20个各式各样的样本

显示全部楼层 · 发表于 2007-3-26 01:00:51

查杀能力小测试

显示全部楼层 · 发表于 2007-3-26 01:13:04

我贴

显示全部楼层 · 发表于 2007-3-26 01:26:00

NOD32 扫描报13个。
运行后又报3个。共16个。

显示全部楼层 · 发表于 2007-3-26 01:27:53

雨伞从没让人失望过

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\test'
C:\Documents and Settings\morgan\My Documents\test\test\
  11744550432.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.aym.15
   [WARNING] The file was ignored!
  11744551237.exe
   [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
   [WARNING] The file was ignored!
  1532CE82.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [WARNING] The file was ignored!
  554070D4.DLL
   [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Agent.ahj.223 Backdoor server programs
   [WARNING] The file was ignored!
  554070D4.EXE
   [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
   [WARNING] The file was ignored!
  554070D4T.EXE
   [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
   [WARNING] The file was ignored!
  5A8E28FC.DLL
   [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Agent.ahj.222 Backdoor server programs
   [WARNING] The file was ignored!
  8E7663AC.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [WARNING] The file was ignored!
  AEJOUZEJOTYDIN.EXE
   [DETECTION] Is the Trojan horse TR/Dldr.Agen.795136
   [WARNING] The file was ignored!
  bomb.exe
   [DETECTION] Contains signature of the Ad- or Spyware ADSPY/Cdnup.A.1
   [WARNING] The file was ignored!
  HIDPROC.SYS
   [DETECTION] Contains signature of the Ad- or Spyware ADSPY/Ncast.S
   [WARNING] The file was ignored!
  huigezi.exe
   [DETECTION] Contains signature of the dropper DR/Hupigon.cda.7
   [WARNING] The file was ignored!
  REALSHED.DRV
   [DETECTION] Contains signature of the Ad- or Spyware ADSPY/Agent.BS.2
   [WARNING] The file was ignored!
  servicea.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSAnti.Gen
   [WARNING] The file was ignored!
  servicer.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSAnti.Gen
   [WARNING] The file was ignored!
  servicer.exe~
   [DETECTION] Is the Trojan horse TR/Crypt.NSAnti.Gen
   [WARNING] The file was ignored!
  svohose.exe
   [DETECTION] Contains signature of the dropper DR/Cinmus.F.9
   [WARNING] The file was ignored!
  USRINIT.DLL
   [DETECTION] Contains signature of the Ad- or Spyware ADSPY/Agent.BT.1
   [WARNING] The file was ignored!
  ~tmp.tmp
   [DETECTION] Is the Trojan horse TR/PSW.Steal.26522
   [WARNING] The file was ignored!
  雷之源.exe
   [DETECTION] Contains signature of the dropper DR/Dldr.Agent.arm
   [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-3-26 02:41:29

7个壳。。。。果然是牛。。实际上只能查杀13个。。。

显示全部楼层 · 发表于 2007-3-26 03:16:42

原帖由 EQ2 于 2007-3-25 10:41 发表
7个壳。。。。果然是牛。。实际上只能查杀13个。。。

看来还是不明白呀，算了，我也实在懒得和你解释了，不管是报壳还是什么，反正你的nod挂了7个，这就是差距，你就祈祷你的nod会报壳吧

显示全部楼层 · 发表于 2007-3-26 03:41:35

两位有火药味。要把报TR/Crypt.*.Gen的送给 Avira，这些都是不明文件。
但是 TR/Crypt.NSPM.Gen 不是报壳是什么？是毒还是木马？不是，只是 Crypt.NSPM。
mofunzone 说加壳后结构会改变，「结构」很可疑所以报他，然后说不是报壳，那他报什么，报结构吗？什么结构？没壳他看得出来结构变了吗？结果还不是壳。
少用脱壳...红伞不用脱呀，看到壳就拖去斩了还脱什么。

这样子换来的高查杀率，在某些人眼中似乎不是很光彩。
我屁放完了，逃跑 ... 不要打我

TrendMicro <12>
[  TROJ_AGENT.FSL]( 1) from 11744550432.exe
[    TROJ_VB.CIN]( 1) from 1532CE82.exe
[  BKDR_AGENT.DZP]( 1) from 554070D4.DLL
[  BKDR_AGENT.DUX]( 1) from 554070D4.EXE
[  BKDR_AGENT.DUX]( 1) from 554070D4T.EXE
[  BKDR_AGENT.EQY]( 1) from 5A8E28FC.DLL
[  TROJ_AGENT.ONF]( 1) from bomb.exe
[  TROJ_AGENT.MZT]( 1) from HIDPROC.SYS
[  TSPY_AGENT.ECK]( 1) from servicea.exe
[  TSPY_AGENT.ECK]( 1) from servicer.exe
[  TSPY_AGENT.ECK]( 1) from servicer.exe~
[ TSPY_DELF.FML]( 1) from ~tmp.tmp

CA <2>
~tmp.tmp       -> Win32/Dowque!generic
HIDPROC.SYS ->  Win32/Vowfie!generic

