mbr rootkit

Nblock

测测

[ 本帖最后由 Nblock 于 2008-1-30 13:48 编辑 ]

Graybird

Starting the file scan:

Begin scan in 'E:\1.rar'
E:\1.rar
  [0] Archive type: RAR
  --> 1.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [WARNING]   The file was ignored!

上报~

dericyeoh

detected: Trojan program Trojan.Win32.Agent.dsj        URL: http://bbs.kafan.cn/attachment.php?aid=190221//1.exe//ASPack

醉一生爱妍

只能用一個詞來形容

猛啊

Nblock

扫描

tracydk

SEP继续挂

mimimi

咖啡pass

tracydk

AhnLab-V3	2008.1.25.11	2008.01.25	-
AntiVir	7.6.0.53	2008.01.25	HEUR/Crypted
Authentium	4.93.8	2008.01.25	-
Avast	4.7.1098.0	2008.01.25	Win32:Agent-QLK
AVG	7.5.0.516	2008.01.24	Generic9.AJBD
BitDefender	7.2	2008.01.25	-
CAT-QuickHeal	9.00	2008.01.24	-
ClamAV	0.91.2	2008.01.25	-
DrWeb	4.44.0.09170	2008.01.25	-
eSafe	7.0.15.0	2008.01.16	-
eTrust-Vet	31.3.5484	2008.01.25	-
Ewido	4.0	2008.01.24	-
FileAdvisor	1	2008.01.25	-
Fortinet	3.14.0.0	2008.01.25	-
F-Prot	4.4.2.54	2008.01.24	-
F-Secure	6.70.13260.0	2008.01.25	Trojan.Win32.Agent.dsj
Ikarus	T3.1.1.20	2008.01.25	Trojan.Win32.Agent.dsj
Kaspersky	7.0.0.125	2008.01.25	Trojan.Win32.Agent.dsj
McAfee	5215	2008.01.24	-
Microsoft	1.3109	2008.01.25	PWS:Win32/Sinowal.gen!C
NOD32v2	2821	2008.01.25	-
Norman	5.80.02	2008.01.24	-
Panda	9.0.0.4	2008.01.24	Suspicious file
Prevx1	V2	2008.01.25	-
Rising	20.28.41.00	2008.01.25	-
Sophos	4.25.0	2008.01.25	Mal/Sinowa-A
Sunbelt	2.2.907.0	2008.01.25	-
Symantec	10	2008.01.25	-
TheHacker	6.2.9.196	2008.01.23	-
VBA32	3.12.2.5	2008.01.21	-
VirusBuster	4.3.26:9	2008.01.24	-
Webwasher-Gateway	6.6.2	2008.01.25	Heuristic.Crypted

spatra

Begin scan in 'C:\Documents and Settings\Administrator\桌面\1.rar'
C:\Documents and Settings\Administrator\桌面\1.rar
  [0] Archive type: RAR
  --> 1.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [INFO]      The file was deleted!

写入引导区，现在的病毒看来越来越猛了

[ 本帖最后由 spatra 于 2008-1-25 18:32 编辑 ]

Graybird

The file '1.exe' has been determined to be 'MALWARE'. Our analysts discovered that the file is a Trojan. In general this kind of programs contains harmful functionality called payload. Detection will be added to our virus definition file (VDF) with one of the next updates. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Crypted.