急待鉴定

moonsilver

急待鉴定

allinwonderi

Suspicious Files and Miscellaneous Uploads

Thank you for your submission. Below you can see the current status of the uploaded files.

We received the following archive files:
File ID          Filename         Size (Byte)         Result
25018578          下载.rar         22.24 KB         OK

A listing of files contained inside archives alongside their results can be found below:
File ID          Filename         Size (Byte)         Result
25018579          userinit.exe          16.48 KB          MALWARE
2250676          usrinit.exe          10.86 KB          MALWARE


Please find a detailed report concerning each individual sample below:
Filename         Result
userinit.exe          MALWARE

The file 'userinit.exe' has been determined to be 'MALWARE'. Detection is added to our virus definition file (VDF) starting with version 7.00.01.38.
Filename         Result
usrinit.exe          MALWARE

The file 'usrinit.exe' has been determined to be 'MALWARE'. Our analysts named the threat Worm/Downloader.AU.1. The term "WORM/" denotes a worm that is able to spread itself for instance over the Internet (using eMail, peer-to-peer networks, IRC networks etc.).Detection is added to our virus definition file (VDF) starting with version 7.00.00.227.
Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.

Print this pagePrint this page
               
               
  © 2008 Avira GmbH         Copyright Privacy Sitemap Feedback Imprint Con

真.菲戈

Starting the file scan:

Begin scan in 'D:\Downloads\Sample\DAY\5.14\下载.rar'
D:\Downloads\Sample\DAY\5.14\下载.rar
  [0] Archive type: RAR
  --> userinit.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agent.23552
  --> usrinit.exe
      [DETECTION] Contains detection pattern of the worm WORM/Downloader.AU.1
      [NOTE]      The file was deleted!

allinwonderi

[Scanning : C:\Documents and Settings\All Users\Documents\Test]


C:\Documents and Settings\All Users\Documents\Test\下载.rar<RAR>:usrinit.exe<UPack>:usrinit.exe <- Worm.Au : No action



Scanned objects : 7

Infected objects : 1

allinwonderi

[Found possible virus]        <W32/Threat-SysVenFakU-based!Maximus (not disinfectable)>        C:\Documents and Settings\All Users\Documents\Test\下载.rar->userinit.exe
[Found possible virus]        <W32/Threat-SysVenFakU-based!Maximus (not disinfectable)>        C:\Documents and Settings\All Users\Documents\Test\下载.rar->usrinit.exe

---------------------------------------------------------------------
Scan ended:        2008-5-14, 14:15:01
Duration:        0:00:01

Scan result:

Scanned files:                 7
Infected objects:         2
Disinfected objects:         0
Quarantined files:         0
---------------------------------------------------------------------

The EQs

代码里面有很多行为。。。。。。

傻猪猪米走鸡

2008-5-14 14:27:40        内核        文件 'D:\firefox download\下载.rar' 已发送到 ESET 进行分析。

失翼天使

Access to the data has been denied!
Warning: A virus or unwanted program has been found in the HTTP Data.

Requested URL:         http://bbs.kafan.cn/attachment.p ... 14&t=1210747369
Information:         Is the Trojan horse TR/Drop.Agent.23552

Generated by AntiVir WebGuard 8.0.13.0, AVE 8.1.0.42, VDF 7.0.4.33

adolf_1987

WEB
已检测到: 病毒 Worm.Win32.Downloader.el        URL: http://bbs.kafan.cn/attachment.p ... 747544/userinit.exe


扫描
已检测到: 病毒 Worm.Win32.Downloader.el        文件: F:\下载.rar\userinit.exe
已检测到: 病毒 Worm.Win32.Downloader.el        文件: F:\下载.rar\usrinit.exe

红心王子

2008-5-14 14:51:25,Worm.Downloader.au.kokh,木马,Administrator,C:\Documents and Settings\Administrator\桌面\下载.rar>>usrinit.exe,Manual scan
2008-5-14 14:51:25,Heuri.Suspicious.ERNM,启发式扫描,Administrator,C:\Documents and Settings\Administrator\桌面\下载.rar>>userinit.exe,Manual scan