2008年11月9日下午收集的6个可疑样本

zjsxsycj

2008年11月9日下午收集的6个可疑样本
如果您的安全软件无法查杀,
请及时上报. 谢谢
其中驱逐舰发现1个.....其余已上报
点击下载2008年11月9日下午收集的6个可疑样本

will

  Total Command-Line Scanner Report
-------------------------------------------------------------------------
  Report for Jiangmin Command-Line Scanner :

  FAROY.exe ----- Trojan/VB.eut  

  Jiangmin found 1 detections in 6 files.
-------------------------------------------------------------------------
  Task done @ 2008/11/09 日 15:55:04.03

will

  Total Command-Line Scanner Report
-------------------------------------------------------------------------
  Report for Kingsoft Command-Line Scanner :


  Kingsoft found 0 detections in 6 files.
-------------------------------------------------------------------------
  Task done @ 2008/11/09 日 15:55:58.14

will

Multi Command-Line Scanner Report
-------------------------------------------------------------------------   
D:\Desk\Samples\Collect\MCLS\1006.exe   
Type: Generic Win/DOS Executable / Extension: .EXE   
MD5 Hash: 2CA425CF5909B9AAA273A1460A034821   

A-squared ----- Virus.Win32.QQRob.AS!IK    
Avast ----- Win32:Trojan-gen {Other}    
Avg ----- Downloader.Adload.MI     
Antivir ----- TR/Proxy.Delf.CA    
BitDefender ----- Nothing   
ClamWin ----- Nothing   
Dr.Web ----- Nothing   
Eset ----- Nothing   
Ikarus ----- Virus.Win32.QQRob.AS    
Jiangmin ----- Nothing   
Kaspersky ----- Heur.Downloader    
Kingsoft ----- Nothing   
Vba32 ----- Nothing   

*** 6/13 antivirus engines found virus in this file ***   
-------------------------------------------------------------------------   
D:\Desk\Samples\Collect\MCLS\3202.exe   
Type: Win32 Executable Borland Delphi 7 / Extension: .EXE   
MD5 Hash: E9F25147F5B786DF8083B8236161CA38   

A-squared ----- Nothing   
Avast ----- Win32:Banload-FVI [Trj]    
Avg ----- Nothing   
Antivir ----- TR/ATRAPS.Gen    
BitDefender ----- MemScan:Trojan.Generic.476075    
ClamWin ----- Nothing   
Dr.Web ----- Trojan.Proxy.3858    
Eset ----- Win32/TrojanDownloader.Adload.NFF trojan    
Ikarus ----- Nothing   
Jiangmin ----- Nothing   
Kaspersky ----- Nothing   
Kingsoft ----- Nothing   
Vba32 ----- Embedded.Win32.TrojanDownloader.Adload.NFF    

*** 6/13 antivirus engines found virus in this file ***   
-------------------------------------------------------------------------   
D:\Desk\Samples\Collect\MCLS\FAROY.exe   
Type: UPX compressed Win32 Executable / Extension: .EXE   
MD5 Hash: FC78766CA427AFBD5B7CB85EF926416A   

A-squared ----- Email-Worm.Win32.VB.fn!IK    
Avast ----- Win32:Dialer-gen [Trj]    
Avg ----- Generic12.DMN     
Antivir ----- TR/Crypt.FKM.Gen    
BitDefender ----- Nothing   
ClamWin ----- Nothing   
Dr.Web ----- Nothing   
Eset ----- a variant of Win32/TrojanDownloader.VB.NQS trojan    
Ikarus ----- Email-Worm.Win32.VB.fn    
Jiangmin ----- Trojan/VB.eut    
Kaspersky ----- Trojan.Win32.VB.fyp    
Kingsoft ----- Nothing   
Vba32 ----- Trojan.Win32.VB.flg    

*** 9/13 antivirus engines found virus in this file ***   
-------------------------------------------------------------------------   
D:\Desk\Samples\Collect\MCLS\msconfig.exe   
Type: UPX compressed Win32 Executable / Extension: .EXE   
MD5 Hash: ADB8D712AA199CA74ECAE572B747E1D6   

A-squared ----- Nothing   
Avast ----- Win32:Trojan-gen {Other}    
Avg ----- Nothing   
Antivir ----- Nothing   
BitDefender ----- Nothing   
ClamWin ----- Nothing   
Dr.Web ----- Nothing   
Eset ----- Nothing   
Ikarus ----- Nothing   
Jiangmin ----- Nothing   
Kaspersky ----- Nothing   
Kingsoft ----- Nothing   
Vba32 ----- Nothing   

