MD5: A959F6

mhj144007

AhnLab-V3	2007.5.9.0	05.09.2007 [td]no virus found
AntiVir	7.4.0.32	06.15.2007 [td]no virus found
Authentium	4.93.8	06.16.2007 [td]no virus found
Avast	4.7.997.0	06.15.2007 [td]no virus found
AVG	7.5.0.467	05.08.2007 [td]no virus found
BitDefender	7.2	06.16.2007 [td]no virus found
CAT-QuickHeal	9.00	06.15.2007 [td]no virus found
ClamAV	devel-20070416	05.09.2007 [td]no virus found
DrWeb	4.33	06.15.2007	Trojan.Goner
eSafe	7.0.15.0	05.08.2007	suspicious Trojan/Worm
eTrust-Vet	30.7.3721	06.15.2007	Win32/Lolyda.U
FileAdvisor	1	06.16.2007 [td]no virus found
Fortinet	2.85.0.0	06.16.2007	LegMir!tr.pws
F-Prot	4.3.2.48	05.08.2007 [td]no virus found
F-Secure	6.70.13030.0	05.09.2007 [td]no virus found
Ikarus	T3.1.1.7	05.09.2007	Trojan-PWS.Win32.Small.br
Kaspersky	4.0.2.24	06.16.2007 [td]no virus found
McAfee	5054	06.15.2007	PWS-LegMir.dll
Microsoft	1.2607	06.16.2007	VirTool:Win32/Obfuscator.C
NOD32v2	2334	06.15.2007	a variant of Win32/PSW.Agent.NEC
Norman	5.80.02	06.15.2007	W32/Suspicious_U.gen
Panda	9.0.0.4	06.16.2007	Suspicious file
Prevx1	V2	06.16.2007 [td]no virus found
Sophos	4.18.0	06.12.2007	Mal/Packer
Sunbelt	2.2.907.0	05.05.2007	VIPRE.Suspicious
Symantec	10	05.09.2007 [td]no virus found
TheHacker	6.1.6.133	06.15.2007 [td]no virus found
VBA32	3.12.0.2	06.15.2007	Trojan.Goner

小邪邪

咖啡报木马

wangjay1980

2007-6-16 JAY12:12:08        File: C:\Documents and Settings\Owner\×ÀÃæ\MSDEG32.zip/MSDEG32.DLL//UPack        ok        scanned
detected: Trojan program Trojan-PSW.Win32.OnLineGames.nn URL: http://bbs.kafan.cn/attachment.php?aid=88050//MSDEG32.DLL//UPack

[ 本帖最后由 wangjay1980 于 2007-6-16 15:35 编辑 ]

红心王子

给LZ一点建议
不知道你能否采纳
安博士AhnLab-V3的扫描引擎形同虚设，不如不列出来
样本区里面的测试 属安博士最差劲 表现的也不是很突出
斧头KV接招  监控拦截

mofunzone

可惜呀可惜

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\MSDEG32.rar'
C:\Documents and Settings\Administrator\My Documents\
  MSDEG32.rar
    [0] Archive type: RAR
    --> MSDEG32.DLL
        [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!

金剑

风暴胜者V2 测试版本(http://www.v0day.com)
_________您的安全是我们的责任_______________
载入病毒库…进行整理…分配内存…可以使用



===============================================
   ___________病毒查杀结果__________________


===============================================

2007年6月16日12时20分44秒 开始查杀C:\Documents and Settings\Administrator\桌面\virus\MSDEG32
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\virus\MSDEG32\MSDEG32.DLL 操作:阻止运行
=========================================

_________文件性质分析结果________________
"带壳"仅指文件性质,仅供专业人员分析使用。


-----------------------------------------

2007年6月16日12时20分44秒收起线程…100% 查杀完毕！
扫描文件：1查杀病毒：1

taihuxian

[0] Archive type: RAR
  --> MSDEG32.DLL
      [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
      [INFO]      A backup was created as '46b7677c.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!

蓝色牛仔裤

[Scan path] C:\Documents and Settings\Administrator\桌面\MSDEG32.rar
>>C:\Documents and Settings\Administrator\桌面\MSDEG32.rar\MSDEG32.DLL infected with Trojan.Goner
C:\Documents and Settings\Administrator\桌面\MSDEG32.rar - archive contains infected objects

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 3
Infected objects found: 1
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 5 Kb/s
Scan time: 00:00:00

scottxzt

一堆码码无法运行机制。

promised

为什么和多引擎不一样
?           Copyright (c) 1993-2007 by VBA Ltd.            ?
酝屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯?
License expired
License #000000119 Valid till 2006-12-31
Demo mode
Command line options:
/r=susp.rpt /ha=3 /collect_suspects /nc /af+ /ar+ /bt- /mr- /ml+ /rw+ /as-
Ctrl-C will terminate program execution

*:
C:\
C:\...\MSDEG32.DLL : is suspected of Trojan-PSW.Game.32 (paranoid heuristics)
Program execution terminated by user


Directories       : 3       Files in archives:      Files on disks:
Archives:                   - total       : 1       - total       : 14
- scanned         : 1       -  scanned    : 1       - scanned     : 14
- contain viruses : 0       -  infected   : 0       - infected    : 0
- deleted         : 0       -  suspicious : 1       - suspicious  : 1

Startup    : 13:08:35 16-06-2007
End        : 13:08:38 16-06-2007
Total time : 00:00:03
终止批处理操作吗(Y/N)?