McAfee <8>
11744550432.exe ... Found the Generic Downloader.u trojan !!!
11744551237.exe ... Found the Downloader-AYD trojan !!!
554070D4.DLL ... Found the AdClicker-EW.dll trojan !!!
8E7663AC.exe ... Found the AdClicker-EW trojan !!!
AEJOUZEJOTYDIN.EXE ... Found potentially unwanted program Adware-MokeAd.
bomb.exe\bomb.exe ... Found potentially unwanted program Adware-CDNHelper.
HIDPROC.SYS ... Found the NTRootKit-J trojan !!!
~tmp.tmp\~tmp.tmp\0000b4f0.EXE ... Found the PWS-QQGame trojan !!!
--FILES PACKAGED--
1532CE82.exe ... is packaged using New Packer.
554070D4.DLL ... is packaged using New Packer.
554070D4.EXE ... is packaged using New Packer.
554070D4T.EXE ... is packaged using New Packer.
8E7663AC.exe ... is packaged using New Packer.
bomb.exe ... is packaged using ASpack.
servicea.exe ... is packaged using New Packer.
servicer.exe ... is packaged using New Packer.
servicer.exe~ ... is packaged using New Packer.
~tmp.tmp ... is packaged using UPX.

显示全部楼层 · 发表于 2007-3-26 04:11:32

原帖由 tun 于 2007-3-25 11:41 发表
两位有火药味。要把报TR/Crypt.*.Gen的送给 Avira，这些都是不明文件。
但是 TR/Crypt.NSPM.Gen 不是报壳是什么？是毒还是木马？不是，只是 Crypt.NSPM。
mofunzone 说加壳后结构会改变，「结构」很可疑所以报 ...

唉。。
不只是加壳ok？
加壳只是产生结构变量的一种方法而已，是一个双刃剑，可以免杀，也可以被有些引擎侦测出来，类似antivir，但是产生结构变量的不只有一种，很多病毒在编写的时候为了免杀就采用了很多特殊结构，为了免杀，所以根本就不需要加壳就也可以免杀
给你一个例子，这个是一个没有加壳的viking变种，但是雨伞依然是nspm.gen，那你怎么解释？
没壳他也给你报一个壳吗？
自己用od打开看看里面的东西是怎么写的吧。。
发现小白真多
AhnLab-V3 2007.3.24.1 03.24.2007 Win32/Viking.suspicious
AntiVir 7.3.1.44 03.25.2007 TR/Crypt.NSPM.Gen
Authentium 4.93.8 03.24.2007 Possibly a new variant of W32/PWStealer.gen1
Avast 4.7.936.0 03.23.2007 Win32:Tibs-ADO
AVG 7.5.0.447 03.25.2007 Worm/Delf.ASR
BitDefender 7.2 03.25.2007 GenPack:Win32.Worm.Viking.IZ
CAT-QuickHeal 9.00 03.23.2007 Worm.Viking.gs
ClamAV devel-20070312 03.25.2007 no virus found
DrWeb 4.33 03.25.2007 Win32.HLLW.Gavir.54
eSafe 7.0.14.0 03.25.2007 suspicious Trojan/Worm
eTrust-Vet 30.6.3506 03.23.2007 Win32/NSAnti
Ewido 4.0 03.25.2007 Worm.Viking.gs
FileAdvisor 1 03.25.2007 Not analyzed yet
Fortinet 2.85.0.0 03.25.2007 suspicious
F-Prot 4.3.1.45 03.23.2007 W32/PWStealer.gen1
F-Secure 6.70.13030.0 03.25.2007 Worm.Win32.Viking.gs
Ikarus T3.1.1.3 03.25.2007 Worm.Win32.Viking.ex
Kaspersky 4.0.2.24 03.25.2007 Worm.Win32.Viking.gs
McAfee 4991 03.23.2007 New Malware.w
Microsoft 1.2306 03.25.2007 VirTool:Win32/Obfuscator.A
NOD32v2 2144 03.25.2007 Win32/Viking.CH
Norman 5.80.02 03.23.2007 W32/NetworkWorm.NL
Panda 9.0.0.4 03.25.2007 Suspicious file
Prevx1 V2 03.25.2007 no virus found
Sophos 4.15.0 03.23.2007 Mal/Packer
Sunbelt 2.2.907.0 03.24.2007 Trojan.Win32.NSAnti
Symantec 10 03.25.2007 W32.Looked.BK
TheHacker 6.1.6.080 03.23.2007 W32/Viking.gs
UNA 1.83 03.16.2007 Worm.Win32.Viking.gs
VBA32 3.11.2 03.24.2007 MalwareScope.Worm.Viking.5
VirusBuster 4.3.7:9 03.25.2007 Packed/NSPM
Webwasher-Gateway 6.0.1 03.25.2007 Trojan.Crypt.NSPM.Gen

Aditional Information
File size: 62810 bytes
MD5: 4d62400badb37dc31a4c2e3636ddeaf2
SHA1: 74dd8e05c88f0efb2775a9e0ffc9a57f929e4cb3
Bit9 info: http://fileadvisor.bit9.com/serv ... dc31a4c2e3636ddeaf2

显示全部楼层 · 发表于 2007-3-26 04:20:38

偶都不好意思说你了。。。。virusbuster都报壳了。。。

显示全部楼层 · 发表于 2007-3-26 04:23:40

原帖由 EQ2 于 2007-3-25 12:20 发表
偶都不好意思说你了。。。。virusbuster都报壳了。。。

我都不好意思说你了，你看这文件有壳吗？
有壳的名字叫nspm吗？
我已经不想说什么了，继续看你搞笑就好了
还是那句话，od都用不利索的人能在这说什么，工具黑客？
哈哈哈

[病毒样本] 20个各式各样的样本

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

回复 #8 mofunzone 的帖子