前天查到的一个样本，大家看看

显示全部楼层 · 发表于 2009-1-6 09:33:05

前天刚GHOST完后升级杀软后查杀到的，竟然在SYS32下面

显示全部楼层 · 发表于 2009-1-6 09:52:34

文件名称 :    AMW71AD.rar
文件大小 :    21245 byte
文件类型 :    RAR archive data, v1d, os
MD5 :    32c66be16810a7bf9007a95c234a29b9
SHA1 :    2d217f28a6f021eaabcf63bd4de6f4e9f290638b

扫描结果扫描结果 :    32%的杀软(12/38)报告发现病毒
时间 :    2009/01/06 09:53:14 (CST)
软件名称引擎版本病毒库版本病毒库时间扫描结果时间
a-squared 4.0.0.29 20090105213310 2009-01-05 - 2.150
AntiVir 7.9.0.45 7.1.1.73 2009-01-05 - 1.716
Authentium 5.1.1 200901051631 2009-01-05 W32/Dropper.EUQ (Exact) 1.076
AVAST! 3.0.1 090105-0 2009-01-05 - 0.013
AVG 7.5.52.442 270.10.3/1877 2009-01-05 - 1.828
BitDefender 7.81008.2405378 7.22992 2009-01-06 Backdoor.Generic.119259 2.173
CA (VET) 9.0.0.143 31.6.6289 2009-01-02 Win32/Sipay.AB trojan. 5.528
ClamAV 0.94.2 8837 2009-01-06 Trojan.Agent-14305 0.049
Comodo 3.0 878 2009-01-05 TrojWare.Win32.Trojan.StartPage.~B 1.349
CP Secure 1.1.0.715 2009.01.05 2009-01-05 - 6.411
Dr.Web 4.44.0.9170 2009.01.05 2009-01-05 - 3.829
ewido 4.0.0.2 2008.12.31 2008-12-31 - 4.123
F-Prot 4.4.4.56 20090105 2009-01-05 W32/Dropper.EUQ (exact) 1.110
F-Secure 5.51.6100 2009.01.06.02 2009-01-06 - 0.214
GData 19.2282/19.173 20090106 2009-01-06 - 3.603
Ikarus T3.1.01.45 2009.01.06.72106 2009-01-06 - 3.618
Microsoft 1.4205 2009.01.05 2009-01-05 - 4.455
mks_vir 2.01 2009.01.04 2009-01-04 - 2.788
Norman 5.93.01 5.93.00 2009-01-05 - 6.010
nProtect 20090105.01 2841654 2009-01-05 Backdoor.Generic.119259 3.439
Quick Heal 10.00 2009.01.05 2009-01-05 - 0.884
Sophos 2.82.1 4.37 2009-01-06 - 2.070
Sunbelt 4755 4755 2008-12-22 - 0.583
The Hacker 6.3.1.2 v00205 2009-01-04 - 0.504
VBA32 3.12.8.10 20090105.1110 2009-01-05 - 1.523
ViRobot 20090105 2009.01.05 2009-01-05 - 0.415
VirusBuster 4.5.11.10 10.100.16/757569 2009-01-05 - 1.150
卡巴斯基 5.5.10 2009.01.05 2009-01-05 - 0.124
安博士V3 2009.01.06.01 2009.01.06 2009-01-06 VBS/Downloader.57856 1.062
安天 2.0.18 20090105.1950502 2009-01-05 - 0.017
江民杀毒 11.0.706 2009.01.04 2009-01-04 - 1.555
熊猫卫士 9.05.01 2009.01.05 2009-01-05 Generic Backdoor 2.351
瑞星 20.0 21.11.02.00 2009-01-05 - 1.047
赛门铁克 1.3.0.24 20090105.009 2009-01-05 - 0.187
趋势科技 8.700-1004 5.748.13 2009-01-05 TROJ_DLOADER.OZ 0.054
迈克菲 5.3.00 5486 2009-01-05 Generic Downloader.x 2.818
金山毒霸 2008.9.8.18 2009.1.6.10 2009-01-06 - 0.607
飞塔 2.81-3.117 9.895 2009-01-05 W32/Dloader.OZ!tr
文件名称 :    AMW71AD.rar
文件大小 :    21245 byte
文件类型 :    RAR archive data, v1d, os
MD5 :    32c66be16810a7bf9007a95c234a29b9
SHA1 :    2d217f28a6f021eaabcf63bd4de6f4e9f290638b

