不知道是不是毒

Snorelax

RT

[ 本帖最后由 Snorelax 于 2007-2-27 16:47 编辑 ]

jlennon

Virus check with AntiVirusKit
Version 17.0.6282
Virus signatures of 1/5/2007
Start time: 2/27/2007 16:55
Engine(s): Engine A (AVK 17.1835), Engine B (BD 17.1375)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: install.exe/stream data0003
        In archive: C:\Documents and Settings\Administrator\桌面\install[1].part1.rar
        Status: Virus detected
       Virus: Worm.Win32.Delf.bi (Engine A)
Object: install.exe/stream data0004
        In archive: C:\Documents and Settings\Administrator\桌面\install[1].part1.rar
        Status: Virus detected
        Virus: not-a-virus:AdWare.Win32.IEHlpr.aa (Engine A)
Object: install.exe/stream/data0010/data0003 data0003
        In archive: C:\Documents and Settings\Administrator\桌面\install[1].part1.rar
        Status: Virus detected
        Virus: not-a-virus:AdWare.Win32.Cinmus.j (Engine A)
Object: install.exe/stream/data0010/data0003 data0004
        In archive: C:\Documents and Settings\Administrator\桌面\install[1].part1.rar
        Status: Virus detected
        Virus: not-a-virus:AdWare.Win32.Cinmus.j (Engine A)
Object: install.exe/stream/data0011 data0004
        In archive: C:\Documents and Settings\Administrator\桌面\install[1].part1.rar
        Status: Virus detected
        Virus: not-a-virus:AdWare.Win32.AllSum.c (Engine A)
Object: install.exe/stream/data0011 data0006
        In archive: C:\Documents and Settings\Administrator\桌面\install[1].part1.rar
        Status: Virus detected
       Virus: not-a-virus:AdWare.Win32.AllSum.a (Engine A)
Object: install.exe/stream/data0011 data0007
        In archive: C:\Documents and Settings\Administrator\桌面\install[1].part1.rar
        Status: Virus detected
        Virus: not-a-virus:AdWare.Win32.AllSum.c (Engine A)
Object: install.exe=>(NSIS o)=>lzma_solid_nsis0002=>(NSIS o)=>lzma_solid_nsis0001=>(NSIS o) lzma_nsis0004
        In archive: C:\Documents and Settings\Administrator\桌面\install[1].part1.rar
        Status: Virus detected
       Virus: Adware.Bdsearch.AH (Engine B)
Object: install.exe=>(NSIS o) lzma_solid_nsis0003
        In archive: C:\Documents and Settings\Administrator\桌面\install[1].part1.rar
        Status: Virus detected
        Virus: Trojan.Downloader.Agent.AYX (Engine B)
Object: install.exe=>(NSIS o) lzma_solid_nsis0005
        In archive: C:\Documents and Settings\Administrator\桌面\install[1].part1.rar
        Status: Virus detected
        Virus: MemScan:Trojan.Downloader.VB.WN (Engine B)
Object: install.exe=>(NSIS o)=>lzma_solid_nsis0006=>(NSIS o) lzma_solid_nsis0001
        In archive: C:\Documents and Settings\Administrator\桌面\install[1].part1.rar
        Status: Virus detected
        Virus: Trojan.Ccnic.2ij.DLL (Engine B)
Object: install.exe=>(NSIS o) lzma_solid_nsis0007
        In archive: C:\Documents and Settings\Administrator\桌面\install[1].part1.rar
        Status: Virus detected
        Virus: Trojan.PWS.QQPass.DLN (Engine B)
Object: install.exe=>(NSIS o)=>lzma_solid_nsis0008=>(NSIS o) bzip2_solid_nsis0001
        In archive: C:\Documents and Settings\Administrator\桌面\install[1].part1.rar
        Status: Virus detected
        Virus: MemScan:Trojan.Downloader.VB.WN (Engine B)
Object: install.exe=>(NSIS o)=>lzma_solid_nsis0008=>(NSIS o) bzip2_solid_nsis0002
        In archive: C:\Documents and Settings\Administrator\桌面\install[1].part1.rar
        Status: Suspected virus
        Virus: Trojan.Downloader.Gen (Engine B)
Object: install.exe=>(NSIS o)=>lzma_solid_nsis0010=>(NSIS o)=>lzma_nsis0002=>(NSIS o) lzma_nsis0003
        In archive: C:\Documents and Settings\Administrator\桌面\install[1].part1.rar
        Status: Virus detected
        Virus: Adware.Cinmus.F (Engine B)
Object: install.exe=>(NSIS o) lzma_solid_nsis0011
        In archive: C:\Documents and Settings\Administrator\桌面\install[1].part1.rar
        Status: Virus detected
        Virus: Trojan.Dropper.AU (Engine B)
Object: install[1].part1.rar
        Path: C:\Documents and Settings\Administrator\桌面
        Status: Move file into quarantine
        Virus: Worm.Win32.Delf.bi, not-a-virus:AdWare.Win32.IEHlpr.aa, not-a-virus:AdWare.Win32.Cinmus.j (2x), not-a-virus:AdWare.Win32.AllSum.c (2x), not-a-virus:AdWare.Win32.AllSum.a (Engine A), Adware.Bdsearch.AH, Trojan.Downloader.Agent.AYX, MemScan:Trojan.Downloader.VB.WN (2x), Trojan.Ccnic.2ij.DLL, Trojan.PWS.QQPass.DLN, Trojan.Downloader.Gen, Adware.Cinmus.F, Trojan.Dropper.AU (Engine B)
Analysis complete: 2/27/2007 16:55
    4 files checked
    1 infected files detected
    0 suspected files detected

