[afe663]

jimmyleo

jimmyleo

D:\download\t3\show2.rar:\show2.exe - Signature 'Trojan-Dropper.Win32.Delf.MM' found
D:\download\t3\show2.rar

        2 Files scanned
          (1 Archive with 1 file)
        1 Signature found
        0 Suspect code-parts found
        Used time: 0:00.020

jimmyleo

新ik的速度真是无敌了%……

[ 本帖最后由 jimmyleo 于 2007-7-27 07:58 编辑 ]

lsyer

雨伞 卡巴PASS
问下~
IK= ikarus？

jimmyleo

恩 简略说了~

红心王子

这个过了红伞

avast独报，怀疑是误报

Scan taken on 27 Jul 2007 00:09:26 (GMT)
A-Squared	Found nothing
AntiVir	Found nothing
ArcaVir	Found nothing
Avast	Found Win32:Delf-FII
AVG Antivirus	Found nothing
BitDefender	Found nothing
ClamAV	Found nothing
CPsecure	Found nothing
Dr.Web	Found nothing
F-Prot Antivirus	Found nothing
F-Secure Anti-Virus	Found nothing
Fortinet	Found nothing
Kaspersky Anti-Virus	Found nothing
NOD32	Found nothing
Norman Virus Control	Found nothing
Panda Antivirus	Found nothing
Rising Antivirus	Found nothing
Sophos Antivirus	Found nothing
VirusBuster	Found nothing
VBA32	Found nothing

jimmyleo

非也 你运行下就知道了~

tracydk

为什么搞的avast一个报的就是误报??avast也有NB的时候

xxwpk007

2007-07-27 08:33:47    运行应用程序      操作:允许
进程路径:C:\windows\Explorer.EXE
文件路径:C:\Documents and Settings\Administrator\桌面\show2.exe
触发规则:应用程序规则->自动创建规则->C:\windows\Explorer.EXE


2007-07-27 08:33:57    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\show2.exe
文件路径:C:\test.hiv
触发规则:所有程序规则->系统文件->%SystemDrive%\*


2007-07-27 08:33:59    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\show2.exe
文件路径:C:\test2.hiv
触发规则:所有程序规则->系统文件->%SystemDrive%\*


2007-07-27 08:33:59    修改注册表内容      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\show2.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
注册表名称:*
触发规则:所有程序规则->系统自动运行->*\Software\Microsoft\Windows\CurrentVersion\Run*


2007-07-27 08:34:40    删除文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\show2.exe
文件路径:C:\test.hiv
触发规则:所有程序规则->系统文件->%SystemDrive%\*


2007-07-27 08:34:40    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\show2.exe
文件路径:C:\windows\system32\lo.dll
触发规则:所有程序规则->防御规则->%systemdrive%\*.dll


2007-07-27 08:34:45    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\show2.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1GDBJR10\5in1[1].exe
触发规则:所有程序规则->防御规则->%systemdrive%\*.exe


2007-07-27 08:34:45    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\show2.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1GDBJR10\CA45EZ8T.exe
触发规则:所有程序规则->防御规则->%systemdrive%\*.exe


2007-07-27 08:34:46    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\show2.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1GDBJR10\exeg[1].exe
触发规则:所有程序规则->防御规则->%systemdrive%\*.exe


2007-07-27 08:34:46    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\show2.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1GDBJR10\CA0LY51U.exe
触发规则:所有程序规则->防御规则->%systemdrive%\*.exe


2007-07-27 08:34:47    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\show2.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1GDBJR10\ghuany[1].exe
触发规则:所有程序规则->防御规则->%systemdrive%\*.exe


2007-07-27 08:34:47    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\show2.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1GDBJR10\CAV2H09V.exe
触发规则:所有程序规则->防御规则->%systemdrive%\*.exe


2007-07-27 08:34:58    运行应用程序      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\show2.exe
文件路径:C:\windows\system32\cmd.exe
命令行:/cC:\windows\system32\love.exe
触发规则:黑名单->防御规则->*\cmd.exe


2007-07-27 08:35:00    运行应用程序      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\show2.exe
文件路径:C:\windows\system32\cmd.exe
命令行:/cC:\windows\system32\5in1.exe
触发规则:黑名单->防御规则->*\cmd.exe


2007-07-27 08:35:01    运行应用程序      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\show2.exe
文件路径:C:\windows\system32\cmd.exe
命令行:/cC:\windows\system32\fut4.exe
触发规则:黑名单->防御规则->*\cmd.exe


2007-07-27 08:35:05    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\show2.exe
文件路径:C:\windows\system32\tian.exe
触发规则:所有程序规则->系统文件->%WinDir%\system32\*.exe

jimmyleo

LS的 把download的 都抓上来吧~