king_hh

注意！注意！

以上网址http://www.orsoon.com/index.html（未来软件园）有病毒。ssm拦截了，在windows目录下生成文件。
提取到多引擎扫描结果：卡巴挂

AntiVir 7.3.0.26 01.22.2007 DR/Delphi.Gen
Authentium 4.93.8 01.22.2007  no virus found
Avast 4.7.936.0 01.22.2007 Win32:Nilage-AJ
AVG 386 01.23.2007  no virus found
BitDefender 7.2 01.23.2007 Generic.Malware.Sdld.30A2E0BA
CAT-QuickHeal 9.00 01.22.2007  no virus found
ClamAV devel-20060426 01.22.2007  no virus found
DrWeb 4.33 01.23.2007  no virus found
eSafe 7.0.14.0 01.21.2007 suspicious Trojan/Worm
eTrust-InoculateIT 23.73.120 01.23.2007  no virus found
eTrust-Vet 30.3.3344 01.23.2007  no virus found
Ewido 4.0 01.22.2007 Trojan.Delf.mc
Fortinet 2.82.0.0 01.23.2007  no virus found
F-Prot 3.16f 01.22.2007  no virus found
F-Prot4 4.2.1.29 01.22.2007  no virus found
Ikarus T3.1.0.27 01.23.2007  no virus found
Kaspersky 4.0.2.24 01.23.2007  no virus found
McAfee 4946 01.22.2007 no virus found

File size: 15052 bytes
MD5: 6d911718b9e9a7776ebc4b299da08265
SHA1: d82a2aee123f61765bdc872690ab34fc4c05cd8a
packers: UPX
packers: UPX
packers: UPX, BINARYRES
packers: UPX

king_hh

你不见上面的评测吗？卡巴挂了……再者，这个应该是被人挂上不久的灰鸽子木马。加了UPX壳的。卡巴没反应，赶紧用Ewido杀毒。
我下面传上生成：


VirusBuster Found Trojan.QQPass.Gen
VBA32 Found MalwareScope.Backdoor.Hupigon.19
VirusBuster Found Trojan.QQPass.Gen
BitDefender Found Generic.Malware.Sdld.30A2E0BA (probable variant)

[ 本帖最后由 king_hh 于 2007-1-23 16:18 编辑 ]