磁碟机新变种 7F3537

显示全部楼层 · 发表于 2008-2-12 22:42:11

RT… 今天的新变种热腾腾的
卡巴暂时不认识

显示全部楼层 · 发表于 2008-2-12 22:44:07

江民miss，

显示全部楼层 · 发表于 2008-2-12 22:44:59

等了好久，过完年了

给KL

看来不算新变种，还是DR

Hello,

Setup.exe_ - Virus.Win32.Xorer.dr

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Alexander Romanenko
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

> Attachment: Setup.zip

[ 本帖最后由 wangjay1980 于 2008-2-13 16:11 编辑 ]

显示全部楼层 · 发表于 2008-2-12 22:45:59

Starting the file scan:

Begin scan in 'E:\virus\Setup.zip'
E:\virus\Setup.zip
  [0] Archive type: ZIP
  --> Setup.exe
   [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2008-2-12 22:46:37

tarting the file scan:

Begin scan in 'D:\TDdownload\Setup.zip'
D:\TDdownload\Setup.zip
  [0] Archive type: ZIP
  --> Setup.exe
   [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
   [INFO]    The file was deleted!

End of the scan: 2008年2月12日星期二  22:49
Used time: 00:04 min

The scan has been done completely.

   0 Scanning directories
   2 Files were scanned
   1 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes
-.-b，慢了一点

显示全部楼层 · 发表于 2008-2-12 22:48:45

Scan Started Tue Feb 12 22:50:19 2008
-------------------------------------------------------------------------------

----------- SCAN SUMMARY -----------
Known viruses: 189225
Engine version: 0.92
Scanned directories: 0
Scanned files: 1
Skipped non-executable files: 0
Infected files: 0

Data scanned: 0.34 MB
Time: 9.953 sec (0 m 9 s)
--------------------------------------
Completed
--------------------------------------
-.-b，小海螺飘了

显示全部楼层 · 发表于 2008-2-12 22:51:08

Avast 挂了晕 ..

显示全部楼层 · 发表于 2008-2-12 22:52:30

-.-b，忘了升级小海螺了，重新补上
Scan Started Tue Feb 12 22:54:48 2008
-------------------------------------------------------------------------------

----------- SCAN SUMMARY -----------
Known viruses: 207831
Engine version: 0.92
Scanned directories: 0
Scanned files: 1
Skipped non-executable files: 0
Infected files: 0

Data scanned: 0.34 MB
Time: 8.625 sec (0 m 8 s)
--------------------------------------
Completed
--------------------------------------
依然miss

显示全部楼层 · 发表于 2008-2-12 22:53:28

nod32:
扫描进行于：2008-2-12 22:47:08
扫描日志
NOD32版本 2867 (20080212) NT
命令行： C:\Documents and Settings\Administrator\桌面\Setup.zip

日期： 12.2.2008 时间：22:47:10
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\Administrator\桌面\Setup.zip
C:\Documents and Settings\Administrator\桌面\Setup.zip >>ZIP >>Setup.exe - 可能是 Win32/Genetik 木马的一个变种
已扫描的文件数目：1
已发现的病毒数目：1
完成时间： 22:47:11 总扫描时间：1 秒 (00:00:01)

显示全部楼层 · 发表于 2008-2-12 22:54:27

Hello,

Thanks for taking the time to submit your samples to the Norman
Sandbox Information Center.  Customer delight is our top priority at
Norman.  With that in mind we have developed Sandbox Solutions for
organizations that are committed to speedy analysis and debugging.

Norman Sandbox Solutions give your organization the opportunity to
analyze files immediately in your own environment.

To find out how to bring the power of Norman Sandbox into your test
environments follow the links below.

Norman Sandbox Solutions
http://www.norman.com/Product/Sandbox-products/

Norman Sandbox Analyzer
http://www.norman.com/Product/Sandbox-products/Analyzer/

Norman Sandbox Analyzer Pro
http://www.norman.com/Product/Sandbox-products/Analyzer-pro/

Norman SandBox Reporter
http://www.norman.com/Product/Sandbox-products/Reporter/

Setup.exe : Not detected by Sandbox (Signature: NO_VIRUS)

[ DetectionInfo ]
* Sandbox name: NO_MALWARE
* Signature name: NO_VIRUS
* Compressed: YES
* TLS hooks: NO
* Executable type: Application
* Executable file structure: OK

[ General information ]
* Application uses MFC.DLL.
* Decompressing UPX3.
* File length:       95744 bytes.
* MD5 hash: 7f3537dd29d7006d204ebba77770384e.

(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.

This file is not flagged as malicious by the Norman Sandbox Information Center. However, we can not guarantee that the file is harmless. If you still suspect the file to be malicious and if you urgently need to know for sure, please submit it to your local Norman support department for manual analysis.

************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

[病毒样本] 磁碟机新变种 7F3537

本帖子中包含更多资源