可以一贴几个了，一包3个[MD5: C2C637 995AA0 A702EC]

dikex

样本区可以一些几个了，一包3个


具体看这里
http://bbs.kafan.cn/viewthread.php?tid=93409&extra=page%3D1

已经得到lanvin版主的允许，新规定修正中

allenhippo

似曾相识啊，特别是哪个NewInfo.bmp，又更新了？

rasis

样本.rar
  [0] Archive type: RAR
  --> qq.exe
      [DETECTION] Contains signature of the worm WORM/Delf.CI.1
  --> NewInfo.bmp
      [DETECTION] Contains suspicious code HEUR/Malware

wangjay1980

detected: virus Worm.Win32.Delf.ci        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/qq.exe
detected: virus Virus.Win32.AutoRun.be        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/tmp.exe
detected: Trojan program Trojan-PSW.Win32.Delf.qc        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/NewInfo.bmp

dikex

原帖由 allenhippo 于 2007-6-5 15:46 发表
似曾相识啊，特别是哪个NewInfo.bmp，又更新了？

的确是最近更新的版本，虽然比起那个svchost前端时间几乎一天一次的不算什么，但那东西的更新频率不低啊，

allenhippo

昨天有人发了个样本，运行后下了20余个毒，13个卡巴扫不到的，偷偷上报了 现在用卡巴真是凶险哪

欠妳緈諨

AVAST   miss

The EQs

Scan performed at: 2007-6-5 17:02:55
Scanning Log
NOD32 version 2308 (20070604) NT
Command line: C:\Documents and Settings\EQ2\桌面\样本.rar
Operating memory - is OK

Date: 5.6.2007  Time: 17:03:00
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\样本.rar
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?qq.exe - a variant of Win32/TrojanDownloader.Delf.BHO trojan
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?tmp.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?NewInfo.bmp - a variant of Win32/PSW.Delf.NHI trojan
Number of scanned files: 4
Number of threats found: 3
Number of files cleaned: 1
Time of completion: 17:03:00 Total scanning time: 0 sec (00:00:00)

Notes:
[7] File is probably infected with an unknown virus.

jlennon

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-5-27
Start time: 2005-6-5 17:04
Engine(s): KAV engine (AVK 17.5523), BD-Engine (BD 17.5246)
Heuristic: On
Archives: On
System areas: Off

Check selected directories and files...
Object: NewInfo.bmp
        Path: C:\Documents and Settings\Administrator\桌面\样本
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.Delf.qc (KAV engine), Generic.PWStealer.FC298059 (BD-Engine)
Object: qq.exe
        Path: C:\Documents and Settings\Administrator\桌面\样本
        Status: Move file into quarantine
        Virus: Worm.Win32.Delf.ci (KAV engine), BehavesLike:Win32.ExplorerHijack (BD-Engine)
Object: tmp.exe
        Path: C:\Documents and Settings\Administrator\桌面\样本
        Status: Move file into quarantine
        Virus: Virus.Win32.AutoRun.be (KAV engine), Trojan.Agent.VB.ANY (BD-Engine)
Analysis complete: 2005-6-5 17:04
    3 files checked
    3 infected files detected
    0 suspected files detected

1688388728

一包3个[MD5: C2C637 995AA0 A702EC]