转avpclub，多挂

mofunzone

还是那里新样本多
Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\wintoo.exe'
C:\Documents and Settings\morgan\My Documents\
  wintoo.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [WARNING]   The file was ignored!

C:\Documents and Settings\morgan\My Documents\wintoo.exe - 是正常的


[Scan path] C:\Documents and Settings\morgan\My Documents\wintoo.exe
C:\Documents and Settings\morgan\My Documents\wintoo.exe - Ok

File:           wintoo.rar
Status:        
INFECTED/MALWARE
MD5         bb070c113a18334a70a5acd610d7e777
Packers detected:        
-
Scanner results
Scan taken on 22 May 2007 02:32:27 (GMT)
A-Squared        
Found nothing
AntiVir        
Found TR/Crypt.NSPM.Gen
ArcaVir        
Found nothing
Avast        
Found Win32:Tibs-ADO
AVG Antivirus        
Found nothing
BitDefender        
Found nothing
ClamAV        
Found nothing
Dr.Web        
Found nothing
F-Prot Antivirus        
Found Possibly a new variant of W32/PWStealer1!Generic
F-Secure Anti-Virus        
Found nothing
Fortinet        
Found nothing
Kaspersky Anti-Virus        
Found nothing
NOD32        
Found nothing
Norman Virus Control        
Found nothing
Panda Antivirus        
Found nothing
Rising Antivirus        
Found nothing
VirusBuster        
Found nothing
VBA32        
Found MalwareScope.Worm.Viking.3

taihuxian

Virus: Win32:Tibs-ADO [Trj]

Virus found while downloading Web content.

Address: bbs.kafan.cn

wangjay1980

我发现红伞报这个TR/Crypt.NSPM.Gen时,其他杀软就挂的多

mofunzone

实际只要是antivir报基因的，那么别的软件就有很大几率挂掉了
我说过我不在乎是怎么杀出来的，就现在手上手机的样本来看，还是最信任antivir，我很少发自己抓的样本，除非太明显的，不过只要我发我的，绝对就是论“片”的挂的

wangjay1980

可是红伞不只是给你这样的专家用的,况且他也过不了卡巴的主动防御.

欠妳緈諨

是威金，NOD又挂

龙井茶

微点搞懂了的
程序:
D:\TEMP\RAR$EX00.969\WINTOO.EXE
木马程序生成以下文件:
1) D:\TEMP\U9.DLL
2) D:\TEMP\J.SYS
是否删除木马程序及其衍生物?

tracydk

bluenice

红伞就是报壳一流！是不是真正的毒还不知道。
但是这个样本肯定是毒

miller239

C:\Documents and Settings\Administrator\桌面\wintoo.rar\wintoo.exe\[Embedded#09787]\[UPX]
Win32:Agent-EWQ [Trj]
特洛伊木马

C:\Documents and Settings\Administrator\桌面\wintoo.rar\wintoo.exe
Win32:Tibs-ADO [Trj]
特洛伊木马

经常见到非原厂的AVAST引擎（jotti，VT，AVK07）报为ADO的样本, 原版的AVAST都可以提前再报一个EWQ ..