7个毒

zxy900906

2007-5-26        10:38:01        已删除 (清理失败，因为该检测项不可清理)         ZXY900906\Administrator        F:\WinRar\WinRAR.exe        C:\Documents and Settings\Administrator\桌面\Downloads\avp6.0_key.exe        New Malware.aq (特洛伊)
2007-5-26        10:38:02        已删除         ZXY900906\Administrator        F:\WinRar\WinRAR.exe        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWNLOADS\1.EXE        BackDoor-ARR (特洛伊)
2007-5-26        10:38:02        已删除         ZXY900906\Administrator        F:\WinRar\WinRAR.exe        C:\Documents and Settings\Administrator\桌面\Downloads\1.exe        BackDoor-ARR (特洛伊)
2007-5-26        10:38:02        已删除         ZXY900906\Administrator        F:\WinRar\WinRAR.exe        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWNLOADS\KEY.EXE        BackDoor-AWQ (特洛伊)
2007-5-26        10:38:02        已删除         ZXY900906\Administrator        F:\WinRar\WinRAR.exe        C:\Documents and Settings\Administrator\桌面\Downloads\key.exe        BackDoor-AWQ (特洛伊)

moonsilver

KAV-Longhorn

费尔是报的壳，根本不是什么启发式

tracydk

Starting the file scan:

Begin scan in 'F:\样本\Downloads.part1.rar'
F:\样本\Downloads.part1.rar
  [0] Archive type: RAR
  --> ÎÞµÐÍâ¹Ò.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [INFO]      The file was deleted!
Begin scan in 'F:\样本\Downloads.part3.rar'
Begin scan in 'F:\样本\Downloads.part2.rar'
Begin scan in 'F:\样本\Downloads.part4.rar'
F:\样本\Downloads.part4.rar
  [0] Archive type: RAR
  --> 1.exe
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
      [INFO]      The file was deleted!
Begin scan in 'F:\样本\Downloads.part7.rar'
Begin scan in 'F:\样本\Downloads.part5.rar'
Begin scan in 'F:\样本\Downloads.part6.rar'

mofunzone

都和antivir没有可比性
Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\Downloads'
C:\Documents and Settings\morgan\My Documents\Downloads\
  1.exe
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
      [INFO]      The file was deleted!
  a.exe
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Graybird.GN.615424.16 Backdoor server programs
      [INFO]      The file was deleted!
  avp6.0_key.exe
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
      [INFO]      The file was deleted!
  key.exe
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
      [INFO]      The file was deleted!
  Patcher.exe
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
      [INFO]      The file was deleted!
  winplayer.exe
  无敌外挂.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [INFO]      The file was moved to '9f6e1e66.qua'!


End of the scan: 2007年5月25日  21:35
Used time: 00:09 min

The scan has been done completely.

      1 Scanning directories
      7 Files were scanned
      6 viruses and/or unwanted programs were found
      1 classified as suspicious:
      5 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      0 Files not concerned
      0 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

扫描日志
NOD32版本 2291 (20070525) NT
命令行： C:\Documents and Settings\morgan\My Documents\ ?
?winplayer.exe
正在检查NOD32.EXE文件的CRC：状态正常
D:\Eset\nod32.exe - 是正常的
扫描系统内存中：没有进行 (选项已关闭)
扫描MBR及引导区中：没有进行 (选项已关闭)
日期： 25.5.2007  时间：21:36:56
已关闭反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\ ?
?morgan\My Documents\winplayer.exe
C:\Documents and Settings\morgan\My Documents\winplayer. ?
?exe - 是正常的
已扫描的文件数目：1
已发现的病毒数目：0
完成时间： 21:36:56 总扫描时间：0 秒 (00:00:00)
扫描日志
NOD32版本 2291 (20070525) NT
命令行： C:\Documents and Settings\morgan\My Documents\ ?
?Downloads
正在检查NOD32.EXE文件的CRC：状态正常
D:\Eset\nod32.exe - 是正常的
扫描系统内存中：没有进行 (选项已关闭)
扫描MBR及引导区中：没有进行 (选项已关闭)
日期： 25.5.2007  时间：21:37:10
已关闭反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\ ?
?morgan\My Documents\Downloads\
C:\Documents and Settings\morgan\My Documents\Downloads\1. ?
?exe - Win32/Hupigon 木马的变种
C:\Documents and Settings\morgan\My Documents\Downloads\a. ?
?exe - 是正常的
C:\Documents and Settings\morgan\My Documents\Downloads\ ?
?avp6.0_key.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\Downloads\ ?
?key.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\Downloads\ ?
?Patcher.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\Downloads\ ?
?winplayer.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\Downloads\ ?
?无敌外挂.exe - 是正常的
已扫描的文件数目：7
已发现的病毒数目：1
活动的病毒数目：1
完成时间： 21:37:44 总扫描时间：34 秒 (00:00:34)


[Scan path] C:\Documents and Settings\morgan\My Documents\Downloads
C:\Documents and Settings\morgan\My Documents\Downloads\1.exe infected with BackDoor.Pigeon.36
C:\Documents and Settings\morgan\My Documents\Downloads\a.exe - Ok
>C:\Documents and Settings\morgan\My Documents\Downloads\avp6.0_key.exe - Ok
C:\Documents and Settings\morgan\My Documents\Downloads\key.exe - Ok
C:\Documents and Settings\morgan\My Documents\Downloads\Patcher.exe - Ok
C:\Documents and Settings\morgan\My Documents\Downloads\winplayer.exe - Ok
C:\Documents and Settings\morgan\My Documents\Downloads\无敌外挂 - read error

promised

原帖由 红心王子 于 2007-5-26 10:34 发表

蜘蛛报了一个就不对劲了，看来和费尔的引擎还是有
差别的

报壳和不报壳有可比性吗

promised

这两个没有问题，鉴定完毕

bridgewr

无敌外挂.exe、winplayer.exe2个都缺少配置文件运行出错

bridgewr

再上一个

bridgewr

还有