probably unknown NewHeur_PE

1p1

probably unknown NewHeur_PE

AntiVir	Found HEUR/Crypted
ArcaVir	Found nothing
Avast	Found nothing
AVG Antivirus	Found nothing
BitDefender	Found nothing
ClamAV	Found nothing
Dr.Web	Found Trojan.Click.2178
F-Prot Antivirus	Found nothing
F-Secure Anti-Virus	Found nothing
Fortinet	Found nothing
Kaspersky Anti-Virus	Found nothing
NOD32	Found probably unknown NewHeur_PE (probable variant)
Norman Virus Control	Found nothing
Panda Antivirus	Found nothing
Rising Antivirus	Found nothing
VirusBuster	Found nothing
VBA32	Found nothing

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\webpntc.rar'
C:\Documents and Settings\morgan\My Documents\
  webpntc.rar
    [0] Archive type: RAR
    --> webpntc.exe
        [DETECTION] Contains suspicious code HEUR/Crypted
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!

1p1

AhnLab-V3 2007.4.14.0 04.13.2007  no virus found
AntiVir 7.3.1.50 04.13.2007 HEUR/Crypted
Authentium 4.93.8 04.14.2007  no virus found
Avast 4.7.936.0 04.13.2007  no virus found
AVG 7.5.0.447 04.13.2007  no virus found
BitDefender 7.2 04.14.2007  no virus found
CAT-QuickHeal 9.00 04.13.2007  no virus found
ClamAV devel-20070312 04.13.2007  no virus found
DrWeb 4.33 04.13.2007 Trojan.Click.2178
eSafe 7.0.15.0 04.12.2007 suspicious Trojan/Worm
eTrust-Vet 30.7.3567 04.14.2007  no virus found
Ewido 4.0 04.13.2007  no virus found
FileAdvisor 1 04.14.2007  no virus found
Fortinet 2.85.0.0 04.14.2007 suspicious
F-Prot 4.3.2.48 04.13.2007  no virus found
F-Secure 6.70.13030.0 04.13.2007  no virus found
Ikarus T3.1.1.5 04.13.2007  no virus found
Kaspersky 4.0.2.24 04.14.2007  no virus found
McAfee 5009 04.13.2007  no virus found
Microsoft 1.2405 04.14.2007  no virus found
NOD32v2 2187 04.13.2007 probably unknown NewHeur_PE virus
Norman 5.80.02 04.12.2007  no virus found
Panda 9.0.0.4 04.13.2007 Suspicious file
Prevx1 V2 04.14.2007  no virus found
Sophos 4.16.0 04.12.2007  no virus found
Sunbelt 2.2.907.0 04.14.2007  no virus found
Symantec 10 04.14.2007  no virus found
TheHacker 6.1.6.088 04.09.2007  no virus found
VBA32 3.11.3 04.13.2007  no virus found
VirusBuster 4.3.7:9 04.13.2007  no virus found
Webwasher-Gateway 6.0.1 04.13.2007 Heuristic.Crypted

bridgewr

微点

1p1

原帖由 mofunzone 于 2007-4-14 10:46 发表
Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\webpntc.rar'
C:\Documents and Settings\morgan\My Documents\
  webpntc.rar
    [0] Archive type: RAR
    ...

AntiVir

7.3.1.50

04.13.2007 [td]no virus found

无壳的就不报了

AntiVir	Found nothing
ArcaVir	Found nothing
Avast	Found nothing
AVG Antivirus	Found nothing
BitDefender	Found nothing
ClamAV	Found nothing
Dr.Web	Found Trojan.Click.2178
F-Prot Antivirus	Found nothing
F-Secure Anti-Virus	Found nothing
Fortinet	Found nothing
Kaspersky Anti-Virus	Found nothing
NOD32	Found probably unknown NewHeur_PE (probable variant)
Norman Virus Control	Found nothing
Panda Antivirus	Found nothing
Rising Antivirus	Found nothing
VirusBuster	Found nothing
VBA32	Found nothing

[ 本帖最后由 1p1 于 2007-4-14 10:57 编辑 ]

蓝色牛仔裤

beta蜘蛛..

第一个样本;
webpntc.rar\webpntc.exe;C:\Documents and Settings\Administrator\桌面\webpntc.rar;Trojan.Click.2178;;
webpntc.rar;C:\Documents and Settings\Administrator\桌面;Archive contains infected objects;;

第二个样本:
2.rar\1.exe;C:\Documents and Settings\Administrator\桌面\2.rar;BackDoor.Pigeon.36;;
2.rar;C:\Documents and Settings\Administrator\桌面;Archive contains infected objects;;

mofunzone

原帖由 1p1 于 2007-4-13 18:54 发表

AntiVir7.3.1.5004.13.2007 no virus found无壳的就不报了
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found not ...

crypted是因为被加密或者结构问题，

kp2006

原帖由 mofunzone 于 2007-4-14 11:03 发表

crypted是因为被加密或者结构问题，

那小红伞报的那个启发没报重点 报的偏门

[ 本帖最后由 kp2006 于 2007-4-14 11:24 编辑 ]

solcroft

原帖由 kp2006 于 2007-4-14 12:51 发表
那小红伞报的那个启发没报重点 报的偏门

那NOD32怎么也这么没出息，也学人家来报packed executable了？

promised

原帖由 solcroft 于 2007-4-14 12:30 发表

那NOD32怎么也这么没出息，也学人家来报packed executable了？

PE不是这个意思