[病毒样本] one

显示全部楼层 · 发表于 2008-2-13 15:44:20

费尔扫不到~连动态防御都过了~

但是在线扫描说它是一个木马~

[ 本帖最后由 tvuser2007 于 2008-2-13 15:46 编辑 ]

显示全部楼层 · 发表于 2008-2-13 15:44:46

IK
I:\virus\index.rar:\index.exe - Signature 'Virus.Win32.Zlob.ZW' found
I:\virus\index.rar

2 Files scanned
(1 Archiv with 1 file)
1 Signature found
0 Suspect code-parts found
Used time: 0:00.015

显示全部楼层 · 发表于 2008-2-13 15:45:57

Starting the file scan:

Begin scan in 'E:\virus\index.rar'
E:\virus\index.rar
  [0] Archive type: RAR
  --> index.exe
   [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2008-2-13 15:46:04

金山 miss

显示全部楼层 · 发表于 2008-2-13 15:49:08

试图访问远端地址
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.188\INDEX.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:3670
远端地址:85.255.119.242(乌克兰)
远端端口:80

显示全部楼层 · 发表于 2008-2-13 15:49:44

eset pass

显示全部楼层 · 发表于 2008-2-13 15:49:52

Hello,

Thanks for taking the time to submit your samples to the Norman
Sandbox Information Center.  Customer delight is our top priority at
Norman.  With that in mind we have developed Sandbox Solutions for
organizations that are committed to speedy analysis and debugging.

Norman Sandbox Solutions give your organization the opportunity to
analyze files immediately in your own environment.

To find out how to bring the power of Norman Sandbox into your test
environments follow the links below.

Norman Sandbox Solutions
http://www.norman.com/Product/Sandbox-products/

Norman Sandbox Analyzer
http://www.norman.com/Product/Sandbox-products/Analyzer/

Norman Sandbox Analyzer Pro
http://www.norman.com/Product/Sandbox-products/Analyzer-pro/

Norman SandBox Reporter
http://www.norman.com/Product/Sandbox-products/Reporter/

index.exe : Not detected by Sandbox (Signature: W32/Zlob.gen102)

[ DetectionInfo ]
* Sandbox name: NO_MALWARE
* Signature name: W32/Zlob.gen102
* Compressed: YES
* TLS hooks: NO
* Executable type: Application
* Executable file structure: OK

[ General information ]
* Decompressing UPX3.
* File length:       16384 bytes.
* MD5 hash: 9fe7393636f658548814ceb36836b3dc.

(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.

************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

显示全部楼层 · 发表于 2008-2-13 15:50:36

AVAST miss

显示全部楼层 · 发表于 2008-2-13 15:56:35

KL收

Hello.

New malicious software was found in the attached file.
It's detection will be included in the next update. Thank you for your help.

--
Regards, Ilya Goncharov
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com http://www.viruslist.com

> Attachment: index.rar

[ 本帖最后由 wangjay1980 于 2008-2-13 17:31 编辑 ]

[病毒样本] one

本帖子中包含更多资源