一个超级坏蛋 过 卡吧 瑞星 NOD32 11.25 病毒库

capsshift

看着就面熟，一个加了猛壳的东东，红伞不识别这个壳。
但是一运行，生成物马上被红伞咔嚓了，系统安全。

Virus or unwanted program 'HEUR/Malware [HEUR/Malware]'
detected in file 'C:\WINDOWS\inf\NetRunTime.exe.
Action performed: Move file to quarantine

PlayWill

卡7过了

PlayWill

没过卡7主防

sam.to

原帖由 yimike 于 2007-11-25 16:34 发表
附上虚拟机中运行后生成的文件  
注册系统服务  联网  修改注册表IE设置

Hello,

NetRunTime.exe_, windowsime.exe_ - Trojan-Spy.Win32.Delf.art

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vyacheslav Zakorzhevsky
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.


http://bbs.kafan.cn/viewthread.php?tid=161704

一样

[ 本帖最后由 kato9096 于 2007-11-25 18:42 编辑 ]

sam.to

原帖由 雪落的瞬间 于 2007-11-25 15:56 发表

Hello,

aa2.exe_ - Trojan-Dropper.Win32.Delf.aka

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vyacheslav Zakorzhevsky
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

qigang

RX20.19.62未杀。

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 981
Paranoia Database - 49114
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\aa2.exe

C:\Documents and Settings\Uhthn\Desktop\aa2.exe - Infected WIN32.TROJAN.DELF.5 - Deleted

1 Files scanned
1 Infected files found
0 Suspected files found
0 Files disinfected
1 Files deleted

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\Desktop'
C:\Users\morgan\Documents\Desktop\
  NetRunTime.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!
  windowsime.exe
Begin scan in 'C:\Users\morgan\Documents\ah.rar'
C:\Users\morgan\Documents\
  ah.rar
    [0] Archive type: RAR
    --> aa2.exe
        [DETECTION] Is the Trojan horse TR/Agent.506880
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!


End of the scan: 2007年11月25日  10:35
Used time: 00:06 min

The scan has been done completely.

      1 Scanning directories
      4 Files were scanned
      1 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      1 Archives were scanned
      3 Warnings
      0 Notes

Nblock

毒客？   微点的回答:

微点主动防御软件  预升级
程序版本： 1.2.10571.0153
特征版本： 1.6.506.071118
更新时间： 2007-11-18

发现未知木马，是否删除？
程序:
AA2.EXE
木马程序生成以下文件:
1) C:\WINDOWS\INF\NETRUNTIME.EXE
2) C:\WINDOWS\IME\WINDOWSIME.EXE
是否删除木马程序及其衍生物?

[ 本帖最后由 Nblock 于 2007-11-26 11:49 编辑 ]

wu19934718

费尔右键扫描不报，在线扫描报木马一个。。