红伞没能防住改时间的病毒

yusup

今天本来想试一下终截者，下了一个改时间的病毒，后来下了一个绅博版的终截者，然后打开了虚拟影子，没想到我本是去装终截者的（大家都知道绅博下的东西名字好长）一时没看清，把样本运行了，我看到红伞报警了，马上就点了删除，可没想到我一看时间，被改成2005年了，然后我重启了一下，又成了2006年，于是自己改了一下，然后用红伞扫毒，没想到真的中了。

[ 本帖最后由 yusup 于 2007-12-16 20:32 编辑 ]

周杰伦

建议楼主把样本发上来吧
让我们测试看看吧

[ 本帖最后由 周杰伦 于 2007-12-16 17:10 编辑 ]

yusup

发现了，也报了，我马上就点删除了，没想到时间马上就被改了，而且这家伙还绕过了RETURNIL，真是气人，重启后我扫毒的时候扫出来了。

yusup

那我发上来，其实也就是绅博样本区下的。

绅博周幸

Thank you for your submission. Below you can see the current status of the uploaded files.


--------------------------------------------------------------------------------


We received the following archive files:



File ID  Filename  Size (Byte) Result
3600624  绅博GDATA_AntiViren...ho.rar 22.92 KB OK

A listing of files contained inside archives alongside their results can be found below:

File ID  Filename  Size (Byte) Result
3600625  who.exe  48 KB  UNDER ANALYSIS


Please find a detailed report concerning each individual sample below:

Filename Result
who.exe  UNDER ANALYSIS

The file 'who.exe' has been determined to be 'UNDER ANALYSIS'.


--------------------------------------------------------------------------------
Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.

Graybird

强~
A-Squared  Found nothing
AntiVir  Found HEUR/Malware
ArcaVir  Found nothing
Avast  Found nothing
AVG Antivirus  Found nothing
BitDefender  Found nothing
ClamAV  Found nothing
CPsecure  Found nothing
Dr.Web  Found nothing
F-Prot Antivirus  Found Possibly a new variant of W32/VB-EMU:VB-Downloader-Minimi-based!Maximus
F-Secure Anti-Virus  Found nothing
Fortinet  Found nothing
Ikarus  Found nothing
Kaspersky Anti-Virus  Found nothing
NOD32  Found nothing
Norman Virus Control  Found nothing
Panda Antivirus  Found nothing
Rising Antivirus  Found nothing
Sophos Antivirus  Found Mal/Emogen-B
VirusBuster  Found nothing
VBA32  Found nothing

绅博周幸

原帖由 Graybird 于 2007-12-16 17:19 发表
强~
A-Squared  Found nothing
AntiVir  Found HEUR/Malware
ArcaVir  Found nothing
Avast  Found nothing
AVG Antivirus  Found nothing
BitDefender  Found nothing
ClamAV  Found nothing
CPse ...

这再次说明红伞无需升级即可侦测到大量的未知病毒，启发的优越性啊

hj5abc

who.exe : Not detected by Sandbox (Signature: NO_VIRUS)


[ DetectionInfo ]
    * Sandbox name: NO_MALWARE
    * Signature name: NO_VIRUS
    * Compressed: NO
    * TLS hooks: NO
    * Executable type: Application
    * Executable file structure: OK

[ General information ]
    * Applications uses MSVBVM60.DLL (Visual Basic 6).
    * Form uses id Form.
    * File length:        49152 bytes.
    * MD5 hash: b2992d52e40dcc0b1a25fd937925b35d.

[ Process/window information ]
    * Creates a COM object with CLSID {FCFB3D23-A0FA-1068-A738-08002B3371B5} : VBRuntime.
    * Creates a COM object with CLSID {E93AD7C1-C347-11D1-A3E2-00A0C90AEA82} : VBRuntime6.

无尽藏海

用红伞放心
猜测：改时间加病毒下载

yusup

楼上太自信了吧！当时红伞是报了，我马上就点了删除，可还是中了，看看它带来了什么