刚刚收集的样本 4x

magicyujun

mcafee刚解压就干掉了

08红伞威点

Start of the scan: 2009年1月22日  02:09
Starting the file scan:

Begin scan in 'C:\Documents and Settings\***\桌面\过江民主防小心打开.rar'
C:\Documents and Settings\***\桌面\过江民主防小心打开.rar
    [0] Archive type: RAR
    -->***\manage.exe
      [DETECTION] Contains HEUR/Crypted suspicious code
    [NOTE]      A backup was created as 'b588d120.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
-----------------------------------------启发。to Avira.
Begin scan in 'C:\Documents and Settings\***\桌面\蓝屏样本小心打开.rar'
C:\Documents and Settings\***\桌面\蓝屏样本小心打开.rar
    [0] Archive type: RAR
    --> Exploit.exe
      [DETECTION] Contains recognition pattern of the EXP/Crash.B exploit
    [NOTE]      A backup was created as 'b1aec15f.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
----------------------------------------------------------
Begin scan in 'C:\Documents and Settings\***\桌面\木马小心打开.rar'
C:\Documents and Settings\***\桌面\木马小心打开.rar
    [0] Archive type: RAR
    --> 08851\kk.exe
      [DETECTION] Contains recognition pattern of the DR/Delf.ftn.1 dropper
      --> 08851\kk.exe
        [1] Archive type: RAR SFX (self extracting)
        --> Trojan.exe
          [DETECTION] Is the TR/Crypt.CFI.Gen Trojan
    --> 08851\pp.exe
      [DETECTION] Contains recognition pattern of the DR/Delf.ftn dropper
      --> 08851\pp.exe
        [1] Archive type: RAR SFX (self extracting)
        --> Trojan.exe
          [DETECTION] Is the TR/Crypt.CFI.Gen Trojan
    [NOTE]      A backup was created as 'a586ffa3.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
----------------------------------------------------------
Begin scan in 'C:\Documents and Settings\***\桌面\删系统文件病毒__小心打开.rar'
C:\Documents and Settings\***\桌面\删系统文件病毒__小心打开.rar
    [0] Archive type: RAR
    --> Anti Virus Killer.exe
      [DETECTION] Is the TR/FraudPack.amd Trojan
    [NOTE]      A backup was created as 'c856e257.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
---------------------------------------------------------------------------------------------------------------
入库3个，红伞S版(库V7.01.01.159版)杀。

08红伞威点

Filename Result
manage.exe  MALWARE

The file 'manage.exe' has been determined to be 'MALWARE'. Our analysts named the threat BDS/Hupigon.fmnb. The term "BDS/" denotes a Backdoor-Server program. Backdoor-Server programs are used to spy out, modify or delete data.Detection is added to our virus definition file (VDF) starting with version 7.01.01.95. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Crypted.
------------------------------------------------------------------------启发。to Avira.