Expiro.Virus

qianwenxiang

感染EXE的 感染的时候资源占用挺少 感染时同时生成一个与被感染文件同名的.IVR文件
exepiro.exe.vir : 感染源
剩余exe : 被感染的

Nblock

被微点拦截了

zwl2828

C:\Users\Wesley\Downloads\system32.rar
  [0] Archive type: RAR
  --> notepad.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Expiro.B
  --> osk.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Expiro.B
  --> rcimlby.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Expiro.B
  --> mobsync.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Expiro.B
  --> EXPIRO.exe.vir
      [DETECTION] Contains detection pattern of the Windows virus W32/Expiro.B

lx1234

Begin scan in 'C:\Documents and Settings\Administrator\桌面\system32.rar'
C:\Documents and Settings\Administrator\桌面\system32.rar
  [0] Archive type: RAR
  --> notepad.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Expiro.B
  --> osk.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Expiro.B
  --> rcimlby.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Expiro.B
  --> mobsync.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Expiro.B
  --> EXPIRO.exe.vir
      [DETECTION] Contains detection pattern of the Windows virus W32/Expiro.B
      [INFO]      The file was deleted!

The EQs

system32.rar » RAR » notepad.exe - Win32/Expiro.E virus
system32.rar » RAR » osk.exe - Win32/Expiro.E virus
system32.rar » RAR » rcimlby.exe - Win32/Expiro.E virus
system32.rar » RAR » mobsync.exe - Win32/Expiro.E virus
system32.rar » RAR » EXPIRO.exe.vir - Win32/Expiro.E virus

Nblock

FD能判断病毒行为 拦截病毒行为 还能连根清除病毒和病毒的衍生物

Graybird

Starting the file scan:

Begin scan in 'E:\样本.rar'
E:\样本.rar
  [0] Archive type: RAR
  --> MAGNIFY.IVR
      [DETECTION] Contains detection pattern of the Windows virus W32/Expiro.B
  --> UTILMAN.EXE
      [DETECTION] Contains detection pattern of the Windows virus W32/Expiro.B
      [INFO]      The file was deleted!

woai_jolin

Scan Log
Version of virus signature database: 2821 (20080124)
Date: 2008-1-25  Time: 17:49:55
Scanned disks, folders and files: G:\v\system32.rar
G:\v\system32.rar » RAR » notepad.exe - Win32/Expiro.E virus - was a part of the deleted object
G:\v\system32.rar » RAR » osk.exe - Win32/Expiro.E virus - was a part of the deleted object
G:\v\system32.rar » RAR » rcimlby.exe - Win32/Expiro.E virus - was a part of the deleted object
G:\v\system32.rar » RAR » mobsync.exe - Win32/Expiro.E virus - was a part of the deleted object
G:\v\system32.rar » RAR » EXPIRO.exe.vir - Win32/Expiro.E virus - was a part of the deleted object
Number of scanned objects: 6
Number of threats found: 5
Time of completion: 17:49:55  Total scanning time: 0 sec (00:00:00)

ballakay

Scanning Report
25 January 2008 17:59:38 - 17:59:39
Computer name: PUMA-PC
Scanning type: Scan target
Target: C:\Users\Administrator\Desktop\system32.rar


--------------------------------------------------------------------------------

Result: 5 malware found
Virus.Win32.Drubis.b (virus)
C:\Users\Administrator\Desktop\system32.rar\notepad.exe
C:\Users\Administrator\Desktop\system32.rar\osk.exe
C:\Users\Administrator\Desktop\system32.rar\rcimlby.exe
C:\Users\Administrator\Desktop\system32.rar\mobsync.exe
Trojan-PSW.Win32.LdPinch.esg (virus)
C:\Users\Administrator\Desktop\system32.rar\EXPIRO.exe.vir




--------------------------------------------------------------------------------

Statistics
Scanned:
Files: 6
Not scanned: 0
Result:
Viruses: 5
Spyware: 0
Suspicious items: 0
Riskware: 0
Actions:
Disinfected: 0
Renamed: 0
Deleted: 0
Quarantined: 0
Failed: 0
Boot Sectors:
Scanned: 0
Infected: 0
Suspicious items: 0
Disinfected: 0


--------------------------------------------------------------------------------

Options
Definitions version:
Viruses: 2008-01-25_02
Spyware: 2008-01-25_02
Scanning Engines:
F-Secure AVP: 7.00.171, 2008-01-25
F-Secure Libra: 2.04.01, 2008-01-24
F-Secure Orion: 1.02.37, 2008-01-25
F-Secure Draco: 1.00.35, 2008-01-14
Scanning options:
Scan all files
Scan inside archives
Actions:
Viruses: Delete infected files
Spyware: Delete infected files

hj5abc

Win32:Expiro X 5 . avast.