*** 1/13 antivirus engines found virus in this file ***   
-------------------------------------------------------------------------   
D:\Desk\Samples\Collect\MCLS\TRMOV.dll   
Type: UPX compressed Win32 Executable / Extension: .EXE   
MD5 Hash: BCBAB636EB2A67C03FAE48B5E770EFDB   

A-squared ----- Virus.Trojan.Win32.Agent.amjm!IK    
Avast ----- Nothing   
Avg ----- Nothing   
Antivir ----- TR/Fakealert.HK    
BitDefender ----- Nothing   
ClamWin ----- Nothing   
Dr.Web ----- Nothing   
Eset ----- Nothing   
Ikarus ----- Virus.Trojan.Win32.Agent.amjm    
Jiangmin ----- Nothing   
Kaspersky ----- Trojan.Win32.Agent.amjm    
Kingsoft ----- Nothing   
Vba32 ----- Nothing   

*** 4/13 antivirus engines found virus in this file ***   
-------------------------------------------------------------------------   
D:\Desk\Samples\Collect\MCLS\winlogon.exe   
Type: Win64 Executable Generic / Extension: .EXE   
MD5 Hash: 440EDA2420CFA1B3B2AB4725FC33825D   

A-squared ----- Nothing   
Avast ----- Nothing   
Avg ----- Nothing   
Antivir ----- Nothing   
BitDefender ----- Nothing   
ClamWin ----- Nothing   
Dr.Web ----- Nothing   
Eset ----- Nothing   
Ikarus ----- Nothing   
Jiangmin ----- Nothing   
Kaspersky ----- Nothing   
Kingsoft ----- Nothing   
Vba32 ----- Nothing   

*** 0/13 antivirus engines found virus in this file ***   
-------------------------------------------------------------------------   

Task done @ 2008/11/09 日 15:59:33.16   

Palkia

我这里好慢啊


RS KILL 2

Unknown Virus(未知病毒)      
Trojan.Clicker.TheIEFix.a

[ 本帖最后由 tvuser2007 于 2008-11-9 16:07 编辑 ]

无尽藏海

Begin scan in 'D:\Virus\6(3)'
D:\Virus\6(3)\1006.exe
    [DETECTION] Is the TR/Proxy.Delf.CA Trojan
    [NOTE]      The file was deleted!
D:\Virus\6(3)\3202.exe
    [DETECTION] Is the TR/ATRAPS.Gen Trojan
    [NOTE]      The file was deleted!
D:\Virus\6(3)\FAROY.exe
    [DETECTION] Is the TR/Crypt.FKM.Gen Trojan
    [NOTE]      The file was deleted!
D:\Virus\6(3)\TRMOV.dll
    [DETECTION] Is the TR/Fakealert.HK Trojan
    [NOTE]      The file was deleted!

25184569	msconfig.exe	332.66 KB	UNDER ANALYSIS
25184570	winlogon.exe	481.5 KB	UNDER ANALYSIS

[ 本帖最后由 无尽藏海 于 2008-11-9 16:12 编辑 ]

冷冷

msconfig.exe      ADB8D712AA199CA74ECAE572B747E1D6  复制自身到system32 ，并添加自启动
winlogon.exe      440EDA2420CFA1B3B2AB4725FC33825D   未发现恶意行为
3202.exe            E9F25147F5B786DF8083B8236161CA38    取消下载后，仍访问网络
TRMOV.dll         BCBAB636EB2A67C03FAE48B5E770EFDB  nothing
FAROY.exe       FC78766CA427AFBD5B7CB85EF926416A   Tro.DL
1006.exe          2CA425CF5909B9AAA273A1460A034821       恶意

[ 本帖最后由 冷冷 于 2008-11-9 16:52 编辑 ]

daojian

小病毒！大多数的杀毒都能发现！

Scanning Engines:
F-Secure AVP: 7.00.171, 2008-11-09
F-Secure Hydra: 2.08.8110, 2008-11-09

扫描干掉俩

W32/Packed_FSG.D (virus)
C:\DOCUMENTS AND SETTINGS\SK\桌面\VIRUSRUN\081109\6\1006.EXE Action: quarantined

挪威的冬天

金山毒霸可信认证技术查询结果如下

1006.exe     -----------     病毒
3202.exe     -----------     未知
FAROY.exe     -----------     可疑的
msconfig.exe     -----------     安全(*)
TRMOV.dll     -----------     分析中
winlogon.exe     -----------     安全(*)