cppthyzd [md5:0d770b]

mofunzone

File:	cppthyzd
Status:	INFECTED/MALWARE
MD5:	0d770b9be2e5946b5889718249b4d5c6
Packers detected:	-
Scanner results
Scan taken on 27 May 2008 00:01:51 (GMT)
A-Squared	Found  nothing
AntiVir	Found TR/Crypt.XPACK.Gen
ArcaVir	Found Trojan.Downloader.Small.Vzm
Avast	Found  nothing
AVG Antivirus	Found  nothing
BitDefender	Found  nothing
ClamAV	Found  nothing
CPsecure	Found  nothing
Dr.Web	Found  nothing
F-Prot Antivirus	Found  nothing
F-Secure Anti-Virus	Found Trojan-Downloader.Win32.Small.vzm
Fortinet	Found W32/Small.VZM!tr.dldr
Ikarus	Found Trojan.Crypt.XPACK
Kaspersky Anti-Virus	Found Trojan-Downloader.Win32.Small.vzm
NOD32	Found  nothing
Norman Virus Control	Found  nothing
Panda Antivirus	Found  nothing
Sophos Antivirus	Found Mal/EncPk-DB
VirusBuster	Found  nothing
VBA32	Found Trojan-Downloader.Win32.Small.vzm

gaojun7206

Test\
  cppthyzd.rar
    [0] Archive type: RAR
    --> cppthyzd
        [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was moved to '48ab5a72.qua'!

电影结束了

TF过。。。。只知道下载了下载了个D。EXE

估计d.exe会继续下载东西。。。

palfan

还生成一个d1.exe，d.exe添加自身开机启动并更新自身（不确定），d1.exe好像是个木马下载器

[ 本帖最后由 palfan 于 2008-5-27 10:57 编辑 ]

挪威的冬天

金山毒霸 0

sam.to

可不可以打包上來?

palfan

原帖由 kato9096 于 2008-5-27 11:52 发表
可不可以打包上來?

这里

sam.to

Scanned file:   d1.rar
d1.rar/d1.exe - OK
d1.rar/d1.exe - OK
d1.rar/d.exe - OK


TO KL

tracydk

启发出来了

sam.to

File d1.exe9 received on 05.27.2008 08:38:27 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 24/32 (75%)
Loading server information...
Your file is queued in position: ___.
Estimated start time is between ___ and ___ .
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Compact
Print results Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:        
       
Antivirus         Version         Last Update         Result
AhnLab-V3        2008.5.22.1        2008.05.26        -
AntiVir        7.8.0.19        2008.05.27        TR/Tiny.705
Authentium        5.1.0.4        2008.05.26        W32/Backdoor.BVZK
Avast        4.8.1195.0        2008.05.27        Win32:Tiny-II
AVG        7.5.0.516        2008.05.26        Small.AU
BitDefender        7.2        2008.05.27        Trojan.Packed.EK
CAT-QuickHeal        9.50        2008.05.26        Trojan.Tiny.705
ClamAV        0.92.1        2008.05.27        Trojan.Dropper-2267
DrWeb        4.44.0.09170        2008.05.27        -
eSafe        7.0.15.0        2008.05.26        Win32.Trojan
eTrust-Vet        31.4.5823        2008.05.26        -
Ewido        4.0        2008.05.26        Trojan.Agent
F-Prot        4.4.4.56        2008.05.26        W32/Backdoor.BVZK
F-Secure        6.70.13260.0        2008.05.27        Suspicious_F.gen
Fortinet        3.14.0.0        2008.05.27        W32/Small.DRU!tr.dldr
GData        2.0.7306.1023        2008.05.23        Win32:Tiny-II
Ikarus        T3.1.1.26.0        2008.05.27        Virus.Win32.Virut.n
Kaspersky        7.0.0.125        2008.05.27        -
McAfee        5303        2008.05.26        Generic Packed
Microsoft        None        2008.05.27        -
NOD32v2        3133        2008.05.26        probably a variant of Win32/Agent
Norman        5.80.02        2008.05.26        W32/Lineage.AZCL
Panda        9.0.0.4        2008.05.27        Trj/Downloader.NUS
Prevx1        V2        2008.05.27        Malicious Software
Rising        20.46.10.00        2008.05.27        -
Sophos        4.29.0        2008.05.27        Mal/Packer
Sunbelt        3.0.1123.1        2008.05.17        VIPRE.Suspicious
Symantec        10        2008.05.27        -
TheHacker        6.2.92.320        2008.05.26        Trojan/Tiny.gen
VBA32        3.12.6.6        2008.05.27        -
VirusBuster        4.3.26:9        2008.05.26        Packed/FSG
Webwasher-Gateway        6.6.2        2008.05.27        Trojan.Tiny.705

File d.exe8 received on 05.27.2008 08:38:32 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 7/32 (21.88%)
Loading server information...
Your file is queued in position: ___.
Estimated start time is between ___ and ___ .
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Compact
Print results Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:        
       
Antivirus         Version         Last Update         Result
AhnLab-V3        2008.5.22.1        2008.05.26        -
AntiVir        7.8.0.19        2008.05.27        -
Authentium        5.1.0.4        2008.05.26        -
Avast        4.8.1195.0        2008.05.27        Win32:Zbot-WX
AVG        7.5.0.516        2008.05.26        -
BitDefender        7.2        2008.05.27        -
CAT-QuickHeal        9.50        2008.05.26        (Suspicious) - DNAScan
ClamAV        0.92.1        2008.05.27        -
DrWeb        4.44.0.09170        2008.05.27        -
eSafe        7.0.15.0        2008.05.26        Suspicious File
eTrust-Vet        31.4.5823        2008.05.26        -
Ewido        4.0        2008.05.26        -
F-Prot        4.4.4.56        2008.05.26        -
F-Secure        6.70.13260.0        2008.05.27        Suspicious:W32/Malware!Gemini
Fortinet        3.14.0.0        2008.05.27        -
GData        2.0.7306.1023        2008.05.23        -
Ikarus        T3.1.1.26.0        2008.05.27        -
Kaspersky        7.0.0.125        2008.05.27        -
McAfee        5303        2008.05.26        -
Microsoft        None        2008.05.27        -
NOD32v2        3133        2008.05.26        -
Norman        5.80.02        2008.05.26        -
Panda        9.0.0.4        2008.05.27        Suspicious file
Prevx1        V2        2008.05.27        Malicious Software
Rising        20.46.10.00        2008.05.27        -
Sophos        4.29.0        2008.05.27        -
Sunbelt        3.0.1123.1        2008.05.17        -
Symantec        10        2008.05.27        -
TheHacker        6.2.92.320        2008.05.26        -
VBA32        3.12.6.6        2008.05.27        -
VirusBuster        4.3.26:9        2008.05.26        -
Webwasher-Gateway        6.6.2        2008.05.27        Win32.Malware.gen (suspicious)