[ 本帖最后由 jlennon 于 2007-2-27 17:02 编辑 ]

shenrenrenren

原来似乎发过，不知道是不是记错了。

小飞侠.net

这个是流氓/恶意软件N合一～～伪装成卡巴图标。以前测试过～集成驱动多了还蓝屏～害我返工～～

mofunzone

antivri又蜕壳失败。。
把你生成物发上，原程序已经上报了
Thank you for your submission. Below you can see the current status of the uploaded files.


A listing of files alongside their results can be found below:File ID         Filename         Size (Byte)        Result
214394         install.exe         1.952.099         UNDER ANALYSIS



Please find a detailed report concerning each individual sample below: Filename        Result
install.exe         UNDER ANALYSIS


The file 'install.exe' has been determined to be 'UNDER ANALYSIS'.

Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.

mofunzone

用peid看是什么null studio sfx的集成的东西。。
发现antivir对sfx和压缩文件类似7z的支持很不好

mofunzone

AntiVir         Found nothing
ArcaVir         Found nothing
Avast         Found nothing
AVG Antivirus         Found nothing
BitDefender         Found Adware.Bdsearch.AH, Trojan.Downloader.Agent.AYX, MemScan:Trojan.Downloader.VB.WN, Trojan.Ccnic.2ij.DLL, Trojan.PWS.QQPass.DLN, Trojan.Downloader.Gen, Adware.Cinmus.F, Trojan.Dropper.AU (probable variant)
ClamAV         Found nothing
Dr.Web         Found Adware.Cdn, Adware.Baidu, Win32.HLLW.Pager, Adware.CFS, Trojan.DownLoader.15732, Trojan.PWS.Qqshou, Adware.Cinmus, Adware.Allsum
F-Prot Antivirus         Found nothing
F-Secure Anti-Virus         Found Worm.Win32.Delf.bi, not-a-virus:AdWare.Win32.IEHlpr.aa (4, 1, 400), Trojan-Downloader.Win32.Cryptic.ha, Trojan-Spy.Win32.Delf.ps, not-a-virus:AdWare.Win32.Cinmus.j (4, 1, 400), not-a-virus:AdWare.Win32.AllSum.c (4, 1, 400), not-a-virus:AdWare.Win32.AllSum.a (4, 1, 400)
Fortinet         Found Adware/AllSum
Kaspersky Anti-Virus         Found Worm.Win32.Delf.bi, not-a-virus:AdWare.Win32.IEHlpr.aa, Trojan-Downloader.Win32.Cryptic.ha, Trojan-Spy.Win32.Delf.ps, not-a-virus:AdWare.Win32.Cinmus.j, not-a-virus:AdWare.Win32.AllSum.c, not-a-virus:AdWare.Win32.AllSum.a
NOD32         Found Win32/Adware.Toolbar.Baidu application, a variant of Win32/Agent.NAU, a variant of Win32/TrojanDownloader.VB.APY, probably a variant of Win32/Spy.Delf.PG, Win32/Adware.AllSum application (probable variant)
Norman Virus Control         Found nothing
Panda Antivirus         Found nothing
VirusBuster         Found nothing
VBA32         Found Embedded.Adware.Cdnhelper, Worm.Win32.Delf.bi, Trojan-Downloader.Agent.23 (paranoid heuristics), Trojan-Downloader.Win32.Cryptic.f, Embedded.MalwareScope.Backdoor.Hupigon.10, AdWare.Win32.Cinmus.j, AdWare.Win32.AllSum.c (probable variant)

worker321

反病毒专家 AntiVirusKit 2006 扫描病毒日志记录
版本 16.0.7
双引擎反病毒签名 2007-3-4
开始时间: 2007-3-4 16:30
引擎: KAV 引擎 (AVK 16.10153), BD 引擎 (BD 16.6079)
高启发式: 打开
压缩文件: 打开
系统区域: 打开

