收藏本站 |切换到宽版 | 更换论坛皮肤
 找回密码  忘记邮箱  QQ快速登录  快速登录  快速注册

卡饭»论坛 › 安全区 › 病毒样本 分享&分析区 › 4个...朋友家
12下一页
返回列表 发新帖
查看: 3799|回复: 12
收起左侧

[病毒样本] 4个...朋友家

[复制链接]
Orca
发表于 2007-12-14 20:28:23 | 显示全部楼层 |阅读模式
Scanner Engine VerSig VerSig DateScan resultTime
A-Squared3.0.0.1262007.12.132007-12-13-
5.898
AhnLab V32007.12.14.002007.12.142007-12-14-
3.042
AntiVir7.6.0.457.0.1.932007-12-14HEUR/Malware
17.981
Arcavir1.0.42007121318062007-12-13-
15.718
Avast1.0.8071213-02007-12-13Win32:Agent-JRJ [Trj]
11.908
AVG7.5.49.442269.17.1/11832007-12-13-
9.942
BitDefender7.60825.9599707.162832007-12-14-
19.812
CA (VET)9.0.0.14331.3.53752007-12-14-
2.596
ClamAV0.91.251162007-12-14-
1.273
Comodo2.112.0.0.3732007-12-14-
1.722
CP Secure1.1.0.6552007.12.142007-12-14-
24.589
Dr.Web4.44.0.91702007.12.142007-12-14-
7.832
Ewido4.0.0.22007.12.132007-12-13-
13.968
F-Prot4.4.1.52200712132007-12-13Possible W32/Heuristic-162!Eldorado (not disinfectable)
1.720
F-Secure5.51.61002007.12.13.072007-12-13-
11.539
Fortinet2.81-3.118.4492007-12-03-
1.504
IkarusT3.1.01.152007.12.14.699892007-12-14Virus.Win32.Agent.IWX
6.073
JiangMin10.00.6502007.12.132007-12-13-
2.761
Kaspersky5.5.102007.12.142007-12-14-
17.786
KingSoft2007.6.20.2492007.12.142007-12-14-
4.016
McAfee5.2.0051852007-12-13-
17.648
mks_vir2.012007.12.132007-12-13-
15.523
NOD322.70.1027222007-12-14-
4.628
Norman5.91.085.902007-12-12Sandbox: W32/Downloader
44.499
nProtect2007-12-14.0010892552007-12-14-
10.444
Panda9.04.03.00012007.12.132007-12-13Suspicious file
3.705
PrevxV2200712142007-12-14-
26.421
Quick Heal9.002007.12.132007-12-13Suspicious - DNAScan
3.654
Rising19.020.22.41.002007-12-14-
2.813
Sophos2.49.14.212007-12-14-
18.702
Symantec1.3.0.2420071213.0022007-12-13-
0.351
The Hacker6.2.9v001592007-12-13-
1.354
Trend Micro8.500-10014.888.082007-12-14-
7.279
VBA323.12.2.520071213.17142007-12-13-
6.496
ViRobot200712142007.12.142007-12-14-
1.420
VirusBuster4.3.19:99.116.11/11.02007-12-13-
4.823
          NOTICE: It may be false positive by some scanners when they found a malware, so you should judge it by yourself.
Copy to clipboard
上面这个是3.rar的

Scanner results :  17% Scanner(6/36) found malware!
Time :  2007/12/14 20:22:45 (CST)
            
Scanner Engine VerSig VerSig DateScan resultTime
A-Squared3.0.0.1262007.12.132007-12-13-
5.734
AhnLab V32007.12.14.002007.12.142007-12-14-
1.321
AntiVir7.6.0.457.0.1.932007-12-14DR/Delphi.Gen
4.193
Arcavir1.0.42007121318062007-12-13-
2.004
Avast1.0.8071213-02007-12-13-
3.746
AVG7.5.49.442269.17.1/11832007-12-13-
5.818
BitDefender7.60825.9599707.162832007-12-14-
10.640
CA (VET)9.0.0.14331.3.53752007-12-14-
1.081
ClamAV0.91.251162007-12-14-
0.240
Comodo2.112.0.0.3732007-12-14-
1.507
CP Secure1.1.0.6552007.12.142007-12-14-
11.411
Dr.Web4.44.0.91702007.12.142007-12-14Adware.Cdn
6.584
Ewido4.0.0.22007.12.132007-12-13-
2.387
F-Prot4.4.1.52200712132007-12-13Possible W32/Heuristic-162!Eldorado (not disinfectable)
4.360
F-Secure5.51.61002007.12.13.072007-12-13-
1.038
Fortinet2.81-3.118.4492007-12-03-
0.622
IkarusT3.1.01.152007.12.14.699892007-12-14suspicious(level 35)
5.571
JiangMin10.00.6502007.12.132007-12-13-
1.706
Kaspersky5.5.102007.12.142007-12-14-
13.372
KingSoft2007.6.20.2492007.12.142007-12-14-
1.527
McAfee5.2.0051852007-12-13-
9.800
mks_vir2.012007.12.132007-12-13-
8.283
NOD322.70.1027222007-12-14-
1.267
Norman5.91.085.902007-12-12-
33.413
nProtect2007-12-14.0010892552007-12-14-
11.390
Panda9.04.03.00012007.12.132007-12-13Suspicious file
3.788
PrevxV2200712142007-12-14-
11.855
Quick Heal9.002007.12.132007-12-13Win32.Trojan-Clicker.BHO.n
2.934
Rising19.020.22.41.002007-12-14-
1.866
Sophos2.49.14.212007-12-14-
14.448
Symantec1.3.0.2420071213.0022007-12-13-
1.075
The Hacker6.2.9v001592007-12-13-
2.975
Trend Micro8.500-10014.888.082007-12-14-
7.238
VBA323.12.2.520071213.17142007-12-13-
4.519
ViRobot200712142007.12.142007-12-14-
0.813
VirusBuster4.3.19:99.116.11/11.02007-12-13-
3.193
          NOTICE: It may be false positive by some scanners when they found a malware, so you should judge it by yourself.

