New

qigang

下载地址：http://www.mathusallem.ro/forum/Smileys/system.exe

小邪邪

秋叶濛濛

Avira

Begin scan in 'F:\Virus\system.exe'
F:\Virus\system.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [NOTE]      The file was deleted!

tracydk

傻猪猪米走鸡

D:\firefox download\system.rar > RAR > system.exe - 正常
D:\firefox download\system.rar:Zone.Identifier - 正常

aaad2008

Win32:Metro-E [Trj]

[ 本帖最后由 aaad2008 于 2008-6-4 20:34 编辑 ]

allinwonderi

[Found backdoor]         <W32/Polycrypt.A.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\system.rar->system.exe->(SimplePack)

---------------------------------------------------------------------
Scan ended:        2008-6-4, 20:37:19
Duration:        0:00:01

Scan result:

Scanned files:                 6
Infected objects:         1
Disinfected objects:         0
Quarantined files:         0
---------------------------------------------------------------------

qigang

反病毒引擎	版本	最后更新	扫描结果
AhnLab-V3	2008.5.30.1	2008.06.04	-
AntiVir	7.8.0.26	2008.06.04	TR/Crypt.XDR.Gen
Authentium	5.1.0.4	2008.06.04	-
Avast	4.8.1195.0	2008.06.04	Win32:Metro-E
AVG	7.5.0.516	2008.06.04	-
BitDefender	7.2	2008.06.04	GenPack:Trojan.Proxy.Metro.A
CAT-QuickHeal	9.50	2008.06.03	(Suspicious) - DNAScan
ClamAV	0.92.1	2008.06.04	Trojan.Packed-77
DrWeb	4.44.0.09170	2008.06.04	Trojan.MulDrop.11916
eSafe	7.0.15.0	2008.06.03	-
eTrust-Vet	31.6.5847	2008.06.04	-
Ewido	4.0	2008.06.04	-
F-Prot	4.4.4.56	2008.06.04	W32/Polycrypt.A.gen!Eldorado
F-Secure	6.70.13260.0	2008.06.04	W32/Suspicious_C.gen
Fortinet	3.14.0.0	2008.06.04	-
GData	2.0.7306.1023	2008.06.04	Win32:Metro-E
Ikarus	T3.1.1.26.0	2008.06.04	Generic.Trojan-Proxy.Metro.A
Kaspersky	7.0.0.125	2008.06.04	-
McAfee	5309	2008.06.03	New Malware.dz
Microsoft	1.3604	2008.06.04	-
NOD32v2	3157	2008.06.04	-
Norman	5.80.02	2008.06.04	-
Panda	9.0.0.4	2008.06.04	Generic Malware
Prevx1	V2	2008.06.04	-
Rising	20.47.22.00	2008.06.04	-
Sophos	4.30.0	2008.06.04	Mal/Generic-A
Sunbelt	3.0.1144.1	2008.06.04	VIPRE.Suspicious
Symantec	10	2008.06.04	-
TheHacker	6.2.92.333	2008.06.03	Trojan/Buzus.gpu
VBA32	3.12.6.7	2008.06.03	Trojan.Win32.Buzus.gpu
VirusBuster	4.3.26:9	2008.06.03	-
Webwasher-Gateway	6.6.2	2008.06.04	Trojan.Crypt.XDR.Gen

附加信息

File size: 53569 bytes

MD5...: 9b78d00eb4023b7cbf6a8dfc718c49fe

SHA1..: 02464bc3dd1f822dcb1fe86d631337bf18505e7f

SHA256: efe8170816801bc9f3e4118b3be62ae59a05d1c1c904604157af749cfd6e8019

SHA512: a0b41ba1d0b19b6185b3dbaa3790c4024cef5adb755bf8b553c90a928ea4b55e a8bbe25bc1be5d8fb8e65d52f0500427aea4dc48e6f8e0259f51f9b30d3a7f77

PEiD..: -

PEInfo: -

packers (F-Prot): SimplePack

packers (Kaspersky): SimplePack

电影结束了

对象: system.exe
在压缩档案里: F:\virus\system.rar
Status: 已发现病毒
病毒: GenPack:Trojan.Proxy.Metro.A (BD 引擎)

ㄚ一

2008/6/5 U 05:37:13        Placed in group        Low Restricted        : Heur.Trojan.Generic       
2008/6/5 U 05:37:16                c:\documents and settings\administrator\local settings\temp\rarsfx0\模糊ㄉ相片~!.exe        Detected: Trojan.generic       
2008/6/5 U 05:37:26                c:\documents and settings\administrator\local settings\temp\rarsfx0\模糊ㄉ相片~!.exe        Completed: Trojan.generic