[MD5: A95DE4]

显示全部楼层 · 发表于 2007-7-12 14:09:27

D:\download\t3\样本.rar:\~Temp9688.tmp
D:\download\t3\样本.rar
2 个文件被扫描
(1 个压缩档和 1 个文件)
0 个病毒被侦测
0 个可疑代码段被侦测
耗时： 0:00.220

显示全部楼层 · 发表于 2007-7-12 14:10:58

谀哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪姆
?          VirusBlokAda (Console scanner)          ?
?Vba32 Windows/CL 3.12.0.2 / 2007.07.10 20:12 (Vba32.W) ?
?       Copyright (c) 1993-2007 by VBA Ltd.          ?
酝屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯图
License expired
License #000000119 Valid till 2006-12-31
Demo mode
Computer: PROMISED-CE046A
System: Windows XP
Command line options:
/r=susp.rpt /ha=3 /collect_suspects /nc /sfx /af+ /fd+ /ar+ /bt- /mr- /ml+ /rw+ /as-
Program settings:
/r=susp.rpt /ha=3 /collect_suspects /nc /sfx /af+ /fd+ /ar+ /qu+ /ml+ /rw+

*:
C:\
C:\ABC\样本.rar:<RAR>\~Temp9688.tmp : is suspected of Trojan-PSW.Game.18 (paranoid heuristics)
Program execution terminated by user

Directories    : 3    Files in archives:    Files on disks:
Archives:                - total    : 1    - total    : 12
- scanned       : 1    -  scanned : 1    - scanned    : 11
- contain viruses : 0    -  infected : 0    - infected : 0
- deleted       : 0    -  suspicious : 1    - suspicious  : 1

Startup : 14:10:52 12-07-2007
End       : 14:10:55 12-07-2007
Total time : 00:00:03

显示全部楼层 · 发表于 2007-7-12 14:14:43

上报

显示全部楼层 · 发表于 2007-7-12 14:15:14

最近这个的变种还真多

显示全部楼层 · 发表于 2007-7-12 14:21:44

KB PASS

显示全部楼层 · 发表于 2007-7-12 14:24:26

tarting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本.rar'
C:\Documents and Settings\Administrator\桌面\样本.rar
  [0] Archive type: RAR
  --> ~Temp9688.tmp
   [DETECTION] Is the Trojan horse TR/Autorun.BK
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-7-12 14:32:24

刚才看了一下，各大杀软对这个病毒的特征码定位都不是很理想
基本10%
VBA32识别率最高

显示全部楼层 · 发表于 2007-7-12 14:45:34

Scan performed at: 2007-7-12 14:45:17
Scanning Log
NOD32 version 2394 (20070711) NT
Command line: C:\Documents and Settings\EQ2\桌面\2.rar
Operating memory - is OK

Date: 12.7.2007 Time: 14:45:24
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\2.rar
C:\Documents and Settings\EQ2\桌面\2.rar ?RAR ?~Temp9688.tmp - a variant of Win32/PSW.OnLineGames.NBR trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 14:45:24 Total scanning time: 0 sec (00:00:00)

显示全部楼层 · 发表于 2007-7-12 14:59:10

[病毒样本] [MD5: A95DE4]

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源