MD5: c52cb8 7位数字(07.6.12)

显示全部楼层 · 发表于 2007-6-12 09:09:10

各位大大,你们好

再送上个变种哈``

基本上杀软都报了,还是老把戏,双进程守护

IFEO\破坏安全模式\关杀软\破坏隐藏文件\遍历Autorun.inf

和写RUN启动,没什么研究价值

仅供收藏

补上一点,2个哈,一个好像是北斗D``PIED没反映,自己脱了``

另一个就是原体拉``

显示全部楼层 · 发表于 2007-6-12 09:14:00

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\随机7位数字变种.zip'
C:\Documents and Settings\Administrator\My Documents\
  随机7位数字变种.zip
[0] Archive type: ZIP
--> xywrebh.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPI.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> xywrebh(ÒÑÍÑ¿Ç).exe
      [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/Dumped). Please verify the origin of the file
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-6-12 09:25:49

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-6-6
Start time: 2007-6-12 9:27
Engine(s): KAV engine (AVK 17.5733), BD-Engine (BD 17.5315)
Heuristic: On
Archives: On
System areas: Off

Check selected directories and files...
Object: xywrebh(已脱壳).exe
Path: C:\Documents and Settings\Administrator\桌面\随机7位数字变种
Status: Move file into quarantine
Virus: Virus.Win32.AutoRun.ao (KAV engine), Generic.Malware.SP!Pk!g.77E99EC1 (BD-Engine)
Object: xywrebh.exe
Path: C:\Documents and Settings\Administrator\桌面\随机7位数字变种
Status: Move file into quarantine
Virus: Virus.Win32.AutoRun.ao (KAV engine), Generic.Malware.SP!dldPk!g.E44824E9 (BD-Engine)
Analysis complete: 2007-6-12 9:27
2 files checked
2 infected files detected
0 suspected files detected

显示全部楼层 · 发表于 2007-6-12 09:31:22

deleted: virus Virus.Win32.AutoRun.ao File: C:\Documents and Settings\Owner\×ÀÃæ\Ëæ»ú7Î»Êý×Ö±äÖÖ.zip/xywrebh.exe//NSPack
deleted: virus Virus.Win32.AutoRun.ao File: C:\Documents and Settings\Owner\×ÀÃæ\Ëæ»ú7Î»Êý×Ö±äÖÖ.zip/xywrebh(ÒÑÍÑ¿Ç).exe

显示全部楼层 · 发表于 2007-6-12 09:35:52

显示全部楼层 · 发表于 2007-6-12 09:57:57

avast不让下

显示全部楼层 · 发表于 2007-6-12 10:02:27

果然是北斗的```

显示全部楼层 · 发表于 2007-6-12 10:02:44

费尔

显示全部楼层 · 发表于 2007-6-12 10:08:08

我还以为是你自己脱的

显示全部楼层 · 发表于 2007-6-12 10:15:08

原帖由 solcroft 于 2007-6-12 10:08 发表
我还以为是你自己脱的

是自己脱的``

PEID查为未知壳

[病毒样本] MD5: c52cb8 7位数字(07.6.12)

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

回复 #7 只爱宠儿的帖子

[病毒样本] MD5: c52cb8 7位数字(07.6.12)

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

回复 #7 只爱宠儿 的帖子

回复 #7 只爱宠儿的帖子