Is this file a virus?

SeasMood

Several days ago, I searched on Google for movies and linked to the following page.
Quote
hxxp://powerof3x.com/m6/movie1.php?id=4170
(Be careful if you want to visit this page.)
It prompted me to download a file and execute an ActiveX script.
I download the "setup.exe" file, and then forced to close my IE.
Unfortunately,I forgot this suspicious file in my hard disk. Today, I run the"setup.exe". This file disappeared immediate and nothing happened.
This rouses my conscious. Maybe this is a virus. But I have no way to find it. My Kaspersky didn't detect anything.
I also find some information here: http://tacit.livejournal.com/226180.html  and here http://garwarner.blogspot.com/ about the "powerof3x" site.

I went back and downloaded the "setup.exe" and attached in this post.

I am not an expert, just search Google then find here, please help.

PS. Sorry for all the inconvenience for you to read English in this post, cause my laptop cannot type Chinese at the moment.

nosferatu

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\setup.zip'
C:\Documents and Settings\Administrator\桌面\setup.zip
  [0] Archive type: ZIP
  --> setup.exe.danger!!!!!!!
      [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
      [INFO]      The file was deleted!

ngh55

外国人？能找到卡饭的样本区也够能的。不知道找多引擎查毒的网站？多引擎查你的文件结果：

File:           setup.zip
Status:         INFECTED/MALWARE
MD5:         f76a9f578ddf0e6e48d9a245785f3159
Packers detected:         PE_PATCH.UPX, UPX

A-Squared          Found nothing
AntiVir         ——Found TR/Crypt.CFI.Gen
ArcaVir         Found nothing
Avast         ——Found Win32:Small-IKO
AVG Antivirus         Found nothing
BitDefender         ——Found DeepScan:Generic.Zlob.4C7C72C1
ClamAV         Found nothing
CPsecure         Found nothing
Dr.Web         Found nothing
F-Prot Antivirus         Found nothing
F-Secure Anti-Virus——         Found Trojan.Win32.Small.abv
Fortinet         Found nothing
Ikarus ——Found Virus.Win32.Zlob.ZW
Kaspersky Anti-Virus         ——Found Trojan.Win32.Small.abv
NOD32         Found nothing
Norman Virus Control         Found nothing
Panda Antivirus         Found nothing
Rising Antivirus         Found nothing
Sophos Antivirus         Found nothing
VirusBuster         Found nothing
VBA32         ——Found Downloader.Zlob.3 (probable variant)

绅博周幸

Win32:Small-IKO [Trj]

llgiggs

原帖由 ngh55 于 2008-2-2 05:49 发表
外国人？能找到卡饭的样本区也够能的。不知道找多引擎查毒的网站？多引擎查你的文件结果：

File:           setup.zip
Status:         INFECTED/MALWARE
MD5:         f76a9f578ddf0e6e48d9a245785f3159
Pac ...

So rescanning your computer is preferred Kaspersky has detected it
-------------------------------------------------------------------------------------------------------------------------------------------------

ファイル名 setup.zip 受理 2008.02.02 02:48:22 (CET)

アンチウイルス	バージョン	更新日	結果
AhnLab-V3	2008.2.2.10	2008.02.01	-
AntiVir	7.6.0.61	2008.02.01	TR/Crypt.CFI.Gen
Authentium	4.93.8	2008.02.01	-
Avast	4.7.1098.0	2008.02.01	Win32:Small-IKO
AVG	7.5.0.516	2008.02.01	-
BitDefender	7.2	2008.02.02	DeepScan:Generic.Zlob.4C7C72C1
CAT-QuickHeal	9.00	2008.02.01	-
ClamAV	0.92	2008.02.02	-
DrWeb	4.44.0.09170	2008.02.01	-
eSafe	7.0.15.0	2008.01.28	suspicious Trojan/Worm
eTrust-Vet	31.3.5504	2008.02.01	-
Ewido	4.0	2008.02.01	-
FileAdvisor	1	2008.02.02	-
Fortinet	3.14.0.0	2008.02.01	-
F-Prot	4.4.2.54	2008.02.01	-
F-Secure	6.70.13260.0	2008.02.01	Trojan.Win32.Small.abv
Ikarus	T3.1.1.20	2008.02.02	Virus.Win32.Zlob.ZW
Kaspersky	7.0.0.125	2008.02.02	Trojan.Win32.Small.abv
McAfee	5221	2008.02.01	-
Microsoft	1.3204	2008.02.02	TrojanDownloader:Win32/Zlob
NOD32v2	2844	2008.02.01	-
Norman	5.80.02	2008.02.01	-
Panda	9.0.0.4	2008.02.01	-
Prevx1	V2	2008.02.02	Heuristic: Suspicious File With Outbound Communications
Rising	20.29.22.00	2008.01.30	-
Sophos	4.26.0	2008.02.02	-
Sunbelt	2.2.907.0	2008.02.01	-
Symantec	10	2008.02.02	-
TheHacker	6.2.9.205	2008.02.01	-
VBA32	3.12.6.0	2008.02.02	suspected of Downloader.Zlob.3
VirusBuster	4.3.26:9	2008.02.01	-
Webwasher-Gateway	6.6.2	2008.02.01	Trojan.Crypt.CFI.Gen
追加情報
File size: 10458 bytes
MD5: f76a9f578ddf0e6e48d9a245785f3159
SHA1: d9c95134fb9deab8ce1f147958178fc2d62c4b00
PEiD: -
packers: UPX
packers: UPX
packers: PE_Patch.UPX, UPX
Prevx info: http://info.prevx.com/aboutprogr ... 07D8E12810049F117C6

[ 本帖最后由 llgiggs 于 2008-2-2 10:02 编辑 ]

stonejr

你看看VirScan里的卡巴啥版本...

cici584522

VirScan 感觉都不权威。。同版本的杀软引擎，跟正式软件的查杀结果有时候都不同。。

正式软件都不杀。。它那杀。。。

xxwpk007

F:\SETUP.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:1262
远端地址:85.255.119.242(乌克兰)
远端端口:80

llgiggs

原帖由 stonejr 于 2008-2-2 09:39 发表
你看看VirScan里的卡巴啥版本...

一語驚醒夢中人

leonfg

用VT还是好一点。这个版本老不说，更新还不及时