkit.GEI
ClamAV        
Found nothing
CPsecure        
Found nothing
Dr.Web        
Found nothing
F-Prot Antivirus        
Found nothing
F-Secure Anti-Virus        
Found Rootkit.Win32.Agent.ij
Fortinet        
Found nothing
Kaspersky Anti-Virus        
Found Rootkit.Win32.Agent.ij
NOD32        
Found probably unknown NewHeur_PE (probable variant)
Norman Virus Control        
Found nothing
Panda Antivirus        
Found Trj/Downloader.MDW
Rising Antivirus        
Found RootKit.Win32.Agent.ij
Sophos Antivirus        
Found nothing
VirusBuster        
Found Rootkit.Agent.WLA
VBA32        
Found Rootkit.Win32.Agent.ij

yclidong

nod32   3.0

BING126

文件 fishpe.sys 接收于 2007.11.14 08:36:59 (CET)

反病毒引擎	版本	最后更新	扫描结果
AhnLab-V3	2007.11.14.0	2007.11.14	-
AntiVir	7.6.0.34	2007.11.14	-
Authentium	4.93.8	2007.11.14	-
Avast	4.7.1074.0	2007.11.13	Win32:Agent-IBC
AVG	7.5.0.503	2007.11.13	Hider.AA
BitDefender	7.2	2007.11.14	Trojan.Rootkit.GEI
CAT-QuickHeal	9.00	2007.11.14	-
ClamAV	0.91.2	2007.11.14	-
DrWeb	4.44.0.09170	2007.11.14	-
eSafe	7.0.15.0	2007.11.13	-
eTrust-Vet	31.2.5293	2007.11.13	-
Ewido	4.0	2007.11.13	-
FileAdvisor	1	2007.11.14	High threat detected
Fortinet	3.11.0.0	2007.10.19	W32/Agent.IJ!tr.rkit
F-Prot	4.4.2.54	2007.11.14	W32/RootkitX.KX
F-Secure	6.70.13030.0	2007.11.14	Rootkit.Win32.Agent.ij
Ikarus	T3.1.1.12	2007.11.14	Virus.Win32.Agent.IBC
Kaspersky	7.0.0.125	2007.11.14	Rootkit.Win32.Agent.ij
McAfee	5162	2007.11.13	-
Microsoft	1.3007	2007.11.12	-
NOD32v2	2657	2007.11.14	probably unknown NewHeur_PE virus
Norman	5.80.02	2007.11.13	-
Panda	9.0.0.4	2007.11.14	Trj/Downloader.MDW
Prevx1	V2	2007.11.14	-
Rising	20.18.20.00	2007.11.14	RootKit.Win32.Agent.ij
Sophos	4.23.0	2007.11.14	-
Sunbelt	2.2.907.0	2007.11.14	Trojan.Rootkit.GEI
Symantec	10	2007.11.14	-
TheHacker	6.2.9.127	2007.11.14	-
VBA32	3.12.2.4	2007.11.11	Rootkit.Win32.Agent.ij
VirusBuster	4.3.26:9	2007.11.13	Rootkit.Agent.WLA
Webwasher-Gateway	6.0.1	2007.11.14	-

有意思的是卡巴和瑞星扫描病毒名称居然一样!

906mbc

还好，我刚装的nod 32 3.0干掉他了

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： RootKit.Win32.Agent.ij   

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.18.22

sam.to

已偵測: 特洛伊木馬程式 Rootkit.Win32.Agent.ij        檔案: C:\Documents and Settings\kato9096\桌面\fishpe\fishpe.sys

mars2009

病毒在文件C:\Documents and Settings\Administrator\桌面\样本\fishpe\fishpe.sys中        Win32.Hack.Unknown.14848        处理成功（操作：删除）

xiongyimeng

小红伞飞过，，，不报。。。。。

cy6266812

过AVAST