收到一個QQ尾巴傳來的檔案（第2版）

endurer　原創

2006-04-04　第2版　補充完善

2006-04-03　第1版

QQ傳來的檔案是：元旦快樂.ZIP，其中的檔案是

 

 

元旦快樂.jpg                                                                                                                                .exe

 

 

檔案表徵圖為MM的頭像，檔案名稱中的.jpg和檔案的副檔名.exe前面加上了許多空格，很容易讓人以為是一個JPG圖片檔案。

瑞星報為Worm.QQ.TopFox.aq

Kaspersky 5在QQ中接收檔案時不報，手動掃描或解壓時才報為：Trojan.Win32.VB.aha。

File:	元旦快樂.zip
Status:	INFECTED/MALWARE
MD5	d7958247cf08ab13a22c0b137e8c9cca
Packers detected:	Analyzing...
Scanner results
AntiVir	Found Trojan/TopFox.A
ArcaVir	Found Trojan.Vb.Aha
Avast	Found Win32:Trojan-gen. {Other}
AVG Antivirus	Found Generic.MHL
BitDefender	Found Trojan.Vb.AHA
ClamAV	Found nothing
Dr.Web	Found Trojan.Topfox
F-Prot Antivirus	Found nothing
Fortinet	Found W32/QQLove.A-pws
Kaspersky Anti-Virus	Found Trojan.Win32.VB.aha
NOD32	Found probably unknown NewHeur_PE (probable variant)
Norman Virus Control	Found W32/VBTroj.TT
UNA	Found nothing
VirusBuster	Found Trojan.VB.EDK
VBA32	Found Trojan.Win32.VB.aha

 

This is a report processed by VirusTotal on 04/03/2006 at 11:59:44 (CET) after scanning the file " __25968" file.

Antivirus	Version	Update	Result
AntiVir	6.34.0.14	04.03.2006	TR/TopFox.A
Avast	4.6.695.0	04.03.2006	Win32:Trojan-gen. {Other}
AVG	386	03.31.2006	Generic.MHL
Avira	6.34.0.54	04.03.2006	TR/TopFox.A
BitDefender	7.2	04.03.2006	Trojan.Vb.AHA
CAT-QuickHeal	8.00	03.31.2006	Trojan.VB.aha
ClamAV	devel-20060202	04.03.2006	no virus found
DrWeb	4.33	04.03.2006	Trojan.Topfox
eTrust-InoculateIT	23.71.118	04.02.2006	Win32/SillyDL.21652!Trojan
eTrust-Vet	12.4.2146	04.03.2006	no virus found
Ewido	3.5	04.03.2006	Trojan.VB.aha
Fortinet	2.71.0.0	04.03.2006	W32/QQLove.A-pws
F-Prot	3.16c	03.30.2006	no virus found
Ikarus	0.2.59.0	04.01.2006	Win32.HLLW.Imkill
Kaspersky	4.0.2.24	04.03.2006	Trojan.Win32.VB.aha
McAfee	4731	03.31.2006	Generic Malware.a!zip
NOD32v2	1.1467	04.02.2006	probably unknown NewHeur_PE virus
Norman	5.70.10	03.31.2006	W32/VBTroj.TT
Panda	9.0.0.4	04.02.2006	Trj/Qeds.F
Sophos	4.04.0	04.03.2006	no virus found
Symantec	8.0	04.03.2006	Trojan Horse
TheHacker	5.9.7.124	04.03.2006	W32/Generic!zip-dobleextension
UNA	1.83	03.30.2006	Trojan.Win32.VB
VBA32	3.10.5	04.03.2006	Trojan.Win32.VB.aha