Folderraper,感染呀感染......红伞挂，NOD抓

wangweivip

AhnLab-V3        2007.5.31.2        06.01.2007        no virus found
AntiVir          7.4.0.29        06.01.2007        no virus found
Authentium        4.93.8          05.23.2007        no virus found
Avast                  4.7.997.0        06.01.2007        no virus found
AVG                  7.5.0.467        06.03.2007        no virus found
BitDefender        7.2                  06.03.2007        Trojan.Vb.ATG
CAT-QuickHeal 9.00            06.02.2007        W32.Delf.BH
ClamAVdevel-20070416        06.03.2007        no virus found
DrWeb          4.33                  06.03.2007        no virus found
eSafe                  7.0.15.0        06.03.2007        no virus found
eTrust-Vet        30.7.3688        06.03.2007        no virus found
Ewido                  4.0                  06.03.2007        Trojan.VB.atg
FileAdvisor        1                  06.03.2007        no virus found
Fortinet        2.85.0.0        06.02.2007        suspicious
F-Prot                  4.3.2.48        06.01.2007        no virus found
F-Secure        6.70.13030.0        06.03.2007        Virus.Win32.Downloader.f
Ikarus           T3.1.1.8        06.03.2007        Virus.Win32.Downloader.f
Kaspersky        4.0.2.24        06.03.2007        Virus.Win32.Downloader.f
McAfee        5044                  06.01.2007        no virus found
Microsoft        1.2503                  06.03.2007        no virus found
Norman        5.80.02        06.01.2007        no virus found
Panda                  9.0.0.4        06.03.2007        W32/Downloader.OPZ
Prevx1           V2                  06.03.2007        no virus found
Sophos        4.18.0                  06.01.2007        no virus found
Sunbelt        2.2.907.0        05.30.2007        no virus found
Symantec        10                  06.03.2007        Downloader
TheHacker        6.1.6.128        05.31.2007        no virus found



好像比较严重哦

solcroft

Funny!.reg+壳王报杀的生成物

1. REGEDIT4
   
2. [HKEY_CLASSES_ROOT\exefile]
   
3. "NeverShowExt"=""
   
4. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
   
5. "HideFileExt"=dword:00000001
   
6. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
   
7. "DisableRegistryTools"=dword:00000001
   
8. "DisableTaskMgr"=dword:00000001
   
9. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
   
10. "CheckedValue"=dword:00000000
    
11. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    
12. "FolderRaper"="C:\\Documents and Settings\\Virtual Machine\\Desktop\\新建文件夹 (4)\\新建文件夹 (4).exe"

复制代码

taihuxian

Begin scan in 'C:\Documents and Settings\Administrator\桌面\新建文件夹 (4).rar'
C:\Documents and Settings\Administrator\桌面\新建文件夹 (4).rar
  [0] Archive type: RAR
  --> н¨Îļþ¼Ð (4)\н¨Îļþ¼Ð (4).exe
      [DETECTION] Is the Trojan horse TR/Vb.ATG.62
      [INFO]      A backup was created as 'abeaa444.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!

woai_jolin

2007/6/4 12:37:04        Scanning Log
2007/6/4 12:37:04        Version of virus signature database: 2305 (20070601)
2007/6/4 12:37:04        Date: 4.6.2007  Time: 12:37:04
2007/6/4 12:37:04        Scanned disks, folders and files: E:\病毒测试\;E:\VistaAdvance.zip
2007/6/4 12:37:08        E:\病毒测试\新建文件夹 (4).rar - Win32/Mypis.C virus - deleted
2007/6/4 12:37:08        E:\病毒测试\新建文件夹 (4).rar » RAR » 新建文件夹 (4)\新建文件夹 (4).exe - Win32/Mypis.C virus
2007/6/4 12:37:08        Number of scanned files: 74
2007/6/4 12:37:08        Number of threats found: 1
2007/6/4 12:37:08        Time of completion: 12:37:08  Total scanning time: 4 sec (00:00:04)

scottxzt

早就上报了。哈哈！

人浪流涯天

http://hi.baidu.com/renlangliu/b ... 8a66305c600895.html

wangweivip

原帖由 taihuxian 于 2007-6-4 06:48 发表
Begin scan in 'C:\Documents and Settings\Administrator\桌面\新建文件夹 (4).rar'
C:\Documents and Settings\Administrator\桌面\新建文件夹 (4).rar
  [0] Archive type: RAR
  --> н ...

发的时候就已经上报了  下面是回复

Dear Sir or Madam,

Thank you for your email to Avira's virus lab.
Tracking number: INC00048435.

We received the following archive files:File ID         Filename         Size (Byte)        Result
598781         ????? (4).rar        10.36 KB        OK

A listing of files contained inside archives alongside their results can be found below:File ID         Filename         Size (Byte)        Result
598782         ########## (4).exe         44.64 KB         MALWARE

Please find a detailed report concerning each individual sample below: Filename        Result         ########## (4).exe         MALWARE

The file '########## (4).exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/Vb.ATG.62. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 6.38.01.219.

Alternatively you can see the analysis result here:
http://analysis.avira.com/samples/details.php?uniqueid=ZFhS11GqyWI3dyBjL4jWQ2VVyK4KpGyr&incidentid=48435

An overview of all your submissions can be found here:
http://analysis.avira.com/samples/details.php?uniqueid=ZFhS11GqyWI3dyBjL4jWQ2VVyK4KpGyr

Please note: The detection of Spy/Adware is not available in the product "AntiVir PersonalEdition Classic". Please address specific questions to support@avira.com

Kind regards
Avira Virus Lab

---------------------------------------------
Avira GmbH
Lindauer Str. 21, D-88069 Tettnang, Germany
Phone: +49 (0) 7542-500 0
Fax: +49 (0) 7542-525 10
Internet: http://www.avira.com

CEO: Tjark Auerbach
Headquarter: Tettnang
Commercial register: AG Ulm HRB 630992