一个有趣的病毒

The EQs

说其有趣因为不知道应该怎么称呼它好，里面的代码显示有不少病毒的行为，用hips的运行一下看看吧

ssy275

will

TR/Spy.Hacko.3

testhawk

oSS一个
13:29:35        Succeeded to quarantine malware "Packed/FSG" (Sequence)

taihuxian

2008-7-3 13:34:31        SYSTEM        1568        Sign of "Win32:Agent-SIM [Trj]" has been found in "http://bbs.kafan.cn/attachment.php?aid=301814&k=d4520d35b95e9178260850e9e0e74fd1&t=1215063247\10.exe\[FSG]" file.

电影结束了

对象: 10.exe
        在压缩档案里: D:\10.zip
        Status: 已发现病毒
        病毒: Generic.Malware.SP!Pk!g.4EDBBF27 (BD 引擎)

woai_jolin

AhnLab-V3	-	-	-
AntiVir	-	-	TR/Spy.Hacko.3
Authentium	-	-	W32/Banload.B.gen!Eldorado
Avast	-	-	Win32:Agent-SIM
AVG	-	-	-
BitDefender	-	-	Generic.Malware.SP!Pk!g.4EDBBF27
CAT-QuickHeal	-	-	(Suspicious) - DNAScan
ClamAV	-	-	Trojan.Gadgo.20
DrWeb	-	-	Trojan.DownLoader.origin
eSafe	-	-	Suspicious File
eTrust-Vet	-	-	Win32/Mocmex!generic
Ewido	-	-	Heuristic.Win32.AVKiller
F-Prot	-	-	W32/Banload.B.gen!Eldorado
F-Secure	-	-	Suspicious_F.gen
Fortinet	-	-	-
GData	-	-	Win32:Agent-SIM
Ikarus	-	-	Backdoor.Klj
Kaspersky	-	-	Heur.Worm.Generic
McAfee	-	-	-
Microsoft	-	-	-
NOD32v2	-	-	probably a variant of Win32/Genetik
Norman	-	-	Suspicious_F.gen
Panda	-	-	Suspicious file
Prevx1	-	-	Suspicious
Rising	-	-	-
Sophos	-	-	Mal/Heuri-E
Sunbelt	-	-	VIPRE.Suspicious
Symantec	-	-	-
TheHacker	-	-	-
TrendMicro	-	-	PAK_Generic.001
VBA32	-	-	-
VirusBuster	-	-	Packed/FSG
Webwasher-Gateway	-	-	Trojan.Spy.Hacko.3

电影结束了

....AUTORUN.....

zwl2828

Detected: Heur.Worm.Generic

The EQs

原帖由 电影结束了 于 2008-7-3 13:37 发表

....AUTORUN.....

具备下载者的autorun。。。。。应该还有其他行为。。。。