1个样本，kis7 pass

今取现在

1个样本，kis7 pass，直接扫描不到，但是运行之后报风险，拒绝之后报4个生成物

MD5 :

ed2dfd6241ee713eae0c6594df1aeab7

a-squared	3.0.0.126	2007.12.20	2007-12-20	-	3.007
AntiVir	7.6.0.46	7.0.1.137	2007-12-21	TR/BHO.Delf.G	2.275
Arcavir	1.0.4	200712191753	2007-12-19	-	2.105
AVAST	1.0.8	071218-0	2007-12-18	Win32:Baidubar-B [Trj]	3.110
AVG	7.5.49.442	269.17.6/1192	2007-12-21	Generic9.AGMM	2.123
BitDefender	7.60825.961479	7.16405	2007-12-20	-	5.934
CA (VET)	9.0.0.143	31.3.5393	2007-12-21	-	12.908
ClamAV	0.91.2	5186	2007-12-20	-	0.003
Comodo	2.11	2.0.0.380	2007-12-21	-	0.826
CP Secure	1.1.0.655	2007.12.20	2007-12-20	-	4.898
Dr.WEB	4.44.0.9170	2007.12.20	2007-12-20	-	4.073
ewido	4.0.0.2	2007.12.20	2007-12-20	-	1.986
F-PROT	4.4.1.52	20071219	2007-12-19	Possible W32/Heuristic-162!Eldorado (not disinfectable)	1.554
F-SECURE	5.51.6100	2007.12.19.02	2007-12-19	-	3.125
IKARUS	T3.1.01.15	2007.12.21.70028	2007-12-21	Virus.Win32.Baidubar.B	1.187
MKS_VIR	2.01	2007.12.19	2007-12-19	-	2.526
NOD32	2.70.10	2736	2007-12-20	-	4.701
NORMAN	5.91.08	5.90	2007-12-18	W32/Malware.BJLA	5.950
nProtect	2007-12-21.00	1097760	2007-12-21	-	4.960
Prevx	V2	20071221	2007-12-21	TROJAN.DOWNLOADER.GEN	23.790
QuickHeal	9.00	2007.12.20	2007-12-20	-	2.558
SOPHOS	2.49.1	4.21	2007-12-20	-	6.121
The Hacker	6.2.9	v00166	2007-12-20	-	0.921
VBA32	3.12.2.5	20071219.2104	2007-12-19	-	3.022
ViRobot	20071221	2007.12.21	2007-12-21	-	0.413
VirusBuster	4.3.19:9	9.117.7/11.0	2007-12-19	-	1.541
卡巴斯基	5.5.10	2007.12.21	2007-12-21	-	5.007
安博士V3	2007.12.21.01	2007.12.21	2007-12-21	-	0.918
江民杀毒	10.00.650	2007.12.20	2007-12-20	AdWare.EJok.a	1.139
熊猫卫士	9.04.03.0001	2007.12.20	2007-12-20	Suspicious file	3.467
瑞星	19.0	20.23.41.00	2007-12-21	-	1.731
赛门铁克	1.3.0.24	20071219.007	2007-12-19	-	0.728
趋势	8.500-1001	4.902.14	2007-12-21	-	3.103
迈克菲	5.2.00	5189	2007-12-19	-	7.039
金山毒霸	2007.6.20.249	2007.12.21	2007-12-21	-	0.938
飞塔	2.81-3.11	8.449	2007-12-03	-	0.259

Love=卡巴+费尔

费尔

袋鼠吱吱

这个McAfee是报的，属于下载者

文件 D:\病毒样本备份\Skype3053\Skype3053.exe 包含 Generic Downloader.p 特洛伊。已成功删除该文件。

1688388728

2007-12-21 23:45:32    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\Skype3053\Skype3053.exe
文件路径:C:\WINDOWS\system32\vttoiwctew.dll
触发规则:所有程序规则->文件规则->%systemdrive%\*.dll


2007-12-21 23:45:32    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\Skype3053\Skype3053.exe
文件路径:C:\WINDOWS\system32\SkypeClient.exe
触发规则:黑名单->文件保护->?:\*.exe

剑书

Start of the scan: 2007年12月21日  23:48

Starting the file scan:

Begin scan in 'K:\Skype3053.rar'
K:\Skype3053.rar
  [0] Archive type: RAR
  --> Skype3053.exe
      [DETECTION] Is the Trojan horse TR/BHO.Delf.G
      [INFO]      A backup was created as '47e4e09b.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!

wangjay1980

0

dongqiang

卡巴报了是广告程序

keyman1023

还没下完就拦下来了，小A！

Joker

detected: adware not-a-virus:AdWare.Win32.Ejik.s        File: D:\Downloads\Compressed\Skype3053.rar/Skype3053.exe//PE_Patch.PECompact//PecBundle//PECompac

qigang

Rising20.23.51未杀！