来一个

傻猪猪米走鸡

E:\virus\103[1].zip » ZIP » 103[1].exe - Win32/Anilogo.F worm - was a part of the deleted object
E:\virus\103[1].zip - Win32/Anilogo.F worm - deleted - quarantined

qianwenxiang

http://aniufeihu.16f.cn/wg.exe
偶加个

woai_jolin

Scan Log
Version of virus signature database: 3004 (20080405)
Date: 2008/4/5  Time: 23:16:51
Scanned disks, folders and files: G:\v\103[1].zip
G:\v\103[1].zip » ZIP » 103[1].exe - Win32/Anilogo.F worm - was a part of the deleted object
Number of scanned objects: 2
Number of threats found: 1
Number of cleaned objects: 1
Time of completion: 23:16:52  Total scanning time: 1 sec (00:00:01)

woai_jolin

Threat details:

   Web page:
   http://aniufeihu.16f.cn/wg.exe

   Threat:
   probably a variant of Win32/Genetik trojan

   Comment:
   Access to the web page was blocked by ESET NOD32 Antivirus.

wangjay1980

Hello,

#-T#QQ.exe_

No malicious code was found in this file.

fix.exe_ - Backdoor.Win32.Hupigon.bmvy

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Yury Nesmachny
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: QQ.zip

wangjay1980

原帖由 qianwenxiang 于 2008-4-5 23:09 发表
http://aniufeihu.16f.cn/wg.exe
偶加个

geforce

老毒或者绝大多数都报的，是不是考虑一下不要放出来了。

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\103[1].zip'
C:\Documents and Settings\Administrator\My Documents\
  103[1].zip
    [0] Archive type: ZIP
      --> 103[1].exe
        [1] Archive type: Runtime Packed
        --> Object
            [DETECTION] Contains detection pattern of the worm WORM/Cekar.A
            [WARNING]   Infected files in archives cannot be repaired!
      [NOTE]      The file was deleted!

mofunzone

Starting the file scan:

Begin scan in 'C:\TDDOWNLOAD\yz.rar'
C:\TDDOWNLOAD\
  yz.rar
    [0] Archive type: RAR
    --> yz.exe
Begin scan in 'C:\TDDOWNLOAD\pp.rar'
C:\TDDOWNLOAD\
  pp.rar
    [0] Archive type: RAR
    --> ￅￜￅￜ﾿ﾨﾶﾡﾳﾵﾼￓￋ￙ￍ￢ﾹￒ\ￋﾵￃ￷.txt
    --> ￅￜￅￜ﾿ﾨﾶﾡﾳﾵﾼￓￋ￙ￍ￢ﾹￒ\365KDC.exe
        [DETECTION] Is the Trojan horse TR/PSW.Steal.21761
      [NOTE]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\q.rar'
C:\TDDOWNLOAD\
  q.rar
    [0] Archive type: RAR
    --> fix.exe
        [DETECTION] Is the Trojan horse TR/Downloader.Gen
      [NOTE]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\qq.rar'
C:\TDDOWNLOAD\
  qq.rar
    [0] Archive type: RAR
    --> QQￗﾨￒﾵￋﾢￗ￪ﾵￇ￈￫ￆ￷\ￋﾵￃ￷.txt
    --> QQￗﾨￒﾵￋﾢￗ￪ﾵￇ￈￫ￆ￷\ￌￚ￑ﾶQQ.EXE
        [DETECTION] Contains detection pattern of the worm WORM/Nuj.A.452
      [NOTE]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\wg.exe'
C:\TDDOWNLOAD\
  wg.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.Steal.21666
            [WARNING]   Infected files in archives cannot be repaired!
      [NOTE]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\wg.exe.out.exe'
C:\TDDOWNLOAD\
  wg.exe.out.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!


End of the scan: 2008年4月5日  10:04
Used time: 00:04 min

The scan has been done completely.

      0 Scanning directories
     12 Files were scanned
      5 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      5 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      7 Files not concerned
      4 Archives were scanned
      1 Warnings
      5 Notes

mofunzone

Virus or unwanted program 'BDS/Hupigon.Gen [backdoor]'
detected in file 'C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temp\IXP000.TMP\SERVER~1.EXE.
Action performed: Delete file