样本2个

显示全部楼层 · 发表于 2011-3-10 21:17:53

样本2个，来自Sony vegas pro 10

显示全部楼层 · 发表于 2011-3-10 21:28:46

ESET missed.
delreg.exe - clean?
http://camas.comodo.com/cgi-bin/ ... c2b429ceb3be7ae95a5

AviFile.dll - To ESET.
http://samples.nod32.com.hk/inde ... 39d375111dc4d0d8af3

显示全部楼层 · 发表于 2011-3-10 21:31:42

hx1997 发表于 2011-3-10 21:28
ESET missed.
delreg.exe - clean?
http://camas.comodo.com/cgi-bin/submit?file=136fe45783df471ec4c7b ...

AviFile.rar 应该clean
http://www.virustotal.com/file-s ... 363e6169-1299763306
delreg.rar 可疑

http://www.virustotal.com/file-s ... 74f3c9bd-1299763336

显示全部楼层 · 发表于 2011-3-10 21:38:38

回复 3楼三生缘石的帖子

刚运行了下确实有奇怪行为，判断失误了，cima又不准

显示全部楼层 · 发表于 2011-3-10 21:38:59

大蜘蛛均clean，已上报。

显示全部楼层 · 发表于 2011-3-10 21:39:30

2011-03-10 21:33:52 创建文件    操作:允许
进程路径:G:\Documents and Settings\Administrator.HX-C0987054243B\桌面\delreg.exe
文件路径:G:\Sandbox\HX\ThreatBox\user\current\Temp\bt0521.bat
触发规则:所有程序规则->常用目录->*\temp\*.bat

2011-03-10 21:33:56 运行应用程序    操作:允许
进程路径:G:\Documents and Settings\Administrator.HX-C0987054243B\桌面\delreg.exe
文件路径:G:\windows\System32\cmd.exe
命令行:/c G:\DOCUME~1\ADMINI~1.HX-\Temp\bt0521.bat
触发规则:所有程序规则->系统程序调用->*\cmd.exe

2011-03-10 21:34:08 运行应用程序    操作:允许
进程路径:G:\windows\System32\cmd.exe
文件路径:G:\windows\System32\cmd.exe
命令行:/c reg query "HKEY_CLASSES_ROOT\CLSID" | find /i "A677-11d7-A773-00C04F68F44E"
触发规则:所有程序规则->系统程序调用->*\cmd.exe

2011-03-10 21:34:46 运行应用程序    操作:允许
进程路径:G:\windows\System32\cmd.exe
文件路径:G:\windows\System32\cmd.exe
命令行:/c reg query "HKCR\Wow6432Node\CLSID" | find /i "A677-11d7-A773-00C04F68F44E"
触发规则:所有程序规则->系统程序调用->*\cmd.exe

2011-03-10 21:35:08 运行应用程序    操作:允许
进程路径:G:\windows\System32\cmd.exe
文件路径:G:\windows\System32\cmd.exe
命令行:/c reg query "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID" | find /i "A677-11d7-A773-00C04F68F44E"
触发规则:所有程序规则->系统程序调用->*\cmd.exe

2011-03-10 21:35:19 运行应用程序    操作:允许
进程路径:G:\windows\System32\cmd.exe
文件路径:G:\windows\System32\cmd.exe
命令行:/c reg query "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID" | find /i "A677-11d7-A773-00C04F68F44E"
触发规则:所有程序规则->系统程序调用->*\cmd.exe

2011-03-10 21:35:28 删除文件    操作:允许
进程路径:G:\Documents and Settings\Administrator.HX-C0987054243B\桌面\delreg.exe
文件路径:G:\Sandbox\HX\ThreatBox\user\current\Temp\bt0521.bat
触发规则:所有程序规则->常用目录->*\temp\*.bat

显示全部楼层 · 发表于 2011-3-10 21:46:59

AviFile.rar  金山卫士和红伞报安全

delreg.rar 金山卫士报安全

红伞

Starting the file scan:

Begin scan in 'C:\Users\Desktop\delreg.rar'
C:\Users\Desktop\delreg.rar
[0] Archive type: RAR
  [DETECTION] Is the TR/Killav.D Trojan
  --> delreg.exe
  [DETECTION] Is the TR/Killav.D Trojan

Beginning disinfection:
C:\Users\\Desktop\delreg.rar
[DETECTION] Is the TR/Killav.D Trojan
[NOTE]    The file was deleted!

End of the scan: 2011年3月10日  21:43
Used time: 00:00 Minute(s)

The scan has been done completely.

   0 Scanned directories
   3 Files were scanned
   1 Viruses and/or unwanted programs were found
   0 Files were classified as suspicious
   1 files were deleted
   0 Viruses and unwanted programs were repaired
   0 Files were moved to quarantine
   0 Files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   1 Archives were scanned
   0 Warnings
   1 Notes

显示全部楼层 · 发表于 2011-3-10 21:48:39

回复 6楼 hx1997 的帖子

不懂，我想知道delreg.exe这个文件我应该从恢复区删掉还是恢复他？万一是误报的话删了怕vegas某些功能出问题

显示全部楼层 · 发表于 2011-3-10 21:48:52

第一个诺顿不报,第二个诺顿杀掉,报Trojan Horse

显示全部楼层 · 发表于 2011-3-10 21:56:46

本帖最后由 wjcharles 于 2011-3-10 21:59 编辑

NIS2011报了exe

2011-03-10 21:44,高,delreg.exe (Trojan Horse) 检测方自动防护,已阻止,已解决 - 不需要操作,

[病毒样本] 样本2个

本帖子中包含更多资源

本帖子中包含更多资源