实在欠扁的东西

显示全部楼层 · 发表于 2007-4-8 02:23:09

流氓中的流氓

显示全部楼层 · 发表于 2007-4-8 02:57:52

antivir沉默，上报了

显示全部楼层 · 发表于 2007-4-8 03:05:58

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-4-7
Start time: 2007-4-8 3:05
Engine(s): KAV engine (AVK 17.3765), BD-Engine (BD 17.3526)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: dlh9jkd1q2.exe
In archive: C:\Documents and Settings\Administrator\桌面\dlh9jkd1q2.zip
Status: Virus detected
Virus: Trojan.Peed.Gen (BD-Engine)
Object: dlh9jkd1q2.zip
Path: C:\Documents and Settings\Administrator\桌面
Status: Move file into quarantine
Virus: Trojan.Peed.Gen (BD-Engine)
Analysis complete: 2007-4-8 3:05
1 files checked
1 infected files detected
0 suspected files detected

显示全部楼层 · 发表于 2007-4-8 03:17:36

Distribute
SSL
Send
STATUS: FINISHED
Complete scanning result of "dlh9jkd1q2.exe", received in VirusTotal at 04.07.2007, 20:58:51 (CET).
Antivirus Version Update Result
AhnLab-V3 2007.4.7.0 04.06.2007 no virus found
AntiVir 7.3.1.48 04.07.2007 no virus found
Authentium 4.93.8 04.06.2007 no virus found
Avast 4.7.936.0 04.06.2007 no virus found
AVG 7.5.0.447 04.07.2007 no virus found
BitDefender 7.2 04.07.2007 Trojan.Peed.Gen
CAT-QuickHeal 9.00 04.06.2007 (Suspicious) - DNAScan
ClamAV devel-20070312 04.07.2007 no virus found
DrWeb 4.33 04.07.2007 no virus found
eSafe 7.0.15.0 04.07.2007 Suspicious Trojan/Worm
eTrust-Vet 30.7.3549 04.06.2007 no virus found
Ewido 4.0 04.07.2007 no virus found
FileAdvisor 1 04.07.2007 no virus found
Fortinet 2.85.0.0 04.07.2007 suspicious
F-Prot 4.3.1.45 04.04.2007 no virus found
F-Secure 6.70.13030.0 04.07.2007 no virus found
Ikarus T3.1.1.3 04.07.2007 no virus found
Kaspersky 4.0.2.24 04.07.2007 no virus found
McAfee 5003 04.06.2007 no virus found
Microsoft 1.2405 04.07.2007 no virus found
NOD32v2 2172 04.07.2007 no virus found
Norman 5.80.02 04.05.2007 no virus found
Panda 9.0.0.4 04.07.2007 Suspicious file
Prevx1 V2 04.07.2007 Win32.Malware.gen
Sophos 4.16.0 04.06.2007 no virus found
Sunbelt 2.2.907.0 04.07.2007 VIPRE.Suspicious
Symantec 10 04.07.2007 no virus found
TheHacker 6.1.6.085 04.04.2007 no virus found
VBA32 3.11.3 04.06.2007 no virus found
VirusBuster 4.3.7:9 04.07.2007 no virus found
Webwasher-Gateway 6.0.1 04.07.2007 no virus found

Aditional Information
File size: 19460 bytes
MD5: 1c7ad69c98fea8096f1f9a6e37bc8c3b
SHA1: 229102458ea10d253b663e6bdfefc5c4dff9984f
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PXC=f60187607050
Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics.

显示全部楼层 · 发表于 2007-4-8 03:24:06

原帖由 mofunzone 于 2007-4-8 04:47 发表
Distribute
SSL
Send
STATUS: FINISHED
Complete scanning result of "dlh9jkd1q2.exe", received in VirusTotal at 04.07.2007, 20:58:51 (CET).
Antivirus Version Update Result
AhnLab-V3 2007.4.7.0 ...

要发样本，就要发最狠的

显示全部楼层 · 发表于 2007-4-8 05:17:57

原帖由 solcroft 于 2007-4-8 03:24 发表

要发样本，就要发最狠的

那你最好发几个全过的，并且过微点，老鹰，然后主流的HIPS也漏抓动作的

显示全部楼层 · 发表于 2007-4-8 08:00:34

偶打开卡巴斯基的防御，以身试毒，主体的确没有报，已经写入注册表自动加载，卸载删除了，在c:\windows\desktop.html文件被卡巴检测出删除之，清理了注册表，重启后没有异样，小菜一碟，不过的确是个欠扁的狗东西！！！

显示全部楼层 · 发表于 2007-4-25 00:00:38

[:27:] ..阻止甚至禁止它访问网络依然连出。。

[ 本帖最后由 Nblock 于 2007-5-4 15:23 编辑 ]

显示全部楼层 · 发表于 2007-4-25 00:05:05

北京江民新科技术有限公司

扫描引擎 10.00.600
病毒库日期 2007-04-24
更新日期 2007-04-25

扫描目标 C:\Documents and Settings\mrly\My Documents\dlh9jkd1q2.zip

开始时间 2007-04-25 00:04:54

在 C:\Documents and Settings\mrly\My Documents\dlh9jkd1q2.zip->dlh9jkd1q2.exe 中发现 Trojan/Small.aqt 病毒, 发现病毒
正常结束。

扫描结果:
               文件数 :2                                  病毒体 :1
               删除 :0                                  解毒 :0
扫描速度(千字节/秒) :0                               扫描时间 :00:00:00

显示全部楼层 · 发表于 2007-4-25 07:34:48

原帖由 mofunzone 于 2007-4-8 02:57 发表
antivir沉默，上报了

[病毒样本] 实在欠扁的东西

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源