扫描结果扫描结果 :    32%的杀软(12/38)报告发现病毒
时间 :    2009/01/06 09:53:14 (CST)
软件名称引擎版本病毒库版本病毒库时间扫描结果时间
a-squared 4.0.0.29 20090105213310 2009-01-05 - 2.150
AntiVir 7.9.0.45 7.1.1.73 2009-01-05 - 1.716
Authentium 5.1.1 200901051631 2009-01-05 W32/Dropper.EUQ (Exact) 1.076
AVAST! 3.0.1 090105-0 2009-01-05 - 0.013
AVG 7.5.52.442 270.10.3/1877 2009-01-05 - 1.828
BitDefender 7.81008.2405378 7.22992 2009-01-06 Backdoor.Generic.119259 2.173
CA (VET) 9.0.0.143 31.6.6289 2009-01-02 Win32/Sipay.AB trojan. 5.528
ClamAV 0.94.2 8837 2009-01-06 Trojan.Agent-14305 0.049
Comodo 3.0 878 2009-01-05 TrojWare.Win32.Trojan.StartPage.~B 1.349
CP Secure 1.1.0.715 2009.01.05 2009-01-05 - 6.411
Dr.Web 4.44.0.9170 2009.01.05 2009-01-05 - 3.829
ewido 4.0.0.2 2008.12.31 2008-12-31 - 4.123
F-Prot 4.4.4.56 20090105 2009-01-05 W32/Dropper.EUQ (exact) 1.110
F-Secure 5.51.6100 2009.01.06.02 2009-01-06 - 0.214
GData 19.2282/19.173 20090106 2009-01-06 - 3.603
Ikarus T3.1.01.45 2009.01.06.72106 2009-01-06 - 3.618
Microsoft 1.4205 2009.01.05 2009-01-05 - 4.455
mks_vir 2.01 2009.01.04 2009-01-04 - 2.788
Norman 5.93.01 5.93.00 2009-01-05 - 6.010
nProtect 20090105.01 2841654 2009-01-05 Backdoor.Generic.119259 3.439
Quick Heal 10.00 2009.01.05 2009-01-05 - 0.884
Sophos 2.82.1 4.37 2009-01-06 - 2.070
Sunbelt 4755 4755 2008-12-22 - 0.583
The Hacker 6.3.1.2 v00205 2009-01-04 - 0.504
VBA32 3.12.8.10 20090105.1110 2009-01-05 - 1.523
ViRobot 20090105 2009.01.05 2009-01-05 - 0.415
VirusBuster 4.5.11.10 10.100.16/757569 2009-01-05 - 1.150
卡巴斯基 5.5.10 2009.01.05 2009-01-05 - 0.124
安博士V3 2009.01.06.01 2009.01.06 2009-01-06 VBS/Downloader.57856 1.062
安天 2.0.18 20090105.1950502 2009-01-05 - 0.017
江民杀毒 11.0.706 2009.01.04 2009-01-04 - 1.555
熊猫卫士 9.05.01 2009.01.05 2009-01-05 Generic Backdoor 2.351
瑞星 20.0 21.11.02.00 2009-01-05 - 1.047
赛门铁克 1.3.0.24 20090105.009 2009-01-05 - 0.187
趋势科技 8.700-1004 5.748.13 2009-01-05 TROJ_DLOADER.OZ 0.054
迈克菲 5.3.00 5486 2009-01-05 Generic Downloader.x 2.818
金山毒霸 2008.9.8.18 2009.1.6.10 2009-01-06 - 0.607
飞塔 2.81-3.117 9.895 2009-01-05 W32/Dloader.OZ!tr

[ 本帖最后由 ldy144028 于 2009-1-6 09:55 编辑 ]

显示全部楼层 · 发表于 2009-1-6 09:58:03

虽然看不懂不过能帮你顶下

显示全部楼层 · 发表于 2009-1-6 10:03:10

panda直接删除

显示全部楼层 · 发表于 2009-1-6 12:26:30

应该是误报吧

显示全部楼层 · 发表于 2009-1-6 12:30:02

C:\Documents and Settings\桌面\新建文件夹\AMW71AD.rar > RAR > AMW71AD.tmp - 可能是 Win32/TrojanDownloader.Agent 特洛伊木马的变种 - 是已删除对象的一部分

显示全部楼层 · 发表于 2009-1-6 17:19:57

File ID  Filename Size (Byte) Result
25225696  AMW71AD.rar 20.75 KB OK

A listing of files contained inside archives alongside their results can be found below:

File ID  Filename Size (Byte) Result
25225697  AMW71AD.tmp  49 KB  UNDER ANALYSIS
-----------------------------------------------------------------------------------
红伞上报。

显示全部楼层 · 发表于 2009-1-7 09:15:23

原帖由 J-F-F 于 2009-1-6 12:12 发表
典型的误报

误报？？？怎么说啊

显示全部楼层 · 发表于 2009-1-7 22:23:57

这么多样本呀，可能是误报吧

显示全部楼层 · 发表于 2009-1-7 22:49:06

原帖由 08红伞威点 于 2009-1-6 17:19 发表
File ID  Filename Size (Byte) Result
25225696  AMW71AD.rar 20.75 KB OK

A listing of files contained inside archives alongside their results can be found below:

File ID  Filename Size (Byte) R ...

File ID	Filename	Size (Byte)	Result
25225697	AMW71AD.tmp	49 KB	MALWARE

Please find a detailed report concerning each individual sample below:

Filename	Result
AMW71AD.tmp	MALWARE

The file 'AMW71AD.tmp' has been determined to be 'MALWARE'.
Our analysts named the threat BDS/Generic.119259. The term "BDS/" denotes a Backdoor-Server program. Backdoor-Server programs are used to spy out, modify or delete data.Detection is added to our virus definition file (VDF) starting with version 7.01.01.74.

------------------------------
红伞已入库。

[病毒样本] 前天查到的一个样本，大家看看

本帖子中包含更多资源

本帖子中包含更多资源