从自己电脑里挖出来的[MD5: 3E45CB A3330C 83BF06]

微点卫士

费尔全盘扫描时，微点发现的。

promised

C:\ABC\样本.rar:\E.EXE - 特征码 'MalwareScope.Worm.Viking.3' 被发现
C:\ABC\样本.rar:\E4.DLL - 特征码 'MalwareScope.Worm.Viking.3' 被发现
C:\ABC\样本.rar:\IH57.SYS - 特征码 'Rootkit.Win32.Vanti.eu' 被发现
C:\ABC\样本.rar

        4 文件被扫描
          (1 压缩档 3 文件)
        3 特征码被侦测
        0 可疑代码段被发现
        耗时: 0:00.422

jimmyleo

昨天晚上看片的同时用ik扫了下C盘……
误报不少…… 连iexploer都报了……

miss100

2007-10-6 11:24:29        Real-time file system protection        file        D:\Download\样本.rar        probably a variant of Win32/Pacex.Gen virus                NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\Internet Download Manager\IDMan.exe.

promised

C:\ABC\Internet Explorer\custsat.dll
C:\ABC\Internet Explorer\hmmapi.dll
C:\ABC\Internet Explorer\iedw.exe
C:\ABC\Internet Explorer\ieproxy.dll
C:\ABC\Internet Explorer\iexplore.exe
C:\ABC\Internet Explorer\profsyc.html
C:\ABC\Internet Explorer\Connection Wizard\icwconn.dll
C:\ABC\Internet Explorer\Connection Wizard\icwconn1.exe
C:\ABC\Internet Explorer\Connection Wizard\icwconn2.exe
C:\ABC\Internet Explorer\Connection Wizard\icwdl.dll
C:\ABC\Internet Explorer\Connection Wizard\icwhelp.dll
C:\ABC\Internet Explorer\Connection Wizard\icwip.dun
C:\ABC\Internet Explorer\Connection Wizard\icwres.dll
C:\ABC\Internet Explorer\Connection Wizard\icwrmind.exe
C:\ABC\Internet Explorer\Connection Wizard\icwtutor.exe
C:\ABC\Internet Explorer\Connection Wizard\icwutil.dll
C:\ABC\Internet Explorer\Connection Wizard\icwx25a.dun
C:\ABC\Internet Explorer\Connection Wizard\icwx25b.dun
C:\ABC\Internet Explorer\Connection Wizard\icwx25c.dun
C:\ABC\Internet Explorer\Connection Wizard\inetwiz.exe
C:\ABC\Internet Explorer\Connection Wizard\isignup.exe
C:\ABC\Internet Explorer\Connection Wizard\msicw.isp
C:\ABC\Internet Explorer\Connection Wizard\msn.isp
C:\ABC\Internet Explorer\Connection Wizard\phone.icw
C:\ABC\Internet Explorer\Connection Wizard\phone.ver
C:\ABC\Internet Explorer\Connection Wizard\state.icw
C:\ABC\Internet Explorer\Connection Wizard\support.icw
C:\ABC\Internet Explorer\Connection Wizard\trialoc.dll
C:\ABC\Internet Explorer\PLUGINS\nppdf32.dll
C:\ABC\Internet Explorer\SIGNUP\install.ins
C:\ABC\Internet Explorer\zh-cn\hmmapi.dll.mui
C:\ABC\Internet Explorer\zh-cn\iedw.exe.mui
C:\ABC\Internet Explorer\zh-cn\iexplore.exe.mui

        33 文件被扫描
          (0 压缩档 0 文件)
        0 特征码被侦测
        0 可疑代码段被发现
        耗时: 0:00.360

七少

Starting the file scan:

Begin scan in 'E:\样本.rar'
E:\样本.rar
  [0] Archive type: RAR
  --> E.EXE
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> E4.DLL
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [INFO]      The file was moved to '47356703.qua'!

clovedsm

宇宙第一杀软说无毒

The EQs

jimmyleo

e:\antivirus\ikarus\t3scan.lng
e:\antivirus\ikarus\loader.ini
e:\antivirus\ikarus\Icarus.exe - Suspect code-parts found (Level: 95)
e:\antivirus\ikarus\default.t3p
e:\antivirus\ikarus\mail.t3p
e:\antivirus\ikarus\office.t3p
e:\antivirus\ikarus\pack.t3p
e:\antivirus\ikarus\T3Scan.exe
e:\antivirus\ikarus\script.t3p
e:\antivirus\ikarus\T3.dll
e:\antivirus\ikarus\Readme.txt
e:\antivirus\ikarus\t3sigs.vdb
e:\antivirus\ikarus\1.log
e:\antivirus\ikarus\IEXPLORE.EXE - Signature 'Trojan.Win32.Patched.c' found

        14 Files scanned
          (0 Archives with 0 files)
        1 Signature found
        1 Suspect code-part found
        Used time: 0:02.173

还报我的icarus……

ykz1991

狗咬吕洞宾