[02.20]过众多杀毒软件的一个病毒

rest1min

样本转自江民社区：

扫描结果如下：

扫描结果 :

14%的杀软(5/36)报告发现病毒

软件名称	引擎版本	病毒库版本	病毒库时间	扫描结果	时间
a-squared	3.0.0.126	2008.02.19	2008-02-19	-	5.840
AntiVir	7.6.0.67	7.0.2.167	2008-02-20	HEUR/Malware	20.017
Arcavir	1.0.4	200802201110	2008-02-20	-	19.898
AVAST	1.0.8	080219-0	2008-02-19	-	32.739
AVG	7.5.51.442	269.20.8/1289	2008-02-20	-	14.502
BitDefender	7.60825.982491	7.17630	2008-02-20	Generic.Malware.Sdld!!.28EF2B92	27.083
CA (VET)	9.0.0.143	31.3.5550	2008-02-20	-	17.365
ClamAV	0.92	5893	2008-02-20	-	0.027
Comodo	2.11	2.0.0.441	2008-02-20	-	2.431
CP Secure	1.1.0.695	2008.02.15	2008-02-15	-	50.067
Dr.WEB	4.44.0.9170	2008.02.20	2008-02-20	DLOADER.Trojan	34.577
ewido	4.0.0.2	2008.02.20	2008-02-20	-	4.427
F-PROT	4.4.1.52	20080218	2008-02-18	-	17.321
F-SECURE	5.51.6100	2008.02.20.05	2008-02-20	-	15.493
IKARUS	T3.1.01.20	2008.02.18.70329	2008-02-18	-	10.789
Microsoft	1.3204	2008.02.20	2008-02-20	-	9.029
MKS_VIR	2.01	2008.02.17	2008-02-17	-	24.990
NORMAN	5.91.10	5.90	2008-02-18	-	50.077
nProtect	2008-02-19.00	1172805	2008-02-19	Generic.Malware.Sdld!!.28EF2B92	7.809
Prevx	V2	20080220	2008-02-20	-	6.680
QuickHeal	9.00	2008.02.20	2008-02-20	-	4.666
SOPHOS	2.70.1	4.26	2008-02-20	-	0.000
The Hacker	6.2.9	v00224	2008-02-19	-	2.214
VBA32	3.12.6.1	20080219.2304	2008-02-19	-	9.999
ViRobot	20080220	2008.02.20	2008-02-20	-	3.736
VirusBuster	4.3.19:9	9.121.16/11.0	2008-02-18	-	0.000
卡巴斯基	5.5.10	2008.02.20	2008-02-20	-	50.125
安博士V3	2008.02.19.00	2008.02.19	2008-02-19	-	6.287
江民杀毒	10.00.650	2008.02.19	2008-02-19	-	3.298
熊猫卫士	9.04.03.0001	2008.02.19	2008-02-19	-	8.355
瑞星	20.0	20.32.11.00	2008-02-19	-	3.700
赛门铁克	1.3.0.24	20080219.003	2008-02-19	-	0.358
趋势	8.500-1001	5.116.05	2008-02-20	-	0.042
迈克菲	5.2.00	5232	2008-02-18	-	17.277
金山毒霸	2007.6.20.249	2008.2.21	2008-02-21	-	2.805
飞塔	2.81-3.11	8.773	2008-02-20	Suspicious	4.388

[ 本帖最后由 rest1min 于 2008-2-21 00:03 编辑 ]

Graybird

The file 'virus.exe' has been determined to be 'UNDER ANALYSIS'.

上报~

无尽藏海

速度太快了

丢给卡巴了

lomo

小红伞报可疑，但是没有确诊~

Start of the scan: 2008年2月20日  23:52

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Owner\桌面\VIRUS-11.rar'
C:\Documents and Settings\Owner\桌面\VIRUS-11.rar
  [0] Archive type: RAR
  --> VIRUS-11\virus.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      A backup was created as '480e4cf7.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!


End of the scan: 2008年2月20日  23:52
Used time: 00:04 min

The scan has been done completely.

      0 Scanning directories
      3 Files were scanned
      0 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

[ 本帖最后由 lomo 于 2008-2-20 23:55 编辑 ]

moonsilver

很久没给瑞星发东西了，发过去看看

taiw_1144

wolffshen

没在SBie里跑起来，不知道是不是原文件有问题
问题签名:
  问题事件名称:        APPCRASH
  应用程序名:        virus.exe
  应用程序版本:        0.0.0.0
  应用程序时间戳:        47a89b3c
  故障模块名称:        virus.exe
  故障模块版本:        0.0.0.0
  故障模块时间戳:        47a89b3c
  异常代码:        c0000005
  异常偏移量:        0000103e
  OS 版本:        6.0.6000.2.0.0.256.6
  区域设置 ID:        2052
  其他信息 1:        ea5e
  其他信息 2:        1669b0ca334c375ce029acfb3dd739e8
  其他信息 3:        b3ab
  其他信息 4:        a6fa88aa64ed45dea75def09ac2a58b6

ctx0705

File  'C:\Users\Desktop\VIRUS-11.rar' was sent to ESET for analysis.

挪威的冬天

难道再没有还原的情况下实际跑？

用微点也不能那么嚣张呀。。。

傻猪猪米走鸡

结果出来了吗？