今天的样本5/25，持续更新中....

aoyang

下载者需要运行后才杀。下载回来的病毒全杀。

zzh161

趋势的启发还是依然精准

tracydk

Starting the file scan:

Begin scan in 'F:\样本\svchost.zip'
F:\样本\svchost.zip
  [0] Archive type: ZIP
  --> svchost.exe
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
      [INFO]      The file was deleted!
Begin scan in 'F:\样本\virus.zip'
F:\样本\virus.zip
  [0] Archive type: ZIP
  --> conime.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> copypfh.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> csrss.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> ctfmon.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> IEXPLORE.EXE
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> mmc.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> smss.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> spglsdr.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> srogm.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> stpgldk.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> svchost(1).exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> svchost32.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [INFO]      The file was deleted!

蓝色牛仔裤

那包virus 应该是svchost 的生成物吧？ 蜘蛛生成物一个都不报。。。


[Scan path] C:\Documents and Settings\Administrator\桌面\svchost.zip
>>>>C:\Documents and Settings\Administrator\桌面\svchost.zip\svchost.exe probably infected with DLOADER.Trojan
C:\Documents and Settings\Administrator\桌面\svchost.zip - archive contains infected objects

[Scan path] C:\Documents and Settings\Administrator\桌面\virus.zip
>C:\Documents and Settings\Administrator\桌面\virus.zip\conime.exe - Ok
>C:\Documents and Settings\Administrator\桌面\virus.zip\copypfh.exe - Ok
>C:\Documents and Settings\Administrator\桌面\virus.zip\csrss.exe - Ok
>C:\Documents and Settings\Administrator\桌面\virus.zip\ctfmon.exe - Ok
>C:\Documents and Settings\Administrator\桌面\virus.zip\IEXPLORE.EXE - Ok
>C:\Documents and Settings\Administrator\桌面\virus.zip\mmc.exe - Ok
>C:\Documents and Settings\Administrator\桌面\virus.zip\smss.exe - Ok
>C:\Documents and Settings\Administrator\桌面\virus.zip\spglsdr.exe - Ok
>C:\Documents and Settings\Administrator\桌面\virus.zip\srogm.exe - Ok
>C:\Documents and Settings\Administrator\桌面\virus.zip\stpgldk.exe - Ok
>C:\Documents and Settings\Administrator\桌面\virus.zip\svchost(1).exe - Ok
>C:\Documents and Settings\Administrator\桌面\virus.zip\svchost32.exe - Ok
C:\Documents and Settings\Administrator\桌面\virus.zip - Ok

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 15
Infected objects found: 0
Objects with modifications found: 0
Suspicious objects found: 1
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 92 Kb/s
Scan time: 00:00:06

红心王子

已删除: 病毒 Virus.Win32.AutoRun.p        文件: C:\Documents and Settings\Administrator\桌面\svchost.zip/svchost.exe//UPX
卡巴7报了前一个报
后一个没反应，但是让费尔扫描后一个包全是启发式和aoyang发的差不多
卡巴7的Rookit我有点怀疑它报壳的能力，开到deep都没有反应

qqq000@qq.com

----------
              [凝逸反毒] (http://hi.baidu.com/503165656)

       [凝逸.扫描病毒引擎-日志]       2007.5.25 23:5:56

文件:F:\070526\svchost\svchost.exe | 感染:木马 [42>20070525_200911_0053.axx]3
操作:删除文件


扫描完成|病毒:1 文件:13|耗时:501
----------

龙井茶

这个写病毒的是不是去卡巴应聘遭拒绝了,天天找卡巴的麻烦的.

quansen83

原帖由 龙井茶 于 2007-5-25 23:15 发表
这个写病毒的是不是去卡巴应聘遭拒绝了,天天找卡巴的麻烦的.

你MS小说家

建行

第二包真的这么利害！！卡巴7一个都没扫出来

wangjay1980

你是用卡巴吗

[ 本帖最后由 wangjay1980 于 2007-5-25 23:45 编辑 ]