是误报吗？

28654621

RT

AVAST!报的  大家看下是误报吗？  sanhex 是连连看绿色版里面的     xiangqidashi  是象棋大师

sanhex    Win32:Trojan-gen.{other}

xiangqidashi    Win32:Trojan-gen.{UPX!}

scottxzt

Begin scan in 'C:\Documents and Settings\dell\桌面\sanhex.zip'
C:\Documents and Settings\dell\桌面\sanhex.zip
  [0] Archive type: ZIP
  --> sanhex.exe
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/BaiduBar.DD
      [INFO]      The file was successfully wiped!
      [INFO]      The file was deleted!

woai_jolin

xiangqidashi.exe : Not detected by Sandbox (Signature: NO_VIRUS)


[ DetectionInfo ]
   * Sandbox name: NO_MALWARE
   * Signature name: NO_VIRUS
   * Compressed: YES

[ General information ]
   * Decompressing UPX.
   * File length:       145254 bytes.
   * MD5 hash: ca18d9d39db71329a8b3bf0e9863fa87.

[ Process/window information ]
   * Attempts to open CLSID  {0000002C-5994-0005-A03C-01733C3B4000}.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.

This file is not flagged as malicious by the Norman Sandbox Information Center. However, we can not guarantee that the file is harmless. If you still suspect the file to be malicious and if you urgently need to know for sure, please submit it to your local Norman support department for manual analysis.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

[ 本帖最后由 woai_jolin 于 2007-10-5 19:15 编辑 ]

woai_jolin

sanhex.exe : Not detected by Sandbox (Signature: NO_VIRUS)


[ DetectionInfo ]
   * Sandbox name: NO_MALWARE
   * Signature name: NO_VIRUS
   * Compressed: NO

[ General information ]
   * File length:       382961 bytes.
   * MD5 hash: f50cf0f427f4fde06d5857ca444188f3.

[ Changes to filesystem ]
   * Creates directory C:\WINDOWS\TEMP.
   * Creates file C:\WINDOWS\TEMP\nsx8999.tmp.
   * Deletes file C:\WINDOWS\TEMP\nsx8999.tmp.
   * Creates file C:\WINDOWS\TEMP\nsa0899.tmp.
   * Creates directory C:\PROGRA~1.
   * Creates directory C:\PROGRA~1\baidu.
   * Creates directory C:\PROGRA~1\baidu\bar.
   * Creates directory C:\PROGRA~1\baidu\bar\BDBar_tmp.
   * Creates directory C:\PROGRA~1\baidu\bar\BDBar_tmp\img.
   * Creates file C:\PROGRA~1\baidu\bar\BDBar_tmp\img\imglist.bmp.
   * Creates file C:\PROGRA~1\baidu\bar\BDBar_tmp\img\logo.bmp.
   * Creates file C:\PROGRA~1\baidu\bar\BDBar_tmp\baidubar.dat.
   * Creates file C:\PROGRA~1\baidu\bar\BDBar_tmp\BaiduBar.dll.

[ Signature Scanning ]
   * C:\PROGRA~1\baidu\bar\BDBar_tmp\img\imglist.bmp (17720 bytes) : no signature detection.
   * C:\PROGRA~1\baidu\bar\BDBar_tmp\img\logo.bmp (2616 bytes) : no signature detection.
   * C:\PROGRA~1\baidu\bar\BDBar_tmp\baidubar.dat (15308 bytes) : no signature detection.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.

This file is not flagged as malicious by the Norman Sandbox Information Center. However, we can not guarantee that the file is harmless. If you still suspect the file to be malicious and if you urgently need to know for sure, please submit it to your local Norman support department for manual analysis.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

woai_jolin

百度

linsicky

原帖由 <i>woai_jolin</i> 于 2007-10-5 19:13 发表 <a href="http://bbs.kafan.cn/redirect.php?goto=findpost&pid=1836042&ptid=139560" target="_blank"><img src="http://bbs.kafan.cn/images/common/back.gif" border="0" onclick="zoom(this)" onload="attachimg(this, 'load')" alt="" /></a><br />
sanhex.exe : Not detected by Sandbox (Signature: NO_VIRUS)<br />
<br />
<br />
[ DetectionInfo ]<br />
&nbsp; &nbsp;* Sandbox name: NO_MALWARE<br />
&nbsp; &nbsp;* Signature name: NO_VIRUS<br />
&nbsp; &nbsp;* Compressed: NO<br />
<br />
[ General information ]<br />
&nbsp; &nbsp;*&nbsp;&nbsp;...

<br />
你用的是什么HIPS？？

woai_jolin

norman的sandbox在线扫描

qigang

RX挂起。

king6808

没报

微点卫士

程序:
C:\PROGRAM FILES\BAIDU\BAR\BAIDUBAR.DLL
是可疑程序，是否阻止该进程继续运行?
程序:
C:\PROGRAM FILES\BAIDU\BAR\BAIDUBAR.DLL
是否删除病毒程序?

xiangqidashi.exe安装象棋大师，不安装