红伞 nod 报启发（已上传完整程序包）

jhtl

文件 BzHehun.exe 接收于 2009.08.04 01:43:00 (UTC)

反病毒引擎	版本	最后更新	扫描结果
a-squared	4.5.0.24	2009.08.04	-
AhnLab-V3	5.0.0.2	2009.08.03	-
AntiVir	7.9.0.240	2009.08.03	HEUR/Crypted
Antiy-AVL	2.0.3.7	2009.08.03	-
Authentium	5.1.2.4	2009.08.03	-
Avast	4.8.1335.0	2009.08.04	-
AVG	8.5.0.406	2009.08.03	-
BitDefender	7.2	2009.08.04	-
CAT-QuickHeal	10.00	2009.08.03	(Suspicious) - DNAScan
ClamAV	0.94.1	2009.08.04	-
Comodo	1856	2009.08.04	-
DrWeb	5.0.0.12182	2009.08.04	-
eSafe	7.0.17.0	2009.08.03	Suspicious File
eTrust-Vet	31.6.6656	2009.08.04	-
F-Prot	4.4.4.56	2009.08.03	-
F-Secure	8.0.14470.0	2009.08.04	-
Fortinet	3.120.0.0	2009.08.03	-
GData	19	2009.08.04	-
Ikarus	T3.1.1.64.0	2009.08.04	-
Jiangmin	11.0.800	2009.08.03	-
K7AntiVirus	7.10.809	2009.08.03	-
Kaspersky	7.0.0.125	2009.08.04	-
McAfee	5697	2009.08.03	-
McAfee+Artemis	5697	2009.08.03	-
McAfee-GW-Edition	6.8.5	2009.08.03	Heuristic.LooksLike.Trojan.Dropper.C
Microsoft	1.4903	2009.08.03	-
NOD32	4302	2009.08.03	probably unknown NewHeur_PE
Norman	6.01.09	2009.08.03	-
nProtect	2009.1.8.0	2009.08.04	-
Panda	10.0.0.14	2009.08.03	-
PCTools	4.4.2.0	2009.08.03	-
Prevx	3.0	2009.08.04	-
Rising	21.41.02.00	2009.08.03	-
Sophos	4.44.0	2009.08.04	-
Sunbelt	3.2.1858.2	2009.08.04	-
Symantec	1.4.4.12	2009.08.04	-
TheHacker	6.3.4.3.375	2009.08.01	-
TrendMicro	8.950.0.1094	2009.08.03	-
VBA32	3.12.10.9	2009.08.04	-
ViRobot	2009.8.3.1865	2009.08.03	-
VirusBuster	4.6.5.0	2009.08.03	-
附加信息
File size: 509952 bytes
MD5...: 3d0ed082a795d65350d1a0716af0b8b8
SHA1..: 8f4ddc2fc4eb950d76309acfb5dc424521df85a5
SHA256: fb007d8688a6e2a876941a8cb39b7ef783d6cdea8223e6d06332c72088afb8d5
ssdeep: 12288:pfvBlhrENpUxN2X1PqYMoZ2d4wwgWpSR/tIMSkm8lNZA:FR4bUL2X1hM42<BR>dtWs/9SuA<BR>
PEiD..: PECompact 2.xx --> BitSum Technologies
TrID..: File type identification<BR>Win32 EXE PECompact compressed (v2.x) (48.9%)<BR>Win32 EXE PECompact compressed (generic) (34.4%)<BR>Win32 Executable Generic (7.0%)<BR>Win32 Dynamic Link Library (generic) (6.2%)<BR>Generic Win/DOS Executable (1.6%)

）

[ 本帖最后由 jhtl 于 2009-8-4 10:31 编辑 ]

小兔乖乖

无不良行为！

[ 本帖最后由 小兔乖乖 于 2009-8-4 10:00 编辑 ]

jhtl

这只是一个程序的一个exe。。。

何倩

没发现什么不良行为,下次可要搞个真正病毒的样本上来

Nicklong2007

IKARUS

date/time: 2009-8-5 13:36:37
filename: 南方八字合婚程序v1.0[1].rar
original path: c:\Documents and Settings\======\Local Settings\Temporary Internet Files\Content.IE5\AZ0B2X4H\
filesize: 816.16 KB
virusname: Virus.Win32.Neptunia
suggestion: deleted
signatureId: 16470454

剩下的没报，不过看楼上两位的说法，两个都CLEAN？