山寨杀毒软件提取出来的样本

显示全部楼层 · 发表于 2009-5-13 23:30:30

我的NOD32报的。可有高手来分析下？

山寨网址http://www.medusa1375.cn/
VirSCAN.org Scanned Report :
Scanned time : 2009/05/13 23:19:04 (CST)
Scanner results: 16%的杀软(6/38)报告发现病毒
File Name    : MedusaProc.exe
File Size    : 1099368 byte
File Type    : PE32 executable for MS Windows (console) Intel 80386 32-bit
MD5          : 4989398f39150c5437688767b2696643
SHA1          : ad07e628dbbe0b3e6f9ee49ce47611b1c848e3d8
Online report  : http://virscan.org/report/10dcf44366d50ea62e7a192a4855167e.html
Scanner       Engine Ver    Sig Ver          Sig Date Time Scan result
a-squared    4.0.0.32       20090513145023 2009-05-13  2.44 -
安博士V3    2009.05.13.02 2009.05.13       2009-05-13  0.78 -
AntiVir       8.2.0.166    7.1.3.197       2009-05-13  0.12 -
安天          2.0.18       20090513.2406204  2009-05-13  0.18 -
Arcavir       2009          200905130930    2009-05-13  0.23 Heur.RoundKick
Authentium    5.1.1          200905122328    2009-05-12  1.47 W32/Injector.A.gen!Eldorado (Possible)
AVAST!       4.7.4          090512-0       2009-05-12  0.07 -
AVG          8.5.286       270.12.27/2112 2009-05-13  4.77 -
BitDefender 7.81008.2964787 7.25381          2009-05-13  3.19 -
CA (VET)    9.0.0.143    31.6.6502       2009-05-13  5.93 -
ClamAV       0.95          9355             2009-05-13  0.46 -
Comodo       3.8          1157             2009-05-08  0.76 -
CP Secure    1.1.0.715    2009.05.13       2009-05-13  10.04  -
Dr.Web       4.44.0.9170    2009.05.13       2009-05-13  5.62 BACKDOOR.Trojan
F-Prot       4.4.4.56       20090512       2009-05-12  2.06 W32/Injector.A.gen!Eldorado (generic, not disinfectable)
F-Secure    5.51.6100    2009.05.13.07    2009-05-13  0.11 -
飞塔          2.81-3.117    10.384          2009-05-13  0.38 Suspicious
GData       19.5197/19.328  20090513       2009-05-13  3.45 -
ViRobot       20090513       2009.05.13       2009-05-13  0.56 -
Ikarus       T3.1.01.49    2009.05.13.72714  2009-05-13  4.33 -
江民杀毒    11.0.706       2009.05.13       2009-05-13  2.37 -
卡巴斯基    5.5.10       2009.05.13       2009-05-13  0.07 -
金山毒霸    2009.2.5.15    2009.5.13.18    2009-05-13  0.51 -
迈克菲       5.3.00       5613             2009-05-12  3.35 -
Microsoft    1.4602       2009.05.13       2009-05-13  5.83 -
mks_vir       2.01          2009.05.12       2009-05-12  3.88 -
Norman       6.01.05       6.01.00          2009-05-13  4.07 -
熊猫卫士    9.05.01       2009.05.11       2009-05-11  1.16 -
趋势科技    8.700-1004    6.126.03       2009-05-13  0.08 -
Quick Heal    10.00          2009.05.13       2009-05-13  1.89 -
瑞星          20.0          21.29.24.00    2009-05-13  0.92 -
Sophos       2.86.0       4.41             2009-05-13  7.57 Mal/Behav-156
Sunbelt       5129          5129             2009-05-11  0.96 -
赛门铁克    1.3.0.24       20090512.003    2009-05-12  0.06 -
nProtect    20090513.01    3661809          2009-05-13  6.28 -
The Hacker    6.3.4.1       v00325          2009-05-12  0.65 -
VBA32       3.12.10.5    20090512.1718    2009-05-12  2.09 -
VirusBuster 4.5.11.10    10.105.25/1350489 2009-05-13  1.98 -

显示全部楼层 · 发表于 2009-5-13 23:31:38

文件 MedusaProc.exe 接收于 2009.05.13 17:25:09 (CET)反病毒引擎版本最后更新扫描结果
a-squared 4.0.0.101 2009.05.13 -
AhnLab-V3 5.0.0.2 2009.05.13 -
AntiVir 7.9.0.166 2009.05.13 -
Antiy-AVL 2.0.3.1 2009.05.13 -
Authentium 5.1.2.4 2009.05.13 W32/Injector.A.gen!Eldorado
Avast 4.8.1335.0 2009.05.12 -
AVG 8.5.0.327 2009.05.13 -
BitDefender 7.2 2009.05.13 -
CAT-QuickHeal 10.00 2009.05.13 -
ClamAV 0.94.1 2009.05.13 -
Comodo 1157 2009.05.08 -
DrWeb 5.0.0.12182 2009.05.13 BACKDOOR.Trojan
eSafe 7.0.17.0 2009.05.12 -
eTrust-Vet 31.6.6503 2009.05.13 -
F-Prot 4.4.4.56 2009.05.13 W32/Injector.A.gen!Eldorado
F-Secure 8.0.14470.0 2009.05.13 -
Fortinet 3.117.0.0 2009.05.13 -
GData 19 2009.05.13 -
Ikarus T3.1.1.49.0 2009.05.13 -
K7AntiVirus 7.10.734 2009.05.13 -
Kaspersky 7.0.0.125 2009.05.13 -
McAfee 5613 2009.05.12 -
McAfee+Artemis 5613 2009.05.12 -
McAfee-GW-Edition 6.7.6 2009.05.13 -
Microsoft 1.4602 2009.05.13 -
NOD32 4071 2009.05.13 probably a variant of Win32/Genetik
Norman 6.01.05 2009.05.13 -
nProtect 2009.1.8.0 2009.05.13 -
Panda 10.0.0.14 2009.05.13 -
PCTools 4.4.2.0 2009.05.07 -
Prevx 3.0 2009.05.13 -
Rising 21.29.24.00 2009.05.13 -
Sophos 4.41.0 2009.05.13 Mal/Behav-156
Symantec 1.4.4.12 2009.05.13 -
TheHacker 6.3.4.1.325 2009.05.12 -
TrendMicro 8.950.0.1092 2009.05.13 -
VBA32 3.12.10.5 2009.05.13 -
ViRobot 2009.5.13.1733 2009.05.13 -
VirusBuster 4.6.5.0 2009.05.13 -

显示全部楼层 · 发表于 2009-5-14 11:02:14

好像不是病毒呢我拿去在线沙盘分析下先....
EQ 安静规则没提示..

显示全部楼层 · 发表于 2009-5-14 11:05:39

应该不是病毒吧?!!

http://camas.comodo.com/cgi-bin/ ... 512321aa4e926c97e79

显示全部楼层 · 发表于 2009-5-14 11:38:31

卡巴没有说是毒...

显示全部楼层 · 发表于 2009-5-14 21:32:38

没发现异常行为。。

[可疑文件] 山寨杀毒软件提取出来的样本

本帖子中包含更多资源