未知样本一个

小邪邪

从这个贴子里捕获的http://bbs.kafan.cn/viewthread.php?tid=68714&extra=page%3D1&page=1

mcafee阻挡报告:
2007-4-2 1:03:24 已由访问保护规则禁止\WINDOWS\system32\CMD.exe
（试图执行）\Temporary Internet Files\Content.IE5\GHIJK9AZ\wmv[1].exe
通用标准保护:禁止公用程序从 Temp 文件夹运行文件
已阻止的操作: 执行

咖啡虽阻挡住了但不报杀的，扔上给大家检测下.
闪.

The EQs

Scan performed at: 2007-4-2 1:06:02
Scanning Log
NOD32 version 2161 (20070401) NT
Command line: C:\Documents and Settings\EQ2\桌面\wmv[1].rar
Operating memory - is OK

Date: 2.4.2007  Time: 01:06:05
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\wmv[1].rar
C:\Documents and Settings\EQ2\桌面\wmv[1].rar ?RAR ?wmv[1].exe - probably a variant of Win32/Spy.Delf.NDZ trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 01:06:06 Total scanning time: 1 sec (00:00:01)

小邪邪

扫描器已检测（加壳程序）

jlennon

扫描报告
2007年4月2日 1:33:57 - 1:33:58
计算机名称: 0553A719C5644CE
扫描类型: 扫描目标
目标: C:\Documents and Settings\Administrator\桌面\wmv[1].rar


--------------------------------------------------------------------------------

结果: 发现 1 恶意软件
Trojan-Spy.Win32.Agent.pn (病毒)
C:\Documents and Settings\Administrator\桌面\wmv[1].rar\wmv[1].exe




--------------------------------------------------------------------------------

统计信息
已扫描:
文件: 2
尚未扫描: 0
结果:
病毒: 1
间谍软件: 0
可疑项目: 0
危险软件: 0
操作:
已杀毒: 0
已重命名: 0
已删除邮件: 0
已隔离: 0
失败: 0
启动扇区:
已扫描: 0
已感染: 0
可疑项目: 0
已杀毒: 0


--------------------------------------------------------------------------------

选项
定义版本:
病毒: 2007-04-01_03
间谍软件: 2007-04-01_03
扫描引擎:
F-Secure AVP: 7.00.171, 2007-04-01
F-Secure Libra: 2.04.01, 2007-03-30
F-Secure Orion: 1.02.37, 2007-04-01
F-Secure Draco: 1.00.35, 2007-03-26
扫描选项:
扫描定义的文件: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ANI AVB BAT CEO CMD LSP MAP MHT MIF PHP POT WMF NWS TAR TGZ ZIP JAR ARJ LZH TAR TGZ GZ CAB RAR BZ2 HQX
扫描内部存档
操作:
病毒: 扫描后询问
间谍软件: 扫描后询问

--------------------------------------------------------------------------------

版权 © 1998-2007 产品支持 | 发送病毒样本到 F-Secure

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\wmv[1].rar'
C:\Documents and Settings\morgan\My Documents\
  wmv[1].rar
    [0] Archive type: RAR
    --> wmv[1].exe
        [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!

剑指七星

卡巴 没有动静

KAV-Longhorn

红伞杀

Starting the file scan:

Begin scan in 'C:\Documents and Settings\FEAR\My Documents\wmv[1].rar'
C:\Documents and Settings\FEAR\My Documents\wmv[1].rar
  [0] Archive type: RAR
  --> wmv[1].exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was moved to '4686731f.qua'!

gggh

卡巴报警...

鼻耳盖子

:\WINNT\SYSTEM32\SCRSYS070401.SCR I:\TEST\070402\3\WMV[1]\WMV[1].EXE
:\WINNT\SYSTEM32\ALXRES070401.EXE I:\TEST\070402\3\WMV[1]\WMV[1].EXE
:\MPLAY.COM I:\TEST\070402\3\WMV[1]\WMV[1].EXE

xffsfy

费尔报启发....