两个样本测试下~ 卡巴 飘过~~

tonger2003

两个样本测试下~ 卡巴 飘过~~

紫外线

原帖由 tonger2003 于 2007-2-7 18:38 发表
两个样本测试下~ 卡巴 飘过~~

AntiVir	Found nothing
ArcaVir	Found nothing
Avast	Found nothing
AVG Antivirus	Found nothing
BitDefender	Found nothing
ClamAV	Found nothing
Dr.Web	Found nothing
F-Prot Antivirus	Found nothing
F-Secure Anti-Virus	Found nothing
Fortinet	Found nothing
Kaspersky Anti-Virus	Found nothing
NOD32	Found nothing
Norman Virus Control	Found nothing
VirusBuster	Found nothing
VBA32	Found nothing

AntiVir	Found TR/Crypt.NSPM.Gen
ArcaVir	Found nothing
Avast	Found nothing
AVG Antivirus	Found nothing
BitDefender	Found BehavesLike:Win32.Malware (probable variant)
ClamAV	Found nothing
Dr.Web	Found nothing
F-Prot Antivirus	Found Possibly a new variant of W32/PWStealer.gen1
F-Secure Anti-Virus	Found nothing
Fortinet	Found nothing
Kaspersky Anti-Virus	Found nothing
NOD32	Found nothing
Norman Virus Control	Found nothing
VirusBuster	Found nothing
VBA32	Found MalwareScope.Worm.Viking.4

nod都没报。。

zxy900906

第二个NOD运行也不报..

zzh161

费尔不报第一个，启发式报了第二个

jimmyleo

第一个 已上报 感谢提供
第二个 红伞[已知]报

kp2006

pcc 2007报patch.rar possible_mlwr-1

鼻耳盖子

文件生成关系
C:\WINNT\SYSTEM32\KAV26.DLL C:\WINNT\SVCH0ST.EXE
C:\WINNT\SVCH0ST.EXE I:\TEST\070207\5\PATCH\PATCH.EXE

注册表也改了
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ SJX2XU9L  C:\WINNT\SVCH0ST.EXE I:\TEST\070207\5\PATCH\PATCH.EXE

turkey2k6

微点很强悍啊

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\patch.rar'
C:\Documents and Settings\Administrator\My Documents\
  patch.rar
    [0] Archive type: RAR
    --> patch.exe
        [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!
Begin scan in 'C:\Documents and Settings\Administrator\My Documents\derr.rar'
C:\Documents and Settings\Administrator\My Documents\
  derr.rar
    [0] Archive type: RAR
    --> derr.exe

mofunzone

第二个文件运行之后没找到数据就自动退出了
不过仍然感谢提供样本
antivir上报完毕
谢谢
Thank you for your submission. Below you can see the current status of the uploaded files.


A listing of files contained inside archives alongside their results can be found below:File ID         Filename         Size (Byte)        Result
203745         derr.exe         32.768         UNDER ANALYSIS



Please find a detailed report concerning each individual sample below: Filename        Result
derr.exe         UNDER ANALYSIS


The file 'derr.exe' has been determined to be 'UNDER ANALYSIS'.

Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.