10个样本！

chabosh

10个样本！

The EQs

C:\Documents and Settings\Don johnson\桌面\du2.rar » RAR » du2\ad7678.exe » NSIS - incorrect CRC checksum, the file may be damaged
C:\Documents and Settings\Don johnson\桌面\du2.rar » RAR » du2\ad76783.exe » NSIS - archive damaged

sam.to

已隔離: 病毒 Heur.Downloader (修改)        檔案: C:\Documents and Settings\kato9096\桌面\uusee.rar/uusee.exe//PE_Patch.PECompact//PecBundle//PECompact
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Small.suu        檔案: C:\Documents and Settings\kato9096\桌面\du1.rar/du1\a.exe//PE_Patch//UPack

上报到卡巴

曲中求

费尔8

E:\病毒\病毒.rar>>du1\du1\1.EXE        Heuri.Possible/Packed        启发式扫描        还未处理
E:\病毒\病毒.rar>>du1\du1\222.exe        Packed.UPX.a        带壳程序        还未处理
E:\病毒\病毒.rar>>du1\du1\a.exe        TrojanPSW.OnLineGames.wlu.kjdk        木马        还未处理
E:\病毒\病毒.rar>>du2.rar>>du2\abcd.exe        Heuri.Suspicious.ERNM        启发式扫描        还未处理
E:\病毒\病毒.rar>>du2.rar>>du2\abcd[1].exe        Heuri.Suspicious.ERNM        启发式扫描        还未处理
E:\病毒\病毒.rar>>du2.rar>>du2\abcd[2].exe        Heuri.Suspicious.ERNM        启发式扫描        还未处理
E:\病毒\病毒.rar>>du3.rar>>du3\du3\SlientInstall2144.exe        Packed.UPX.a        带壳程序        还未处理
E:\病毒\病毒.rar>>uusee.rar>>uusee.exe        TrojanDownloader.Delf.hro.xofr        木马        还未处理

除去正常启发+正常识别的5个，另外报壳3个+未知2个运行后提示如下：

动态防御测试暂时不进行了，虽然还有病毒预警在后面扛着没事...........累............等哪天手痒了再来.........

[ 本帖最后由 曲中求 于 2008-4-2 01:40 编辑 ]

aerbeisi

[Found possible virus]         <W32/NewMalware-LSU-based!Maximus>        C:\test\d\uusee.exe->(PecBundle)->(PECompact)
[Found possible security risk]         <W32/Heuristic-CSU!Eldorado (damaged, not disinfectable)>        C:\test\d\du1\a.exe

aribeth199

检测到：木马程序 Trojan-Downloader.Win32.Small.suu        URL: http://bbs.kafan.cn/attachment.p ... xe//PE_Patch//UPack

nosferatu

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\du1.rar'
C:\Documents and Settings\Administrator\桌面\du1.rar
  [0] Archive type: RAR
  --> du1\1.EXE
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was deleted!
Begin scan in 'C:\Documents and Settings\Administrator\桌面\du2.rar'
C:\Documents and Settings\Administrator\桌面\du2.rar
  [0] Archive type: RAR
  --> du2\abcd.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
  --> du2\abcd[1].exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
  --> du2\abcd[2].exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
      [INFO]      The file was deleted!
Begin scan in 'C:\Documents and Settings\Administrator\桌面\du3.rar'
C:\Documents and Settings\Administrator\桌面\du3.rar
  [0] Archive type: RAR
  --> du3\du3\SlientInstall2144.exe
      [DETECTION] Contains detection pattern of the dropper DR/Agent.449024
      [INFO]      The file was deleted!
Begin scan in 'C:\Documents and Settings\Administrator\桌面\uusee.rar'
C:\Documents and Settings\Administrator\桌面\uusee.rar
  [0] Archive type: RAR
  --> uusee.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
      [INFO]      The file was deleted!


End of the scan: 星期三 2008年4月2日  02:46
Used time: 00:09 min

The scan has been done completely.

      0 Scanning directories
     14 Files were scanned
      6 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      4 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      8 Files not concerned
      4 Archives were scanned
      0 Warnings
      0 Notes

Starting the file scan:

Begin scan in 'E:\新建文件夹 (2)\1.EXE'
E:\新建文件夹 (2)\1.EXE
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was deleted!
Begin scan in 'E:\新建文件夹 (2)\222.exe'
Begin scan in 'E:\新建文件夹 (2)\a.exe'
Begin scan in 'E:\新建文件夹 (2)\abcd.exe'
E:\新建文件夹 (2)\abcd.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
      [INFO]      The file was deleted!
Begin scan in 'E:\新建文件夹 (2)\abcd[1].exe'
E:\新建文件夹 (2)\abcd[1].exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
      [INFO]      The file was deleted!
Begin scan in 'E:\新建文件夹 (2)\abcd[2].exe'
E:\新建文件夹 (2)\abcd[2].exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
      [INFO]      The file was deleted!
Begin scan in 'E:\新建文件夹 (2)\ad7678.exe'
Begin scan in 'E:\新建文件夹 (2)\ad76783.exe'
Begin scan in 'E:\新建文件夹 (2)\uusee.exe'
E:\新建文件夹 (2)\uusee.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
      [INFO]      The file was deleted!
Begin scan in 'E:\新建文件夹 (2)\SlientInstall2144.exe'
E:\新建文件夹 (2)\SlientInstall2144.exe
      [DETECTION] Contains detection pattern of the dropper DR/Agent.449024
      [INFO]      The file was deleted!


End of the scan: 2008年4月2日  06:08
Used time: 00:08 min

The scan has been done completely.

      0 Scanning directories
     10 Files were scanned
      6 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      6 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      4 Files not concerned
      0 Archives were scanned
      0 Warnings
      0 Notes

[ 本帖最后由 Exia 于 2008-4-2 06:08 编辑 ]

222.exe  22.08 KB  UNDER ANALYSIS
a.exe  10.13 KB  UNDER ANALYSIS
ad7678.exe  126.66 KB  UNDER ANALYSIS
ad76783.exe  77.21 KB  UNDER ANALYSIS

无尽藏海

E:\VIRUS\VIRUS4.2\du1\a.exe: PUA.Packed.UPack-2 FOUND
E:\VIRUS\VIRUS4.2\uusee.exe: Trojan.Downloader.Banload-1494 FOUND