马一只

显示全部楼层 · 发表于 2008-9-24 14:07:20

马一只

费尔说：setup.exe Trojan.Small.xpk.fgqk 木马还未处理

Norman 在线沙盘日志有点少，来看看这个更多的：ht tp://www.threatexpert.com/report.aspx?md5=2d2843b11bc14c86e65618ae1f98e8ca

&#23567 : Not detected by Sandbox (Signature: W32/Pandex.BM)

[ DetectionInfo ]
* Sandbox name: NO_MALWARE

* Signature name: W32/Pandex.BM

* Compressed: NO
* TLS hooks: NO

* Executable type: Application
* Executable file structure: OK
* Filetype: PE_I386

[ General information ]
* File length:       47104 bytes.
* MD5 hash: 2d2843b11bc14c86e65618ae1f98e8ca.

文件 setup.rar 接收于 2008.09.24 06:58:49 (CET)

结果: 27/36 (75%)

反病毒引擎版本最后更新扫描结果
AhnLab-V3 2008.9.23.1 2008.09.24 -
AntiVir 7.8.1.34 2008.09.23 TR/Kobcka.EX.21
Authentium 5.1.0.4 2008.09.23 W32/Trojan2.DKGR
Avast 4.8.1195.0 2008.09.23 Win32:Trojan-gen {Other}
AVG 8.0.0.161 2008.09.23 Downloader.Agent.AJEE
BitDefender 7.2 2008.09.24 Trojan.Dropper.Kobcka.Gen.1
CAT-QuickHeal 9.50 2008.09.24 Trojan.Agent.acyy
ClamAV 0.93.1 2008.09.24 -
DrWeb 4.44.0.09170 2008.09.24 Trojan.MulDrop.17530
eSafe 7.0.17.0 2008.09.23 -
eTrust-Vet 31.6.6101 2008.09.23 -
Ewido 4.0 2008.09.23 -
F-Prot 4.4.4.56 2008.09.23 W32/Trojan2.DKGR
F-Secure 8.0.14332.0 2008.09.24 Trojan.Win32.Agent.acyy
Fortinet 3.113.0.0 2008.09.23 PossibleThreat
GData 19 2008.09.24 Trojan.Dropper.Kobcka.Gen.1
Ikarus T3.1.1.34.0 2008.09.24 Virus.Trojan.Win32.Small.xpk
K7AntiVirus 7.10.469 2008.09.23 Trojan.Win32.Small.xpk
Kaspersky 7.0.0.125 2008.09.24 Trojan.Win32.Agent.acyy
McAfee 5390 2008.09.23 Spy-Agent.bv.dldr
Microsoft 1.3903 2008.09.24 Trojan:Win32/Meredrop
NOD32v2 3466 2008.09.23 a variant of Win32/Wigon.EH
Norman 5.80.02 2008.09.23 W32/Pandex.BM
Panda 9.0.0.4 2008.09.23 Generic Trojan
PCTools 4.4.2.0 2008.09.23 -
Prevx1 V2 2008.09.24 Malicious Software
Rising 20.63.20.00 2008.09.24 -
Sophos 4.33.0 2008.09.24 Mal/Pushdo-A
Sunbelt 3.1.1666.1 2008.09.24 Trojan.Kobcka.EX
Symantec 10 2008.09.24 Trojan.Pandex
TheHacker 6.3.0.9.092 2008.09.24 Trojan/Small.gen
TrendMicro 8.700.0.1004 2008.09.23 TROJ_SMALL.DOK
VBA32 3.12.8.5 2008.09.23 Trojan.Win32.Small.xpk
ViRobot 2008.9.23.1389 2008.09.24 -
VirusBuster 4.5.11.0 2008.09.23 -
Webwasher-Gateway 6.6.2 2008.09.23 Trojan.Kobcka.EX.21
附加信息
File size: 45973 bytes
MD5...: 61291a0455e7c8357addc850f07a81ae
SHA1..: 07461ca455503ebde43f0dc340f4b4d04c3193b5
SHA256: b12775a7e769ae9d1696f38d12b3244cea6ac2e587981c6d41413f943c606cde
SHA512: 53ecdedd7c5a4f2ae113e1d5d304431abe697aea34561a78cc9c99038359a5d1
a9f35f744877afaab09346dedd6248a0b060b794663e5dbde35dea56e25b3cdd
PEiD..: -
TrID..: File type identification
RAR Archive (83.3%)
REALbasic Project (16.6%)

VirSCAN.org Scanned Report :
Scanned time : 2008/09/24 12:59:20 (CST)
Scanner results: 75%的杀软(27/36)报告发现病毒
File Name    : setup.rar
File Size    : 45973 byte
File Type    : RAR archive data, v1d, os
MD5          : 61291a0455e7c8357addc850f07a81ae
SHA1          : 07461ca455503ebde43f0dc340f4b4d04c3193b5
Online report  : ht tp://virscan.org/report/28c0298bea4fce3c6a6b316c888352b6.html

