发现一个过红伞的病毒

kfanty

原帖在这里：
http://bbs.kafan.cn/viewthread.php?tid=64336&extra=page%3D1

这个病毒偶用金山毒霸扫描报毒，想必红伞也会报，没想到过了红伞，让我有三个想不到：
1、红伞虽然杀毒强悍，但不等于100％
2、红伞好像也不是“遇壳就报”
3、在国内这个环境里，国内杀软并不就一无是处

Service load:	0%       100%
File:	lsass.rar
Status:	INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5	d961692a824578acf4e9754ed5bde892
Packers detected:	NSPACK
Scanner results
Scan taken on 22 Mar 2007 07:39:10 (GMT)
AntiVir	Found nothing
ArcaVir	Found Trojan.Delf.Aws
Avast	Found Win32:Hupigon-YY
AVG Antivirus	Found BackDoor.Generic5.NIM
BitDefender	Found Generic.Malware.FPYdPk.963C132D
ClamAV	Found nothing
Dr.Web	Found BackDoor.Kais
F-Prot Antivirus	Found Possibly a new variant of W32/PWStealer.gen1
F-Secure Anti-Virus	Found Backdoor.Win32.Delf.aws
Fortinet	Found W32/Delf.AWS!tr.bdr
Kaspersky Anti-Virus	Found Backdoor.Win32.Delf.aws
NOD32	Found nothing
Norman Virus Control	Found nothing
Panda Antivirus	Found Bck/Hupigon.JXD
VirusBuster	Found Packed/NSPack
VBA32	Found MalwareScope.Backdoor.Hupigon.17

周杰伦

这种帖子应该发到样本区的，以后请注意

mofunzone

nspack最近雨伞的算法有问题，今天已经升级了一次avpack32.dll，但是没有很好的改观，看下个星期还有没有引擎升级来修复这个问题吧

solcroft

发现一个现象，就是Cyberhawk报已知病毒时名字往往会和AVG，McAfee一样...

gggh

旧东西了