看看有多少不是报启发的(更新下载来的东西)

zzh161

样本：

加载驱动，啥啥啥的

C:\WINDOWS\system32\dllcache\figaro.sys
C:\WINDOWS\drivers\beep.sys
C:\WINDOWS\system32\dllcache\beep.sys
C:\WINDOWS\system32\drivers\beep.sys
C:\WINDOWS\system32\drivers\beep.sys
C:\WINDOWS\system32\braviax.exe

真的很国外，连下载者下来的都是pkg。。。。

样本1：

样本2：太大了，给个地址：http://system-defender.com/demo/systemdefender.pkg

[ 本帖最后由 zzh161 于 2008-2-14 12:09 编辑 ]

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\install.rar'
C:\Documents and Settings\Administrator\My Documents\
  install.rar
  install.rar:Zone.Identifier
    [0] Archive type: RAR
    --> install.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!

IllusionWing

果真启掉了。。不过是加密

leonfg

FS
第一个过，机子被重启

第二个报
Trojan-Downloader.Win32.Adload.ma (病毒)

• C:\Documents and Settings\GUNDAM\桌面\SystemDefender_Installer.rar\SystemDefender_Installer.exe

pkg:
Hello,

Thank you for the sample that you sent to us.

The file you submitted is not an executable file, detection is not created for non-executables.

Should you have further concerns, please do not hesitate to e-mail us again.

Have a nice day!

--
F-Secure Security Labs              http://www.f-secure.com/weblog/
F-Secure Corporation                http://www.f-secure.com/
BE SURE.



ESET
probably unknown NewHeur_PE virus
probably a variant of Win32/TrojanDownloader.Adload

[ 本帖最后由 leonfg 于 2008-2-14 13:29 编辑 ]

Joker

1  The requested object is INFECTED. The following viruses Heur.Trojan.Generic were found
2  名字爆出来了。，
The requested object is INFECTED. The following viruses Trojan-Downloader.Win32.Adload.ma were found

[ 本帖最后由 dark1109 于 2008-2-14 12:18 编辑 ]

sam.to

第一不报，上报
第二：已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Adload.ma        檔案: C:\Documents and Settings\kato9096\桌面\SystemDefender_Installer.rar/SystemDefender_Installer.exe//PE_Patch.UPX//UPX

28654621

install 费尔不认识

install.rar         47.14/47.14KB       100.00%    病毒举报      它是一个“木马”    2008-2-14 13:03:51   2008-2-14 13:03:51
  



D:\download\SystemDefender_Installer.rar>>SystemDefender_Installer.exe        TrojanDownloader.Adload.ma.fihk        木马        还未处理

gho

Scanning Report
14 February 2008 13:06:01 - 13:06:06
Computer name: CN-89FF4B9EA4D6
Scanning type: Scan target
Target: E:\Documents and Settings\Administrator\×ÀÃæ\SystemDefender_Installer.exe


--------------------------------------------------------------------------------

Result: 1 malware found
Trojan-Downloader.Win32.Adload.ma (virus)
E:\Documents and Settings\Administrator\×ÀÃæ\SystemDefender_Installer.exe Action: quarantined

FBAV

MicroVita AntiSpyware 100 C
_____________________________________________
                                          
             风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]                  
                   http://221.10.254.214/
----------------------------------------------
开始扫描……


正在检查启动……
[C:\Documents and Settings\Administrator\桌面\Virus\install\install.exe]
                    …………发现Spy！报告:[1] Win32.Nop UPX
文件信息:  大小:48640  MD5:1aa8bdad73dd778ec7f216839d40ca82


文件数:2   病毒数:1  比重:0.5
OK  扫描完毕！

  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎   
[2] 文件特征码引擎
[1] 文件启发式引擎

woai_jolin

2008/2/14 13:05:15        Real-time file system protection        file        G:\v\SystemDefender_Installer.exe        probably a variant of Win32/TrojanDownloader.Adload trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.