Scanner       Engine Ver    Sig Ver          Sig Date Time Scan result
a-squared    4.0.0.14       2008.09.17       2008-09-17  1.41 Trojan.Win32.Small.xpk!A2
安博士V3    2008.09.24.02 2008.09.24       2008-09-24  0.91 Win-Trojan/Xema.variant
AntiVir       7.8.1.34       7.0.6.202       2008-09-23  2.33 TR/Kobcka.EX.21
Arcavir       1.0.5          200809231419    2008-09-23  1.20 Trojan.Agent.Acyy
AVAST!       3.0.1          080923-0       2008-09-23  0.01 Win32:Trojan-gen {Other}
AVG          7.5.52.442    270.7.1/1687    2008-09-23  1.64 Downloader.Agent.AJEE
BitDefender 7.60825.1790650 7.21014          2008-09-24  3.13 Trojan.Dropper.Kobcka.Gen.1
CA (VET)    9.0.0.143    31.6.6101       2008-09-23  5.37 Win32/Glproxy.B trojan.
ClamAV       0.94          8320             2008-09-24  0.01 -
Comodo       2.11          2.0.0.655       2008-09-23  0.42 -
CP Secure    1.1.0.715    2008.09.24       2008-09-24  5.86 -
Dr.Web       4.44.0.9170    2008.09.23       2008-09-23  3.21 Trojan.MulDrop.17530
ewido       4.0.0.2       2008.09.23       2008-09-23  2.72 -
F-Prot       4.4.4.56       20080923       2008-09-23  1.02 W32/Trojan2.DKGR (exact)
F-Secure    5.51.6100    2008.09.24.01    2008-09-24  3.40 Trojan.Win32.Agent.acyy [AVP]
飞塔          2.81-3.113    9.580          2008-09-23  0.17 PossibleThreat
ViRobot       20080923       2008.09.23       2008-09-23  0.42 Trojan.Win32.Small.30720.D
Ikarus       T3.1.01.34    2008.09.23.71515  2008-09-23  3.34 Virus.Trojan.Win32.Small.xpk
江民杀毒    11.0.706       2008.09.23       2008-09-23  1.22 -
卡巴斯基    5.5.10       2008.09.24       2008-09-24  0.03 Trojan.Win32.Agent.acyy
金山毒霸    2008.1.14.15 2008.9.24.10    2008-09-24  0.64 -
迈克菲       5.3.00       5390             2008-09-23  1.94 Spy-Agent.bv.dldr
Microsoft    1.3903       2008.09.23       2008-09-23  3.90 Trojan:Win32/Meredrop
mks_vir       2.01          2008.09.23       2008-09-23  2.62 -
Norman       5.93.01       5.93.00          2008-09-18  5.39 W32/Pandex.BM
熊猫卫士    9.05.01       2008.09.23       2008-09-23  2.09 Generic Trojan
趋势科技    8.700-1004    5.560.14       2008-09-23  0.02 TROJ_SMALL.DOK
Quick Heal    9.50          2008.09.24       2008-09-24  1.77 Trojan.Agent.acyy
瑞星          20.0          20.63.20.00    2008-09-24  0.76 -
Sophos       2.78.0       4.33             2008-09-24  1.91 Mal/Pushdo-A
Sunbelt       3.1.1662.1    2253             2008-09-23  0.45 Trojan.Kobcka.EX
赛门铁克    1.3.0.24       20080923.003    2008-09-23  0.08 Trojan.Pandex
nProtect    2008-09-24.00 2148988          2008-09-24  4.44 Trojan/W32.Small.30720.W
The Hacker    6.3.0.9       v00092          2008-09-23  0.41 Trojan/Small.gen
VBA32       3.12.8.5       20080923.0958    2008-09-23  1.21 Trojan.Win32.Small.xpk
VirusBuster 4.5.11.10    10.88.5/635652 2008-09-23  0.83 -

显示全部楼层 · 发表于 2008-9-24 14:29:19

Kaspersky Lab
拒绝访问
无法返回请求的网页

试图访问的网页：

http://bbs.kafan.cn/attachment.php?aid=
363933&k=db1bec4f8089d22c8df7a2500101089
9&t=1222237708

发生下列错误：

请求的对象被感染，发现下列病毒 Trojan.Win32.Agent.acyy

如有疑问，请联系您的技术支持
创建日期：
Wed Sep 24 14:28:30 2008
Kaspersky Lab

显示全部楼层 · 发表于 2008-9-24 14:35:06

基本上都报了啊...

显示全部楼层 · 发表于 2008-9-24 16:04:27

这个运行后没发现啥动作,有HIPS的朋友帮忙看看.

显示全部楼层 · 发表于 2008-9-24 16:29:59

原帖由 scottxzt 于 2008-9-24 16:04 发表
这个运行后没发现啥动作,有HIPS的朋友帮忙看看.

生成几个文件在临时目录，和一个驱动文件，还有修改注册表。

显示全部楼层 · 发表于 2008-9-24 16:35:55

国产3巨头全不报？

显示全部楼层 · 发表于 2008-9-24 19:12:00

金山 0

显示全部楼层 · 发表于 2008-9-24 20:10:25

驱逐舰杀

显示全部楼层 · 发表于 2008-9-24 20:10:36

McAfee Spy-Agent.bv.dldr

显示全部楼层 · 发表于 2008-9-24 23:48:55

rising2009 0

[病毒样本] 马一只

本帖子中包含更多资源

本帖子中包含更多资源