Test Sample

qigang

下载地址：http://www.sky8000.com/sina/888.exe

slackware

File 888.rar received on 06.12.2008 16:01:40 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED


Result: 0/32 (0%)
Loading server information...
Your file is queued in position: ___.
Estimated start time is between ___ and ___ .
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Print results  
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:  
  

Antivirus Version Last Update Result
AhnLab-V3 2008.6.11.0 2008.06.12 -
AntiVir 7.8.0.55 2008.06.12 -
Authentium 5.1.0.4 2008.06.12 -
Avast 4.8.1195.0 2008.06.12 -
AVG 7.5.0.516 2008.06.12 -
BitDefender 7.2 2008.06.12 -
CAT-QuickHeal 9.50 2008.06.11 -
ClamAV 0.92.1 2008.06.12 -
DrWeb 4.44.0.09170 2008.06.12 -
eSafe 7.0.15.0 2008.06.11 -
eTrust-Vet 31.6.5868 2008.06.12 -
Ewido 4.0 2008.06.12 -
F-Prot 4.4.4.56 2008.06.12 -
F-Secure 6.70.13260.0 2008.06.12 -
Fortinet 3.14.0.0 2008.06.12 -
GData 2.0.7306.1023 2008.06.12 -
Ikarus T3.1.1.26.0 2008.06.12 -
Kaspersky 7.0.0.125 2008.06.12 -
McAfee 5315 2008.06.11 -
Microsoft 1.3604 2008.06.12 -
NOD32v2 3181 2008.06.12 -
Norman 5.80.02 2008.06.12 -
Panda 9.0.0.4 2008.06.11 -
Prevx1 V2 2008.06.12 -
Rising 20.48.32.00 2008.06.12 -
Sophos 4.30.0 2008.06.12 -
Sunbelt 3.0.1145.1 2008.06.05 -
Symantec 10 2008.06.12 -
TheHacker 6.2.92.344 2008.06.12 -
VBA32 3.12.6.7 2008.06.12 -
VirusBuster 4.3.26:9 2008.06.12 -
Webwasher-Gateway 6.6.2 2008.06.12 -

Palkia

kv 0

aaad2008

http://www.sky8000.com/baidu/0.exe
0.exe
http://www.sky8000.com/baidu/1.exe
1.exe
http://www.sky8000.com/baidu/2.exe
2.exe
http://www.sky8000.com/baidu/3.exe
3.exe
http://www.sky8000.com/baidu/4.exe
4.exe
http://www.sky8000.com/baidu/5.exe
5.exe
http://www.sky8000.com/baidu/6.exe
6.exe
http://www.sky8000.com/baidu/7.exe
7.exe
http://www.sky8000.com/baidu/8.exe
8.exe

qigang

貌似非PE文件，晕死。这地址已经失效。

qigang

怎么来的？

SIGINT

Begin scan in 'C:\Documents and Settings\Administrator\桌面\virus.rar'
C:\Documents and Settings\Administrator\桌面\virus.rar
  [0] Archive type: RAR
  --> 0.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agent.69632
  --> 7.exe
      [DETECTION] Is the Trojan horse TR/Downloader.Gen
      [NOTE]      A backup was created as '48c48234.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!

冷冷

看代码

qigang

已经懂了，忘了这招。