13岁杀软作者给的

PPwangS

Antivirus Version Update Result AntiVir 7.3.1.38 03.04.2007 no virus found Authentium 4.93.8 03.04.2007 no virus found Avast 4.7.936.0 03.03.2007 no virus found AVG 7.5.0.447 03.03.2007 Constructor.ACG BitDefender 7.2 03.04.2007 Virtool.Constructor.Delf.G CAT-QuickHeal 9.00 03.02.2007 no virus found ClamAV devel-20060426 03.04.2007 no virus found DrWeb 4.33 03.04.2007 no virus found eSafe 7.0.14.0 03.04.2007 no virus found eTrust-Vet 30.6.3449 03.03.2007 no virus found Ewido 4.0 03.03.2007 no virus found FileAdvisor 1 03.04.2007 no virus found Fortinet 2.85.0.0 03.04.2007 suspicious F-Prot 4.3.1.45 03.04.2007 W32/VirTool.CZ F-Secure 6.70.13030.0 03.03.2007 no virus found Ikarus T3.1.1.3 03.04.2007 no virus found Kaspersky 4.0.2.24 03.04.2007 no virus found McAfee 4975 03.02.2007 no virus found Microsoft 1.2204 03.04.2007 no virus found NOD32v2 2093 03.03.2007 no virus found Norman 5.80.02 03.02.2007 W32/Hengbang.AC Panda 9.0.0.4 03.04.2007 Suspicious file Prevx1 V2 03.04.2007 no virus found Sophos 4.14.0 03.03.2007 no virus found Sunbelt 2.2.907.0 03.01.2007 no virus found Symantec 10 03.04.2007 no virus found TheHacker 6.1.6.067 03.01.2007 no virus found UNA 1.83 03.02.2007 no virus found VBA32 3.11.2 03.03.2007 Constructor.Win32.Delf.g VirusBuster 4.3.19:9 03.03.2007 Constructor.Delf.ZW!AU Aditional Information File size: 196835 bytes MD5: bb6d1b938f9c9e4215badd6a941e3794 SHA1: 845acfc0d447e631a3378117ffeb24efcae06224 packers: UPX packers: UPX, UPX packers: UPX, ZIP, RAR

13岁杀软作者给的，貌似很强，基本都不过。

经过分析，解包，得出：
多层嵌套，每层都用 UPX 加了壳，最后的文件是微软的记事本和一个后缀名改成 bat 的可疑文件BV2008.bat，改名后查处使用 delphi 编写，这个测试软件脱壳不错。。下面是这个文件的结果：

Antivirus	Version	Update	Result
AntiVir	7.3.1.38	03.04.2007	no virus found
Authentium	4.93.8	03.04.2007	is a virus tool named W32/VirTool.CZ
Avast	4.7.936.0	03.03.2007	no virus found
AVG	7.5.0.447	03.03.2007	Constructor.ACG
BitDefender	7.2	03.04.2007	Virtool.Constructor.Delf.G
CAT-QuickHeal	9.00	03.02.2007	TrojanDropper.QuickBatch.e
ClamAV	devel-20060426	03.04.2007	no virus found
DrWeb	4.33	03.04.2007	no virus found
eSafe	7.0.14.0	03.04.2007	no virus found
eTrust-Vet	30.6.3449	03.03.2007	no virus found
Ewido	4.0	03.03.2007	no virus found
FileAdvisor	1	03.04.2007	no virus found
Fortinet	2.85.0.0	03.04.2007	no virus found
F-Prot	4.3.1.45	03.04.2007	W32/VirTool.CZ
F-Secure	6.70.13030.0	03.03.2007	no virus found
Ikarus	T3.1.1.3	03.04.2007	no virus found
Kaspersky	4.0.2.24	03.04.2007	no virus found
McAfee	4975	03.02.2007	no virus found
Microsoft	1.2204	03.04.2007	no virus found
NOD32v2	2093	03.03.2007	no virus found
Norman	5.80.02	03.02.2007	no virus found
Panda	9.0.0.4	03.04.2007	Suspicious file
Prevx1	V2	03.04.2007	no virus found
Sophos	4.14.0	03.03.2007	no virus found
Sunbelt	2.2.907.0	03.01.2007	no virus found
Symantec	10	03.04.2007	no virus found
TheHacker	6.1.6.067	03.01.2007	no virus found
UNA	1.83	03.02.2007	Constructor.Win32.Delf.0157
VBA32	3.11.2	03.03.2007	Constructor.Win32.Delf.g
VirusBuster	4.3.19:9	03.03.2007	Constructor.Delf.ZW!AU

Aditional Information

File size: 150766 bytes

MD5: 7f2ec65ecf20d065b967526f92aa08a4

SHA1: bf62c0e6e1e40239df3894c7d21f6b81e5203c13

[ 本帖最后由 PPwangS 于 2007-3-4 22:05 编辑 ]

jlennon

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-3-3
Start time: 2007-3-4 19:15
Engine(s): KAV engine (AVK 17.3071), BD-Engine (BD 17.2253)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: 新版记事本.exe=>(ZIP Sfx o)=>NoTEPAD.exe=>(RAR Sfx o) BV2008.bat
        In archive: C:\Documents and Settings\Administrator\桌面\NewJSB.zip
        Status: Virus detected
        Virus: Virtool.Constructor.Delf.G (BD-Engine)
Object: NewJSB.zip
        Path: C:\Documents and Settings\Administrator\桌面
        Status: Move file into quarantine
        Virus: Virtool.Constructor.Delf.G (BD-Engine)
Analysis complete: 2007-3-4 19:15
    1 files checked
    1 infected files detected
    0 suspected files detected

hzq277284

红伞未报，已上报

kp2006

文件没有

金剑

真快

Nblock

  要学会感恩 又发现2处bug

[ 本帖最后由 Nblock 于 2007-3-4 22:09 编辑 ]

yinxuchina

确实强

鼻耳盖子

Nblock

原帖由 鼻耳盖子 于 2007-3-5 10:51 发表

在我这三次运行 样本和微点都有不同的反应

金剑

[:01:] 哈哈