!update-4495[1].rar

mofunzone

File:	!update-4495[1].rar
Status:	INFECTED/MALWARE
MD5:	c7d248ac4b537e1cd891c99cdc51b541
Packers detected:	PE_PATCH.UPX, UPX
Bit9 reports:	File not found
Scanner results
Scan taken on 25 Jan 2008 08:02:46 (GMT)
A-Squared	Found nothing
AntiVir	Found HEUR/Malware
ArcaVir	Found nothing
Avast	Found Win32:PurityScan-Q
AVG Antivirus	Found nothing
BitDefender	Found nothing
ClamAV	Found nothing
CPsecure	Found nothing
Dr.Web	Found nothing
F-Prot Antivirus	Found nothing
F-Secure Anti-Virus	Found Trojan-Downloader.Win32.PurityScan.fk
Fortinet	Found W32/PurityScan.FK!tr.dldr
Ikarus	Found Trojan-Downloader.Win32.PurityScan.eg
Kaspersky Anti-Virus	Found Trojan-Downloader.Win32.PurityScan.fk
NOD32	Found probably a variant of Win32/TrojanDownloader.PurityScan (probable variant)
Norman Virus Control	Found nothing
Panda Antivirus	Found nothing
Rising Antivirus	Found nothing
Sophos Antivirus	Found Mal/Heuri-E
VirusBuster	Found Trojan.DL.CLSpring.Gen
VBA32	Found Trojan-Downloader.Win32.PurityScan.fk

zwl2828

C:\Users\Wesley\Downloads\!update-4495[1].rar
  [0] Archive type: RAR
  --> !update-4495[1].0000
      [DETECTION] Contains suspicious code HEUR/Malware

鱼是一只我

江民 过～～～～～～～～～～

Nblock

协议类型:TCP
本地地址:0.0.0.0
本地端口:2944
远端地址:63.251.135.26(美国)
远端端口:80

程序:
E:\!UPDATE-4495[1].EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\ΑDOBE\REGEDIT.EXE
是否删除木马程序及其衍生物?

Graybird

The file '!update-4495[1].0000' has been determined to be 'MALWARE'. Our analysts named the threat TR/Dldr.PurityScan.FK. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Malware.

BING126

McAfee  MISS

tracydk

冷冷

[ 本帖最后由 冷_冷 于 2008-1-25 20:32 编辑 ]

qigang

rising20.28.42暂时未杀！