一个过卡巴等多数杀软的病毒

woai_jolin

终于看见多引擎上norman sandbox found

woai_jolin

2008/2/16 13:07:50        Real-time file system protection        file        G:\v\mf.exe        probably unknown NewHeur_PE virus        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.

woai_jolin

Hello,

Thanks for taking the time to submit your samples to the Norman
Sandbox Information Center.  Customer delight is our top priority at
Norman.  With that in mind we have developed Sandbox Solutions for
organizations that are committed to speedy analysis and debugging.

Norman Sandbox Solutions give your organization the opportunity to
analyze files immediately in your own environment.

To find out how to bring the power of Norman Sandbox into your test
environments follow the links below.

Norman Sandbox Solutions
http://www.norman.com/Product/Sandbox-products/

Norman Sandbox Analyzer
http://www.norman.com/Product/Sandbox-products/Analyzer/

Norman Sandbox Analyzer Pro
http://www.norman.com/Product/Sandbox-products/Analyzer-pro/

Norman SandBox Reporter
http://www.norman.com/Product/Sandbox-products/Reporter/

mf.exe : INFECTED with W32/Downloader (Signature: NO_VIRUS)


[ DetectionInfo ]
    * Sandbox name: W32/Downloader
    * Signature name: NO_VIRUS
    * Compressed: NO
    * TLS hooks: YES
    * Executable type: Application
    * Executable file structure: OK

[ General information ]
    * Creating several executable files on hard-drive.
    * File length:        35298 bytes.
    * MD5 hash: 2f38e50f5d8a2f5cf12e8b08df58b809.

[ Changes to filesystem ]
    * Creates file C:\down.txt.
    * Creates file C:\new.exe.
    * Deletes file C:\new.exe.

[ Network services ]
    * Downloads file from http://www.hjiuy.com/j.txt as C:\down.txt.
    * Connects to "www.hjiuy.com" on port 80.
    * Opens URL: www.hjiuy.com/j.txt.
    * Downloads file from MZP as C:\new.exe.
    * Connects to "MZP" on port 80.
    * Opens URL: MZP/.
    * Downloads file from $7 as C:\new.exe.
    * Connects to "$7" on port 80.
    * Opens URL: $7/.
    * Downloads file from  as C:\new.exe.
    * Connects to "" on port 80.
    * Opens URL: /.
    * Downloads file from ñ* Á «±UÉ£(#4s?s3í¶ as C:\new.exe.
    * Connects to "ñ* Á «±UÉ£(#4s?s3í¶" on port 80.
    * Opens URL: ñ* Á «±UÉ£(#4s?s3í¶/.
    * Downloads file from &Aring;&Ntilde;+|"<&frac12;
&macr;T.&cent;-R,'Iù&pound;?"B~.&frac34;. q&icirc;F~&Igrave;&Aacute;&cent;&Ograve;&aring;j>ùa$&Igrave; U&frac12;&laquo;&Euml;<á&ccedil;y&Ecirc;;+&acirc;E9&AElig;o&Uuml;&ouml;>&Agrave;&Ccedil;&Oslash; T:&aring;B&Egrave;h as C:\new.exe.
    * Connects to "&Aring;&Ntilde;+|"<&frac12;
&macr;T.&cent;-R,'Iù&pound;?"B~.&frac34;. q&icirc;F~&Igrave;&Aacute;&cent;&Ograve;&aring;j>ùa$&Igrave; U&frac12;&laquo;&Euml;<á&ccedil;y&Ecirc;;+&acirc;E9&AElig;o&Uuml;&ouml;>&Agrave;&Ccedil;&Oslash; T:&aring;B&Egrave;h" on port 80.
    * Opens URL: &Aring;&Ntilde;+|"<&frac12;
&macr;T.&cent;-R,'Iù&pound;?"B~.&frac34;. q&icirc;F~&Igrave;&Aacute;&cent;&Ograve;&aring;j>ùa$&Igrave; U&frac12;&laquo;&Euml;<á&ccedil;y&Ecirc;;+&acirc;E9&AElig;o&Uuml;&ouml;>&Agrave;&Ccedil;&Oslash; T:&aring;B&Egrave;h/.

[ Security issues ]
    * Starting downloaded file - potential security problem.

[ Process/window information ]
    * Creates process "C:\new.exe".

[ Signature Scanning ]
    * C:\down.txt (4096 bytes) : no signature detection.
    * C:\new.exe (8192 bytes) : no signature detection.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

gho

卡巴报了，咖啡miss

gho

原帖由 woai_jolin 于 2008-2-16 13:09 发表
终于看见多引擎上norman sandbox found

支持哦，我只用过FS

啊弥陀佛

啥都没做

woai_jolin

哪个网站估计要用代理才可以上
所以运行后这个病毒无法下载其他的病毒

said411f

AVG 8.0 有报阿~~

"Scan started:";"2008年2月16日 星期六, 下午 02:18:17"
"Total object scanned:";"2"
"Time needed:";"less than one second"
"Errors encountered:";"0"

"Infections"
"File";"Infection";"Result"
"F:\mf.rar:\mf.exe";"Trojan horse Generic9.BBRD";"Moved to Virus Vault"
"F:\mf.rar";"Trojan horse Generic9.BBRD";"Moved to Virus Vault"

allinwonderi

ArcaMicroScan 的确没报！

hlx98007

deleted: Trojan program Trojan-Downloader.Win32.Delf.esm        File: C:\Virus\mf.rar/mf.exe//NeoLite