扫描系统区域...
扫描所选择的目录和文件...
对象: 2016.exe
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\My Documents.rar
        Status: 已发现病毒
        病毒: Worm.Win32.Delf.bi (KAV 引擎), Trojan.Downloader.Agent.AYX (BD 引擎)
对象: 2031.exe
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\My Documents.rar
        Status: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.IEHlpr.aa (KAV 引擎)
对象: AllInOne00000036.exe
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\My Documents.rar
        Status: 已发现病毒
        病毒: Trojan-Downloader.Win32.Cryptic.ha (KAV 引擎), MemScan:Trojan.Downloader.VB.WN (BD 引擎)
对象: OpenIe.exe
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\My Documents.rar
        Status: 已发现病毒
        病毒: Trojan-Spy.Win32.Delf.ps (KAV 引擎), Trojan.PWS.QQPass.DLN (BD 引擎)
对象: dodolook048.exe/data0003 data0003
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\My Documents.rar
        Status: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.Cinmus.j (KAV 引擎)
对象: dodolook048.exe/data0003 data0004
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\My Documents.rar
        Status: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.Cinmus.j (KAV 引擎)
对象: wd2_051117_NAV077_mini.exe data0004
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\My Documents.rar
        Status: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.AllSum.c (KAV 引擎)
对象: wd2_051117_NAV077_mini.exe data0006
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\My Documents.rar
        Status: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.AllSum.a (KAV 引擎)
对象: wd2_051117_NAV077_mini.exe data0007
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\My Documents.rar
        Status: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.AllSum.c (KAV 引擎)
对象: 19dg.exe=>(NSIS o)=>lzma_solid_nsis0001=>(NSIS o) lzma_nsis0004
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\My Documents.rar
        Status: 已发现病毒
        病毒: Adware.Bdsearch.AH (BD 引擎)
对象: DOWN.exe=>(NSIS o) lzma_solid_nsis0001
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\My Documents.rar
        Status: 已发现病毒
        病毒: Trojan.Ccnic.2ij.DLL (BD 引擎)
对象: dodolook048.exe=>(NSIS o)=>lzma_nsis0002=>(NSIS o) lzma_nsis0003
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\My Documents.rar
        Status: 已发现病毒
        病毒: Adware.Cinmus.F (BD 引擎)
对象: wd2_051117_NAV077_mini.exe
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\My Documents.rar
        Status: 已发现病毒
        病毒: Trojan.Dropper.AU (BD 引擎)
对象: rundll32.exe
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\My Documents.rar
        Status: 已发现病毒
        病毒: MemScan:Trojan.Downloader.VB.WN (BD 引擎)
对象: setup.exe
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\My Documents.rar
        Status: 可疑病毒
        病毒: Trojan.Downloader.Gen (BD 引擎)
对象: My Documents.rar
        路径: C:\Documents and Settings\Administrator\桌面
        Status: 已发现病毒
        病毒: Worm.Win32.Delf.bi, not-a-virus:AdWare.Win32.IEHlpr.aa, Trojan-Downloader.Win32.Cryptic.ha, Trojan-Spy.Win32.Delf.ps, not-a-virus:AdWare.Win32.Cinmus.j (2x), not-a-virus:AdWare.Win32.AllSum.c (2x), not-a-virus:AdWare.Win32.AllSum.a (KAV 引擎), Adware.Bdsearch.AH, Trojan.Downloader.Agent.AYX, MemScan:Trojan.Downloader.VB.WN (2x), Trojan.Ccnic.2ij.DLL, Trojan.PWS.QQPass.DLN, Adware.Cinmus.F, Trojan.Dropper.AU, Trojan.Downloader.Gen (BD 引擎)
对象: nsm242.tmp
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\nsm242.rar
        Status: 已发现病毒
        病毒: Trojan.Dropper.AU (BD 引擎)
对象: nsm242.rar
        路径: C:\Documents and Settings\Administrator\桌面
        Status: 已发现病毒
        病毒: Trojan.Dropper.AU (BD 引擎)
对象: stream data0003
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\install\install.exe
        Status: 已发现病毒
        病毒: Worm.Win32.Delf.bi (KAV 引擎)
对象: stream data0004
