下载者及产物4个[MD5: AE07D1 016A25 F6E7DE 73C7F6]

promised

C:\ABC\1\m1.exe - 特征码 'BehavesLikeWin32.ExplorerHijack' 被发现
C:\ABC\1\main.exe - 特征码 'BehavesLikeWin32.ExplorerHijack' 被发现
C:\ABC\1\winint.exe
C:\ABC\1\winsys.sys

Graybird

Starting the file scan:

Begin scan in 'E:\样本.rar'
E:\样本.rar
  [0] Archive type: RAR
  --> main.exe
      [DETECTION] Is the Trojan horse TR/Agent.47104.B
  --> m1.exe
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was deleted!

The file 'winint.exe' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.

winsys.sys  没报~

傻猪猪米走鸡

F:\virus\样本.rar » RAR » main.exe - a variant of Win32/Mypis virus
F:\virus\样本.rar » RAR » m1.exe - a variant of Win32/TrojanDownloader.Delf.NUM trojan

xxwpk007

木马名称:Trojan-Downloader.Win32.Delf.iaq

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\M1.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?


程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MAIN.EXE
是否删除木马程序及其衍生物?

wangjay1980

detected: Trojan program Trojan-Downloader.Win32.Delf.dgg        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾3.rar/m1.exe//PE_Patch.UPX//UPX

sam.to

已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Delf.dgg        檔案: C:\Documents and Settings\kato9096\桌面\167830\m1.exe//PE_Patch.UPX//UPX

3个不报，已上报

wangjay1980

Hello,

main.exe_
Will be detected as soon as possible.

winint.exe_, winsys.sys
No malicious code were found in these files.

IllusionWing

[扫描] [变形壳检测] 在 E:\Documents and Settings\Administrator\桌面\win\样本.rar>>m1.exe 检测到 Packed.Generic.UPX.Modified.2
[扫描] [变形壳检测] 在 E:\Documents and Settings\Administrator\桌面\win\样本.rar>>main.exe 检测到 Packed.Generic.UPX.Modified.2
[扫描] [ExternalDLL] 在 E:\Documents and Settings\Administrator\桌面\win\样本.rar>>winsys.sys 检测到 Generic.ExternalDatabaseItem.Rootkit.Possible?
[扫描] [ExternalDLL] 在 E:\Documents and Settings\Administrator\桌面\win\样本.rar>>winint.exe 检测到 Generic.ByEMF.SusDriverLoader

sam.to

Hello,

main.exe_ - Virus.Win32.Downloader.af

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

winint.exe_, winsys.sys

No malicious code were found in these files.

Please quote all when answering.

--
Best regards, Yury Nesmachny
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

Graybird

The file 'winsys.sys' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.