自己看吧

显示全部楼层 · 发表于 2007-7-21 09:18:44

样本是我加了几个壳的一个正常文件
更搞笑的是有杀软报灰鸽子呵呵无语了

显示全部楼层 · 发表于 2007-7-21 09:21:14

估计是VBA32什么的

显示全部楼层 · 发表于 2007-7-21 09:21:34

我看是病毒吧

脱壳前NORMAN报
我脱了壳后NORMAN还是在报而且名字都一样

脱壳前
===================================================================================================
NVCOD On Demand Scanner 5.80.02

NSE revision 5.91.02
nvcbin.def revision 5.90.00 of 2007/07/19 17:24:52 (812833 variants)
nvcmacro.def revision 5.90.00 of 2007/06/29 06:32:19 (20341 variants)
Total number of variants: 833174
Command line: "@C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~ODD.tmp"
===================================================================================================

   Time  Filename                                                    Virus name
---------------------------------------------------------------------------------------------------
- Scanning files matching: F:\Hash.exe
      0 ms F:\Hash.exe                                                 Trojan Suspicious_H.gen ()
- File F:\Hash.exe quarantined.
- File F:\Hash.exe deleted.

===================================================================================================

The scanning started: 2007/07/21 09:17:04
            ended: 2007/07/21 09:17:04
Logged on as       : Administrator
on hostname       : BE29C0E1C4C9406

Scanning results:
Total number of files found..............................:    1
Number of files scanned..................................:    1
Number of files/directories skipped due to exclude list..:    0
Number of files that could not be opened.................:    0
Number of archive files unpacked.........................:    0
Number of archive files not unpacked.....................:    0
Number of infections.....................................:    1

Copyright (c) 1993-2005 Norman ASA.
脱壳后
===================================================================================================
NVCOD On Demand Scanner 5.80.02

NSE revision 5.91.02
nvcbin.def revision 5.90.00 of 2007/07/19 17:24:52 (812833 variants)
nvcmacro.def revision 5.90.00 of 2007/06/29 06:32:19 (20341 variants)
Total number of variants: 833174
Command line: "@C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~ODE.tmp"
===================================================================================================

   Time  Filename                                                    Virus name
---------------------------------------------------------------------------------------------------
- Scanning files matching: F:\unpacked.exe
      0 ms F:\unpacked.exe                                           Trojan Suspicious_H.gen ()
- File F:\unpacked.exe quarantined.
- File F:\unpacked.exe deleted.

===================================================================================================

The scanning started: 2007/07/21 09:17:53
            ended: 2007/07/21 09:17:53
Logged on as       : Administrator
on hostname       : BE29C0E1C4C9406

Scanning results:
Total number of files found..............................:    1
Number of files scanned..................................:    1
Number of files/directories skipped due to exclude list..:    0
Number of files that could not be opened.................:    0
Number of archive files unpacked.........................:    0
Number of archive files not unpacked.....................:    0
Number of infections.....................................:    1

Copyright (c) 1993-2005 Norman ASA.

显示全部楼层 · 发表于 2007-7-21 09:22:15

不是毒可能你没脱玩正常的程序

显示全部楼层 · 发表于 2007-7-21 09:23:17

PACKER壳

显示全部楼层 · 发表于 2007-7-21 09:23:33

原帖由 za1012 于 2007-7-21 09:22 发表
不是毒可能你没脱玩正常的程序

SORRY还有个ASPACK没有脱

[ 本帖最后由 woai_jolin 于 2007-7-21 09:25 编辑 ]

显示全部楼层 · 发表于 2007-7-21 09:24:25

你多引擎看看普通程序

显示全部楼层 · 发表于 2007-7-21 09:27:10

我把脱后的传上来
全部脱完还是在报
===================================================================================================
NVCOD On Demand Scanner 5.80.02
NSE revision 5.91.02
nvcbin.def revision 5.90.00 of 2007/07/19 17:24:52 (812833 variants)
nvcmacro.def revision 5.90.00 of 2007/06/29 06:32:19 (20341 variants)
Total number of variants: 833174
Command line: "@C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~OD11.tmp"
===================================================================================================
   Time  Filename                                                    Virus name
---------------------------------------------------------------------------------------------------
- Scanning files matching: F:\unpacked.exe
      0 ms F:\unpacked.exe                                           Trojan Suspicious_H.gen ()
- File F:\unpacked.exe quarantined.
- File F:\unpacked.exe deleted.
===================================================================================================
The scanning started: 2007/07/21 09:23:06
            ended: 2007/07/21 09:23:06
Logged on as       : Administrator
on hostname       : BE29C0E1C4C9406
Scanning results:
Total number of files found..............................:    1
Number of files scanned..................................:    1
Number of files/directories skipped due to exclude list..:    0
Number of files that could not be opened.................:    0
Number of archive files unpacked.........................:    0
Number of archive files not unpacked.....................:    0
Number of infections.....................................:    1
Copyright (c) 1993-2005 Norman ASA.

显示全部楼层 · 发表于 2007-7-21 09:29:17

全部脱完后

Scanner	Name der Malware
A-Squared	X
AntiVir	BDS/Hupigon.Gen
ArcaVir	X
Avast	X
AVG Antivirus	X
BitDefender	X
ClamAV	X
CPsecure	X
Dr.Web	X
F-Prot Antivirus	Possibly a new variant of W32/Threat-HLLIE-based!Maximus
F-Secure Anti-Virus	X
Fortinet	X
Kaspersky Anti-Virus	X
NOD32	X
Norman Virus Control	Hupigon.gen126
Panda Antivirus	X
Rising Antivirus	X
Sophos Antivirus	Mal/GrayBird
VirusBuster	X
VBA32	X

显示全部楼层 · 发表于 2007-7-21 09:29:46

不杀上报。。

自己看吧

本帖子中包含更多资源

回复 #6 woai_jolin 的帖子

本帖子中包含更多资源