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\install\install.exe
        Status: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.IEHlpr.aa (KAV 引擎)
对象: stream data0005
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\install\install.exe
        Status: 已发现病毒
        病毒: Trojan-Downloader.Win32.Cryptic.ha (KAV 引擎)
对象: stream data0007
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\install\install.exe
        Status: 已发现病毒
        病毒: Trojan-Spy.Win32.Delf.ps (KAV 引擎)
对象: stream/data0010/data0003 data0003
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\install\install.exe
        Status: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.Cinmus.j (KAV 引擎)
对象: stream/data0010/data0003 data0004
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\install\install.exe
        Status: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.Cinmus.j (KAV 引擎)
对象: stream/data0011 data0004
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\install\install.exe
        Status: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.AllSum.c (KAV 引擎)
对象: stream/data0011 data0006
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\install\install.exe
        Status: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.AllSum.a (KAV 引擎)
对象: stream/data0011 data0007
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\install\install.exe
        Status: 已发现病毒
        病毒: not-a-virus:AdWare.Win32.AllSum.c (KAV 引擎)
对象: (NSIS o)=>lzma_solid_nsis0002=>(NSIS o)=>lzma_solid_nsis0001=>(NSIS o) lzma_nsis0004
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\install\install.exe
        Status: 已发现病毒
        病毒: Adware.Bdsearch.AH (BD 引擎)
对象: (NSIS o) lzma_solid_nsis0003
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\install\install.exe
        Status: 已发现病毒
        病毒: Trojan.Downloader.Agent.AYX (BD 引擎)
对象: (NSIS o) lzma_solid_nsis0005
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\install\install.exe
        Status: 已发现病毒
        病毒: MemScan:Trojan.Downloader.VB.WN (BD 引擎)
对象: (NSIS o)=>lzma_solid_nsis0006=>(NSIS o) lzma_solid_nsis0001
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\install\install.exe
        Status: 已发现病毒
        病毒: Trojan.Ccnic.2ij.DLL (BD 引擎)
对象: (NSIS o) lzma_solid_nsis0007
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\install\install.exe
        Status: 已发现病毒
        病毒: Trojan.PWS.QQPass.DLN (BD 引擎)
对象: (NSIS o)=>lzma_solid_nsis0008=>(NSIS o) bzip2_solid_nsis0001
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\install\install.exe
        Status: 已发现病毒
        病毒: MemScan:Trojan.Downloader.VB.WN (BD 引擎)
对象: (NSIS o)=>lzma_solid_nsis0008=>(NSIS o) bzip2_solid_nsis0002
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\install\install.exe
        Status: 可疑病毒
        病毒: Trojan.Downloader.Gen (BD 引擎)
对象: (NSIS o)=>lzma_solid_nsis0010=>(NSIS o)=>lzma_nsis0002=>(NSIS o) lzma_nsis0003
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\install\install.exe
        Status: 已发现病毒
        病毒: Adware.Cinmus.F (BD 引擎)
对象: (NSIS o) lzma_solid_nsis0011
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\install\install.exe
        Status: 已发现病毒
        病毒: Trojan.Dropper.AU (BD 引擎)
对象: install.exe
        路径: C:\Documents and Settings\Administrator\桌面\install
        Status: 已发现病毒
        病毒: Worm.Win32.Delf.bi, not-a-virus:AdWare.Win32.IEHlpr.aa, Trojan-Downloader.Win32.Cryptic.ha, Trojan-Spy.Win32.Delf.ps, not-a-virus:AdWare.Win32.Cinmus.j (2x), not-a-virus:AdWare.Win32.AllSum.c (2x), not-a-virus:AdWare.Win32.AllSum.a (KAV 引擎), Adware.Bdsearch.AH, Trojan.Downloader.Agent.AYX, MemScan:Trojan.Downloader.VB.WN (2x), Trojan.Ccnic.2ij.DLL, Trojan.PWS.QQPass.DLN, Trojan.Downloader.Gen, Adware.Cinmus.F, Trojan.Dropper.AU (BD 引擎)
扫描完成: 2007-3-4 16:31
    已检查 14 个文件
    已发现 3 个染毒文件
    发现 0 个可疑文件