一个样本~~

显示全部楼层 · 发表于 2007-4-20 02:05:53

231313

显示全部楼层 · 发表于 2007-4-20 03:13:42

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\test.rar'
C:\Documents and Settings\Administrator\桌面\test.rar
  [0] Archive type: RAR
  --> test.exe
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    The file was moved to '469abfeb.qua'!

显示全部楼层 · 发表于 2007-4-20 06:30:55

NOD过！

显示全部楼层 · 发表于 2007-4-20 06:40:05

费尔过

显示全部楼层 · 发表于 2007-4-20 07:40:44

小红伞报了

Archive type: RAR
--> test.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-4-20 07:42:16

红伞报的启发啊

显示全部楼层 · 发表于 2007-4-20 07:54:43

过卡巴
====

手动分析结果：
大致类型：Downloader
行为：下载以下文件到电脑：

http://vnet.onlinedown.net/new/new_js/js/pic6/js_1.exe
http://vnet.onlinedown.net/new/new_js/js/pic6/js_2.exe
http://vnet.onlinedown.net/new/new_js/js/pic6/js_3.exe
http://vnet.onlinedown.net/new/new_js/js/pic6/js_4.exe
http://vnet.onlinedown.net/new/new_js/js/pic6/js_5.exe
http://vnet.onlinedown.net/new/new_js/js/pic6/js_6.exe
http://vnet.onlinedown.net/new/new_js/js/pic6/js_7.exe
http://vnet.onlinedown.net/new/new_js/js/pic6/js_8.exe
http://vnet.onlinedown.net/new/new_js/js/pic6/js_9.exe
http://vnet.onlinedown.net/new/new_js/js/pic6/js_10.exe

复制代码

这些是他的下载文件：

显示全部楼层 · 发表于 2007-4-20 09:19:43

卡巴飘过。。。。上报去了。

显示全部楼层 · 发表于 2007-4-20 09:30:51

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\EXE_DOWNLOADER_FILE_FROM_onlinedown.zip'
C:\Documents and Settings\morgan\My Documents\
  EXE_DOWNLOADER_FILE_FROM_onlinedown.zip
[0] Archive type: ZIP
--> js_1.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> js_2.exe
      [DETECTION] Is the Trojan horse TR/Agent.18757.B
      [WARNING] Infected files in archives cannot be repaired!
--> js_4.exe
--> js_5.exe
--> js_6.exe
--> js_7.exe
--> js_8.exe
--> js_9.exe
--> js_10.exe
      [WARNING] The file was ignored!

End of the scan: 2007年4月19日  18:31
Used time: 00:07 min

The scan has been done completely.

   0 Scanning directories
   10 Files were scanned
   2 viruses and/or unwanted programs were found
   0 classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   8 Files not concerned
   1 Archives were scanned
   3 Warnings
   0 Notes
   0 Hidden objects were found

显示全部楼层 · 发表于 2007-4-20 09:58:25

微点轻松解决

[病毒样本] 一个样本~~

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源