新年快乐 附赠样本及衍生物

红心王子

在番茄花园bbs上软件区的一个东东

身份证的生成器，运行后微点报警

Graybird

Starting the file scan:

Begin scan in 'E:\SVCHOST.rar'
E:\SVCHOST.rar
  [0] Archive type: RAR
  --> SVCHOST.RA
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
      [INFO]      The file was deleted!
Begin scan in 'E:\身份证生成器V1.1.rar'
E:\身份证生成器V1.1.rar
  [0] Archive type: RAR
  --> Éí·ÝÖ¤Éú³ÉÆ÷V1.1.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [WARNING]   The file was ignored!

上报~

[ 本帖最后由 Graybird 于 2008-2-8 11:37 编辑 ]

leonfg

Virus check with G DATA AntiVirus
Version 18.2.7318.595
Virus signature dated 2/8/2008
Start time: 2/8/2008 11:37
Engine(s): Engine A (AVK 18.2695), Engine B (AVKB 18.127)
Heuristics: On
Archive: On
System areas: On

Check system areas...
Check the following directories and files:
  C:\Documents and Settings\GUNDAM\桌面\身份证生成器V1.1\
  C:\Documents and Settings\GUNDAM\桌面\SVCHOST\

Object: 身份证生成器V1.1.exe
        Path: C:\Documents and Settings\GUNDAM\桌面\身份证生成器V1.1
        Status: Virus detected
        Virus: Win32:PcClient-NM [Trj] (Engine B)
Object: SVCHOST.RA
        Path: C:\Documents and Settings\GUNDAM\桌面\SVCHOST
        Status: Virus detected
        Virus: Win32:Virtualizer [Cryp] (Engine B)

Analysis performed in full: 2/8/2008 11:37
    2 files checked
    2 infected files detected
    0 suspicious files found

28654621

费尔认识

D:\download\SVCHOST.rar>>SVCHOST.RA        Backdoor.Hupigon.ausq.cyhh        后门        还未处理
D:\download\身份证生成器V1.1.rar>>身份证生成器V1.1.exe        TrojanDropper.Joiner.bq.dwgk        木马        还未处理

[ 本帖最后由 28654621 于 2008-2-8 20:13 编辑 ]

spaceplane

avast 全报

做坏事的东西不少都带毒

dd2006

扫描系统区域...
扫描所选择的目录和文件...
对象: SVCHOST.RA
        在压缩档案里: C:\Documents and Settings\Administrato\桌面\样本\SVCHOST.rar
        状态: 已发现病毒
        病毒: Win32:Virtualizer [Cryp] (AVAST! 引擎)
对象: SVCHOST.rar
        路径: C:\Documents and Settings\Administrato\桌面\样本
        状态: 已发现病毒
        病毒: Win32:Virtualizer [Cryp] (AVAST! 引擎)
对象: 身份证生成器V1.1.exe
        在压缩档案里: C:\Documents and Settings\Administrato\桌面\样本\身份证生成器V1.1.rar
        状态: 已发现病毒
        病毒: Win32:PcClient-NM [Trj] (AVAST! 引擎)
对象: 身份证生成器V1.1.rar
        路径: C:\Documents and Settings\Administrato\桌面\样本
        状态: 已发现病毒
        病毒: Win32:PcClient-NM [Trj] (AVAST! 引擎)
分析完成: 2/8/2008 11:48
    已扫描 2 个文件
    已发现 2 个染毒文件
    发现 0 个可疑文件


Starting the file scan:
Begin scan in 'C:\Documents and Settings\Administrato\桌面\样本'
C:\Documents and Settings\Administrato\桌面\样本\SVCHOST.rar
  [0] Archive type: RAR
  --> SVCHOST.RA
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
      [WARNING]   The file was ignored!
C:\Documents and Settings\Administrato\桌面\样本\身份证生成器V1.1.rar
  [0] Archive type: RAR
  --> Éí·ÝÖ¤Éú³ÉÆ÷V1.1.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [WARNING]   The file was ignored!


End of the scan: 2008年2月8日  11:52
Used time: 00:14 min

The scan has been done completely.

      1 Scanning directories
      4 Files were scanned
      1 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      2 Archives were scanned
      2 Warnings
      0 Notes

[ 本帖最后由 dd2006 于 2008-2-8 11:52 编辑 ]

天灰

大蜘蛛两个都miss

hj5abc

Avast 就爱放冷枪 ..

wang.yi

瑞星2个都没报

无尽藏海

ESET 飘
2008-2-8 12:00:04        Kernel        File  'F:\virus\SVCHOST.rar' was sent to ESET for analysis.       
2008-2-8 11:59:46        Kernel        File  'F:\virus\身份证生成器V1.1.rar' was sent to ESET for analysis.