8个病毒样本

蓝色牛仔裤

beta蜘蛛7个...

007[1].rar\007[1].exe;C:\Documents and Settings\Administrator\桌面\007[1].rar;BackDoor.Pomax;;
007[1].rar\IECONFIG[1].exe;C:\Documents and Settings\Administrator\桌面\007[1].rar;BINARYRES;;
007[1].rar\ldasd[1].exe;C:\Documents and Settings\Administrator\桌面\007[1].rar;BackDoor.Pigeon.origin;;
007[1].rar\SC0NFIG[1].exe;C:\Documents and Settings\Administrator\桌面\007[1].rar;BackDoor.Pigeon.origin;;
007[1].rar\SPy[1].exe;C:\Documents and Settings\Administrator\桌面\007[1].rar;BINARYRES;;
007[1].rar\SVCH0ST[1].exe;C:\Documents and Settings\Administrator\桌面\007[1].rar;Trojan.PWS.Wsgame;;
007[1].rar\wanmeishijie[1].EXE;C:\Documents and Settings\Administrator\桌面\007[1].rar;Trojan.PWS.Wsgame;;
007[1].rar;C:\Documents and Settings\Administrator\桌面;Archive contains infected objects;;

蓝色牛仔裤

正式版蜘蛛真的一个没报吗? 那么跟beta蜘蛛的差别还真大...

jlennon

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-4-1
Start time: 2007-4-3 1:55
Engine(s): KAV engine (AVK 17.3690), BD-Engine (BD 17.2421)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: 007[1].exe
        Path: C:\Documents and Settings\Administrator\桌面\007[1]
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.Nilage.ara (KAV engine)
Object: IECONFIG[1].exe
        Path: C:\Documents and Settings\Administrator\桌面\007[1]
        Status: Move file into quarantine
        Virus: Generic.Malware.SdldgPWS.25F04345 (BD-Engine)
Object: ldasd[1].exe
        Path: C:\Documents and Settings\Administrator\桌面\007[1]
        Status: Move file into quarantine
        Virus: Trojan.PWS.OnLineGames.ARI (BD-Engine)
Object: SC0NFIG[1].exe
        Path: C:\Documents and Settings\Administrator\桌面\007[1]
        Status: Move file into quarantine
        Virus: Trojan.PWS.OnLineGames.ARI (BD-Engine)
Object: SPy[1].exe
        Path: C:\Documents and Settings\Administrator\桌面\007[1]
        Status: Move file into quarantine
        Virus: Generic.Malware.SFBdld.2A7F15BF (BD-Engine)
Object: SVCH0ST[1].exe
        Path: C:\Documents and Settings\Administrator\桌面\007[1]
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.Nilage.ara (KAV engine)
Object: TIMPLATF0RM[1].exe
        Path: C:\Documents and Settings\Administrator\桌面\007[1]
        Status: Move file into quarantine
        Virus: MemScan:Trojan.PWS.OnLineGames.DQ (BD-Engine)
Object: wanmeishijie[1].EXE
        Path: C:\Documents and Settings\Administrator\桌面\007[1]
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.Nilage.ara (KAV engine), Trojan.PWS.Nilage.CZ (BD-Engine)
Analysis complete: 2007-4-3 1:55
    8 files checked
    8 infected files detected
    0 suspected files detected

mmll888

Starting the file scan:

Begin scan in 'C:\Documents and Settings\zxb\桌面\007[1].rar'
C:\Documents and Settings\zxb\桌面\007[1].rar
  [0] Archive type: RAR
  --> 007[1].exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> IECONFIG[1].exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> SPy[1].exe
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
  --> SVCH0ST[1].exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> TIMPLATF0RM[1].exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.DQ.2
  --> wanmeishijie[1].EXE
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [INFO]      The file was deleted!

红心王子

江民的监控还不错，没等你下载，就提前提示预警我了

solcroft

原帖由 红心王子 于 2007-4-3 17:58 发表
江民的监控还不错，没等你下载，就提前提示预警我了

“不错”可能是相对的标准吧... 八个样本才报了两个

jlennon

原帖由 solcroft 于 2007-4-3 17:18 发表

“不错”可能是相对的标准吧... 八个样本才报了两个

嗯，每个人的标准不一样

soul20010

FS7.0
Result: 8 malware found
Trojan-PSW.Win32.Nilage.ara (virus)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\007[1].rar\007[1].exe
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\007[1].rar\SVCH0ST[1].exe
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\007[1].rar\wanmeishijie[1].EXE
Trojan-PSW.Win32.OnLineGames.es (virus)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\007[1].rar\IECONFIG[1].exe
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\007[1].rar\TIMPLATF0RM[1].exe
Trojan-PSW.Win32.OnLineGames.im (virus)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\007[1].rar\ldasd[1].exe
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\007[1].rar\SC0NFIG[1].exe
Trojan-PSW.Win32.QQPass.vq (virus)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\007[1].rar\SPy[1].exe

caocao

KIS报8个
已删除: 木马程序 Trojan-PSW.Win32.Nilage.ara        文件: D:\Downloads\007[1].rar\007[1].exe
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.es        文件: D:\Downloads\007[1].rar\IECONFIG[1].exe
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.im        文件: D:\Downloads\007[1].rar\ldasd[1].exe/NSPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.im        文件: D:\Downloads\007[1].rar\SC0NFIG[1].exe/NSPack
已删除: 木马程序 Trojan-PSW.Win32.QQPass.vq        文件: D:\Downloads\007[1].rar\SPy[1].exe/UPX
已删除: 木马程序 Trojan-PSW.Win32.Nilage.ara        文件: D:\Downloads\007[1].rar\SVCH0ST[1].exe
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.es        文件: D:\Downloads\007[1].rar\TIMPLATF0RM[1].exe
已删除: 木马程序 Trojan-PSW.Win32.Nilage.ara        文件: D:\Downloads\007[1].rar\wanmeishijie[1].EXE

KAV-Longhorn

红伞8个

Starting the file scan:

Begin scan in 'C:\Documents and Settings\FEAR\My Documents\007[1].rar'
C:\Documents and Settings\FEAR\My Documents\007[1].rar
  [0] Archive type: RAR
  --> 007[1].exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> IECONFIG[1].exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> ldasd[1].exe
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> SC0NFIG[1].exe
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> SPy[1].exe
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
  --> SVCH0ST[1].exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> TIMPLATF0RM[1].exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.DQ.2
  --> wanmeishijie[1].EXE
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [INFO]      The file was moved to '4649275c.qua'!