Kav pass

显示全部楼层 · 发表于 2008-5-18 02:29:16

Norman Sandbox: [ General information ]
* **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
* Creating several executable files on hard-drive.
* File length: 20480 bytes.

[ Changes to filesystem ]
* Creates file C:\WINDOWS\TEMP\tempaq.
* Creates file C:\WINDOWS\tempaq.
* Deletes file C:\WINDOWS\TEMP\tempaq.

[ Network services ]
* Opens URL:

?queryid=70530.
* Connects to \"sports.yahoo550.com\" on port 80 (TCP).
* Opens URL: sports.yahoo550.com/image/logo.jpg?queryid=70530.

[ Security issues ]
* Starting downloaded file - potential security problem.

[ Process/window information ]
* Creates process \"sample.exe\".
* Creates process \"tempaq\"\".

显示全部楼层 · 发表于 2008-5-18 02:29:47

AhnLab-V3 2008.5.16.0 2008.05.16 -
AntiVir 7.8.0.19 2008.05.17 TR/Downloader.Gen
Authentium 5.1.0.4 2008.05.17 W32/Downloader.D.gen!Eldorado
Avast 4.8.1195.0 2008.05.17 -
AVG 7.5.0.516 2008.05.16 Downloader.Small.61.B
BitDefender 7.2 2008.05.17 GenPack:Trojan.Generic.135917
CAT-QuickHeal 9.50 2008.05.17 -
ClamAV 0.92.1 2008.05.17 -
DrWeb 4.44.0.09170 2008.05.17 -
eSafe 7.0.15.0 2008.05.16 -
eTrust-Vet 31.4.5798 2008.05.16 -
Ewido 4.0 2008.05.14 Downloader.QQHelper.bda
F-Prot 4.4.2.54 2008.05.16 W32/Downloader.D.gen!Eldorado
F-Secure 6.70.13260.0 2008.05.17 W32/Downloader
Fortinet 3.14.0.0 2008.05.17 -
GData 2.0.7306.1023 2008.05.17 -
Ikarus T3.1.1.26.0 2008.05.17 -
Kaspersky 7.0.0.125 2008.05.17 -
McAfee 5297 2008.05.17 StartPage-JU.dldr.gen
Microsoft 1.3408 2008.05.13 TrojanDownloader:Win32/Yafive.A
NOD32v2 3106 2008.05.16 -
Norman 5.80.02 2008.05.16 W32/Downloader
Panda 9.0.0.4 2008.05.17 -
Prevx1 V2 2008.05.17 Malicious Software
Rising 20.44.52.00 2008.05.17 Trojan.DL.Win32.Mnless.zer
Sophos 4.29.0 2008.05.17 Mal/Behav-189
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.17 -
TheHacker 6.2.92.311 2008.05.15 -
VBA32 3.12.6.6 2008.05.17 Trojan-Downloader.Win32.QQHelper.bda
VirusBuster 4.3.26:9 2008.05.17 -
Webwasher-Gateway 6.6.2 2008.05.17 Trojan.Downloader.Gen

[ 本帖最后由 VISN 于 2008-5-18 02:31 编辑 ]

显示全部楼层 · 发表于 2008-5-18 02:32:26

汗，瑞星微软咖啡都能查出来的NOD32， GDATA，KAV，AVAST居然查不出来

显示全部楼层 · 发表于 2008-5-18 03:15:59

TO KL & AVAST

显示全部楼层 · 发表于 2008-5-18 03:50:44

这个东西至少有半年历史了，看来NOD32死活就是不肯入库，虽然不知道是不是同样一个样本

显示全部楼层 · 发表于 2008-5-18 05:14:34

原帖由 solcroft 于 2008-5-18 03:50 发表
这个东西至少有半年历史了，看来NOD32死活就是不肯入库，虽然不知道是不是同样一个样本

刚修改过代码，查不出很正常。修改前的确是查出来了

显示全部楼层 · 发表于 2008-5-18 11:51:31

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.DL.Win32.Mnless.zer

MAC 地址：00:0C:29:DE:9A:3B

用户来源：局域网

软件版本：20.44.52

显示全部楼层 · 发表于 2008-5-18 11:56:53

Hello,

3.exe_ - Trojan-Downloader.Win32.Agent.pjd

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Evgeny Aseev
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

> Attachment: 3(5).rar

显示全部楼层 · 发表于 2008-5-18 12:30:43

金山毒霸 0

显示全部楼层 · 发表于 2008-5-18 20:30:30

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.DL.Win32.Mnless.zer

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.44.62

[病毒样本] Kav pass

本帖子中包含更多资源

2/1