考验杀软的脱壳能力 7种壳

显示全部楼层 · 发表于 2007-5-7 19:30:27

红伞居然只查出来2个，卡巴7个全查出来了。。我汗

已检测: 木马程序 Trojan-Dropper.Win32.VB.w 文件: C:\Documents and Settings\Administrator\桌面\3038.rar/3038\ke1.exe//ExeStealth
已检测: 木马程序 Trojan-Dropper.Win32.Delf.aah 文件: C:\Documents and Settings\Administrator\桌面\3038.rar/3038\ke2.exe
已检测: 木马程序 Trojan-Dropper.Win32.VB.w 文件: C:\Documents and Settings\Administrator\桌面\3038.rar/3038\ke3.exe//VPacker
已检测: 木马程序 Trojan-Dropper.Win32.VB.w 文件: C:\Documents and Settings\Administrator\桌面\3038.rar/3038\ke4.exe//RLPack
已检测: 木马程序 Trojan-Dropper.Win32.VB.w 文件: C:\Documents and Settings\Administrator\桌面\3038.rar/3038\ke5.exe//VPacker
已检测: 木马程序 Trojan-Dropper.Win32.VB.w 文件: C:\Documents and Settings\Administrator\桌面\3038.rar/3038\ke6.exe//YodaProt
已检测: 木马程序 Trojan-Dropper.Win32.VB.w 文件: C:\Documents and Settings\Administrator\桌面\3038.rar/3038\ke7.exe//DragonArmor

显示全部楼层 · 发表于 2007-5-7 19:32:31

风暴胜者V2 测试版本(http://www.v0day.com)
_________您的安全是我们的责任_______________
载入病毒库…进行整理…分配内存…可以使用

===============================================
___________病毒查杀结果__________________

===============================================

2007年5月7日19时32分33秒开始查杀C:\Documents and Settings\Administrator\桌面\3038
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\3038\3038\ke2.exe 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\3038\3038\ke4.exe 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\3038\3038\ke7.exe 操作:阻止运行
=========================================

_________文件性质分析结果________________
"带壳"仅指文件性质,仅供专业人员分析使用。

-----------------------------------------

2007年5月7日19时32分33秒收起线程…100% 查杀完毕！
扫描文件：7查杀病毒：3

显示全部楼层 · 发表于 2007-5-7 19:33:38

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-5-4
Start time: 2007-5-7 19:33
Engine(s): KAV engine (AVK 17.5061), BD-Engine (BD 17.4685)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: ke1.exe
Path: C:\Documents and Settings\Administrator\桌面\3038\3038
Status: Move file into quarantine
Virus: Trojan-Dropper.Win32.VB.w (KAV engine)
Object: ke2.exe
Path: C:\Documents and Settings\Administrator\桌面\3038\3038
Status: Move file into quarantine
Virus: Trojan-Dropper.Win32.Delf.aah (KAV engine), MemScan:Trojan.Dropper.Delf.AAH (BD-Engine)
Object: ke3.exe
Path: C:\Documents and Settings\Administrator\桌面\3038\3038
Status: Move file into quarantine
Virus: Trojan-Dropper.Win32.VB.w (KAV engine)
Object: ke4.exe
Path: C:\Documents and Settings\Administrator\桌面\3038\3038
Status: Move file into quarantine
Virus: Trojan-Dropper.Win32.VB.w (KAV engine), Trojan.Peed.Gen (BD-Engine)
Object: ke5.exe
Path: C:\Documents and Settings\Administrator\桌面\3038\3038
Status: Move file into quarantine
Virus: Trojan-Dropper.Win32.VB.w (KAV engine)
Object: ke6.exe
Path: C:\Documents and Settings\Administrator\桌面\3038\3038
Status: Move file into quarantine
Virus: Trojan-Dropper.Win32.VB.w (KAV engine)
Object: ke7.exe
Path: C:\Documents and Settings\Administrator\桌面\3038\3038
Status: Move file into quarantine
Virus: Trojan-Dropper.Win32.VB.w (KAV engine), Trojan.Agent.BCS (BD-Engine)
Analysis complete: 2007-5-7 19:33
7 files checked
7 infected files detected
0 suspected files detected

显示全部楼层 · 发表于 2007-5-7 19:34:15

Starting the file scan:

Begin scan in 'F:\样本\3038.rar'
F:\样本\3038.rar
  [0] Archive type: RAR
  --> 3038\ke3.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 3038\ke5.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 3038\ke6.exe
   [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/YodaProt). Please verify the origin of the file
   [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-5-7 19:34:22

原帖由 jlennon 于 2007-5-7 19:33 发表
Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-5-4
Start time: 2007-5-7 19:33
Engine(s): KAV engine (AVK 17.5061), BD-Engine (BD 17.4685)
Heuristic: On
Archives: On
...

汗，你这全用的卡巴引擎，和卡巴有区别么

显示全部楼层 · 发表于 2007-5-7 19:34:40

---------------------------------------------------------
AVG Anti-Spyware - 扫描报告
---------------------------------------------------------

+ 创建时间: 19:34:57 2007-5-7

+ 扫描结果:

F:\样本\3038.rar/3038\ke7.exe -> Backdoor.Hupigon : 未进行操作.
F:\样本\3038.rar/3038\ke2.exe -> Dropper.Delf.aah : 未进行操作.
F:\样本\3038.rar/3038\ke1.exe -> Dropper.VB.w : 未进行操作.
F:\样本\3038.rar/3038\ke4.exe -> Dropper.VB.w : 未进行操作.

::报告结束

显示全部楼层 · 发表于 2007-5-7 19:34:49

实在无法相信nod32的能力。。。。无语了。。上报去

显示全部楼层 · 发表于 2007-5-7 19:35:09

LZ确定全部能运行？？？

显示全部楼层 · 发表于 2007-5-7 19:36:01

原帖由 EQ2 于 2007-5-7 19:34 发表
实在无法相信nod32的能力。。。。无语了。。上报去

再次受到打击??

显示全部楼层 · 发表于 2007-5-7 19:37:08

nod32成绩不应该这么差劲。。。。。。

考验杀软的脱壳能力 7种壳

本帖子中包含更多资源