传说中的李鬼？？？

FLogo

冒牌的瑞星病毒库升级软件，囧呀，kaba miss ，等待kaba fans 继续上报！（rising MISS）

saga3721

'TR/Dropper.Gen [trojan]'

kkgh

是瑞星升级保姆

gomu887

文件 UP2009.exe 接收于 2009.01.22 08:27:49 (CET)

反病毒引擎	版本	最后更新	扫描结果
a-squared	4.0.0.73	2009.01.22	Backdoor.Win32.Hupigon!IK
AhnLab-V3	5.0.0.2	2009.01.22	-
AntiVir	7.9.0.57	2009.01.22	TR/Dropper.Gen
Authentium	5.1.0.4	2009.01.22	W32/Nuj.A.gen!Eldorado
Avast	4.8.1281.0	2009.01.21	Win32:Agent-TMM
AVG	8.0.0.229	2009.01.22	Suspicion: unknown virus
BitDefender	7.2	2009.01.22	DeepScan:Generic.Malware.SFM!b.D3EC591B
CAT-QuickHeal	10.00	2009.01.22	(Suspicious) - DNAScan
ClamAV	0.94.1	2009.01.22	PUA.Packed.NPack-3
Comodo	940	2009.01.21	TrojWare.Win32.TrojanClicker.Flyst.~O
DrWeb	4.44.0.09170	2009.01.22	-
eSafe	7.0.17.0	2009.01.20	Suspicious File
eTrust-Vet	31.6.6319	2009.01.21	-
F-Prot	4.4.4.56	2009.01.21	W32/Nuj.A.gen!Eldorado
F-Secure	8.0.14470.0	2009.01.22	W32/Packed_NSPack.B
Fortinet	3.117.0.0	2009.01.22	-
GData	19	2009.01.22	DeepScan:Generic.Malware.SFM!b.D3EC591B
Ikarus	T3.1.1.45.0	2009.01.22	Backdoor.Win32.Hupigon
K7AntiVirus	7.10.599	2009.01.22	-
Kaspersky	7.0.0.125	2009.01.22	-
McAfee	5502	2009.01.21	New Malware.u
McAfee+Artemis	5502	2009.01.21	New Malware.u
Microsoft	1.4205	2009.01.22	-
NOD32	3787	2009.01.22	-
Norman	5.93.01	2009.01.21	W32/Packed_NSPack.B
nProtect	2009.1.8.0	2009.01.22	-
Panda	9.5.1.2	2009.01.21	-
PCTools	4.4.2.0	2009.01.21	Packed/NSPack
Prevx1	V2	2009.01.22	Malicious Software
Rising	21.13.31.00	2009.01.22	-
SecureWeb-Gateway	6.7.6	2009.01.22	Packer.NSPack
Sophos	4.37.0	2009.01.22	Mal/Packer
Sunbelt	3.2.1835.2	2009.01.16	-
Symantec	10	2009.01.22	-
TheHacker	6.3.1.5.225	2009.01.21	W32/Behav-Heuristic-067
TrendMicro	8.700.0.1004	2009.01.22	Cryp_Xed-6
VBA32	3.12.8.10	2009.01.22	Trojan.BAT.KillAV.df
ViRobot	2009.1.22.1573	2009.01.22	-
VirusBuster	4.5.11.0	2009.01.21	Packed/NSPack
附加信息
File size: 1016918 bytes
MD5...: b2782fad6e727f8961c568665b28030c
SHA1..: d9b4fcced5179a66779bea3daeb3a791e772fe18
SHA256: 6f6cb585033916359352852e495e6072f99cc8e3ef31cd7e97c7d64d4a02fa6f
SHA512: 20c28dbb0f547f5bd50e7ca76e04c1c16e320dc725acc6159796dd4725d8461f<BR>12164f89dd6ba30f4eeda8de78e4e6886e7a115b64542dc7313d7a738027f1c1<BR>
ssdeep: 24576:C9fzXmLz09RzD/L98/f76MjkgIf3XpnMtUN+cBB7RMr5BsUgIuh:C97Xh9<BR>ZDL9kD65WUwcX7RQ5BsUgdh<BR>
PEiD..: -
TrID..: File type identification<BR>DOS Executable Generic (100.0%)
PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x42080d<BR>timedatestamp.....: 0x59bffa3 (Mon Dec 25 05:33:23 1972)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 3 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>.nsp0 0x1000 0x1d000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e<BR>.nsp1 0x1e000 0xf000 0xe361 7.73 1b4d9b48d714eeb1e2e23e958bc38a3e<BR>.nsp2 0x2d000 0x1034 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e<BR><BR>( 2 imports ) <BR>&gt; KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess<BR>&gt; USER32.DLL: MessageBoxA<BR><BR>( 0 exports ) <BR>
packers (Kaspersky): PE_Patch, NSPack
Prevx info: &lt;a href='http://info.prevx.com/aboutprogramtext.asp?PX5=65AF15C156D30B96840C0F7929E7AD003A0D1BD9' target='_blank'&gt;http://info.prevx.com/aboutprogr ... D003A0D1BD9&amp;lt;/a&gt;
packers (Authentium): NSPack, PE_Patch
packers (F-Prot): NSPack, PE_Patch

Palkia

恩~早上已经上报

尤金卡巴斯基

Hello,

UP2009.exe_ - Trojan.Win32.FlyStudio.fx

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.
The answer is relevant to the latest bases from update sources.

Regards, Andrey Ladikov
Virus Analyst, Kaspersky Lab.

Hopesky

to DrWeb

jijiasd

这年头保姆也作假