MD5: 3087e6(过21日卡吧\AVG\BD)

只爱宠儿

一个鄙视卡吧的病毒,很过分

捆绑带下木马

不敢独享,特上传,希望杀软能识别下

捆绑方式是在文件尾部硬塞了21034字节代码

修改PE头,指向尾部的病毒代码(优先执行)

下了16个木马(中途死了几个)

瑞星报:Worm.Delf.dy

分析写好了,就不给连接了,呵呵

附一PP:






样本密码为virus

对不起,又加密码了``

红心王子

解压之后
找不到文件 隐藏系统的文件病毒
斧头KV不报 上报

tracydk

在avast的监控下,解压缩后文件消失???

The EQs

隐藏文件

红心王子

一般隐藏系统你文件
不是很好对付
想运行都很难做到

tracydk

是啊,找不到就不能运行啊

wangjay1980

deleted: Trojan program Trojan-Downloader.Win32.Agent.buv        File: C:\Documents and Settings\Owner\×ÀÃæ\setup.rar/setup.exe//UPack

mofunzone

antivir的名字很有特色，知道木马，而且看来比kav率先截获，没拷贝卡巴的名字，而且看来avast没找到
jotti卡住了，panada扫不过去。。
File:           setup.exe
Status:         
INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5:         3087e68819f9521b7f8be1a17734c3fe
Packers detected:         
Analyzing...
Bit9 reports:         File not found
Scanner results
Scan taken on 22 Jun 2007 03:12:31 (GMT)
A-Squared         
Found nothing
AntiVir         
Found TR/Dldr.Zhidao
ArcaVir         
Found nothing
Avast         
Found nothing
AVG Antivirus         
Found nothing
BitDefender         
Found nothing
ClamAV         
Found nothing
Dr.Web         
Found Trojan.DownLoader.24280
F-Prot Antivirus         
Found nothing
F-Secure Anti-Virus         
Found Trojan-Downloader.Win32.Agent.buv
Fortinet         
Found nothing
Kaspersky Anti-Virus         
Found Trojan-Downloader.Win32.Agent.buv
NOD32         
Found nothing
Norman Virus Control         
Found W32/Suspicious_U.gen
Panda Antivirus         
Scanning, please wait...
Rising Antivirus         
Scanning, please wait...
VirusBuster         
Scanning, please wait...
VBA32         
Scanning, please wait...

scottxzt

A listing of files contained inside archives alongside their results can be found below:

File ID  Filename  Size (Byte) Result
1001055  setup.exe  19.53 KB  MALWARE
203894  autorun.inf  85 Byte  CLEAN


Please find a detailed report concerning each individual sample below:

Filename Result
setup.exe  MALWARE

The file 'setup.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/Dldr.Zhidao. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 6.39.00.44. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: PCK/UPACK.

scottxzt

有趣的木马：ZHIDAO，有中国化的意思。