上面这个是setup310的（试毒的请在解压后的文件后面加上.exe）
不知是否小红伞误报...


[ 本帖最后由 Orca 于 2007-12-14 20:29 编辑 ]

本帖子中包含更多资源

您需要 登录 才可以下载或查看，没有帐号？快速注册

x
回复

举报

库洛洛
发表于 2007-12-14 20:29:51 | 显示全部楼层
Starting the file scan:

Begin scan in 'E:\3.rar'
E:\3.rar
  [0] Archive type: RAR
  --> 0366.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!
Begin scan in 'E:\setup310.rar'
E:\setup310.rar
  [0] Archive type: RAR
  --> setup310
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [WARNING]   The file was ignored!

2个没报~ 已上报~

[ 本帖最后由 库洛洛 于 2007-12-14 20:33 编辑 ]
回复

举报

yangpizhi
发表于 2007-12-14 20:33:56 | 显示全部楼层
F-Prot还真是不错啊
-----------------------------SCAN REPORT-----------------------------
F-PROT Antivirus for Windows

Antivirus Scanning Engine version number: 4.4.2
Virus signature file from: 2007-12-14, 3:08

Scan name: [Custom Scan]
Path to scan: C:\Documents and Settings\Administrator\桌面\3.rar

Normal scan
Also scan: Inside subfolders, Compressed files, Streams

Scan started: 2007-12-14, 20:31:29
---------------------------------------------------------------------

[Clean]        C:\Documents and Settings\Administrator\桌面\3.rar->0366.exe->(PecBundle)->(PECompact)
[Found downloader]         <W32/Downloader.D.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\Administrator\桌面\3.rar->my_70338.exe
[Clean]        C:\Documents and Settings\Administrator\桌面\3.rar->setpwr32.exe
[Contains infected objects]        C:\Documents and Settings\Administrator\桌面\3.rar
[Quarantined]        C:\Documents and Settings\Administrator\桌面\3.rar->setpwr32.exe

---------------------------------------------------------------------
Scan ended:        2007-12-14, 20:31:32
Duration:        0:00:02

Scan result:

Scanned files:                 1
Infected objects:         1
Disinfected objects:         0
Quarantined files:         1
---------------------------------------------------------------------

可为什么第二个我的F-Prot没报。。。
回复

举报

Orca
 楼主| 发表于 2007-12-14 20:38:45 | 显示全部楼层
我就知道这堆东西肯定有问题...都在%windir%下面
回复

举报

碧水寒潭
发表于 2007-12-14 20:39:27 | 显示全部楼层

红伞报！

Start of the scan: 2007年12月14日  20:38

Starting the file scan:

Begin scan in 'I:\样本'
I:\样本\3.rar
  [0] Archive type: RAR
  --> 0366.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was deleted!
I:\样本\setup310.rar
  [0] Archive type: RAR
  --> setup310
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [INFO]      The file was deleted!


End of the scan: 2007年12月14日  20:38
Used time: 00:26 min

The scan has been done completely.

      1 Scanning directories
      6 Files were scanned
      1 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      2 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      5 Files not concerned
      2 Archives were scanned
      0 Warnings
      0 Notes
回复

举报

qigang
发表于 2007-12-14 20:46:14 | 显示全部楼层
RX20.22.42全过。
回复

举报

sam.to
发表于 2007-12-14 20:49:29 | 显示全部楼层
上报給卡巴看看
回复

举报

库洛洛
发表于 2007-12-14 21:03:59 | 显示全部楼层

回复 2楼 库洛洛 的帖子

The file '0366.exe' has been determined to be 'MALWARE'. Our analysts named the threat DR/Boran.BX. The term "DR/" denotes a program that is able to place a virus or a malware discretely on a system.Detection will be added to our virus definition file (VDF) with one of the next updates. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Malware.

The file 'my_70338.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/Dldr.Small.czv. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

The file 'setpwr32.exe' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.
回复

举报

leonfg
发表于 2007-12-14 22:50:06 | 显示全部楼层
FS和费尔扫描均不报，运行后结果：

310那个，fs主防阻止运行
费尔扫描 监控都没任何反应

3那个，前两个有毒的FS沙盘报毒
费尔动态防御也都有反应

[ 本帖最后由 leonfg 于 2007-12-14 23:12 编辑 ]
回复

举报

scottxzt
发表于 2007-12-14 23:05:21 | 显示全部楼层
程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\VIRUS\0366.EXE
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\VIRUS\MY_70338.EXE
是否阻止该进程继续运行?
回复

举报

下一页 »
12下一页
返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2025-5-22 20:30 , Processed in 0.122059 second(s), 18 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究，不得将上述内容用于商业或者其他非法用途，否则产生的一切后果自负，本站信息来自网络，版权争议问题与本站无关，您必须在下载后的24小时之内从您的电脑中彻底删除上述信息，如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表