误报么？

clovedsm

扫描结果 :	19%的杀软(7/36)报告发现病毒
时间 :	2007/11/18 23:24:14 (CST)

                      

软件名称	引擎版本	病毒库版本	病毒库时间	扫描结果	时间
a-squared	3.0.0.126	2007.11.17	2007-11-17	-	3.435
AntiVir	7.6.0.34	7.0.0.226	2007-11-16	DR/Zlob.Gen	7.122
Arcavir	1.0.4	200711171053	2007-11-17	-	3.239
AVAST	1.0.8	071118-1	2007-11-18	-	6.608
AVG	7.5.49.442	269.16.0/1136	2007-11-17	Generic4.PPZ	6.601
BitDefender	7.60825.956050	7.15865	2007-11-18	-	12.833
CA (VET)	9.0.0.143	31.2.5304	2007-11-17	-	4.970
ClamAV	0.91.2	4832	2007-11-18	-	3.069
Comodo	2.11	2.0.0.347	2007-11-18	-	3.080
CP Secure	1.1.0.655	2007.11.15	2007-11-15	-	7.721
Dr.WEB	4.44.0.9170	2007.11.18	2007-11-18	-	7.715
ewido	4.0.0.2	2007.11.17	2007-11-17	-	7.675
F-PROT	4.4.1.52	20071116	2007-11-16	-	1.319
F-SECURE	5.51.6100	2007.11.14.07	2007-11-14	-	2.998
IKARUS	T3.1.01.15	2007.11.18.69837	2007-11-18	-	2.522
MKS_VIR	2.01	2007.11.17	2007-11-17	-	8.541
NOD32	2.70.10	2657	2007-11-14	-	0.003
NORMAN	5.91.08	5.90	2007-11-15	-	5.145
nProtect	2007-11-17.00	1051245	2007-11-17	-	20.538
Prevx	V2	20071118	2007-11-18	TROJAN.DOWNLOADER.GEN	13.086
QuickHeal	9.00	2007.11.16	2007-11-16	Suspicious - DNAScan	2.421
SOPHOS	2.49.1	4.21	2007-11-18	Mal/ZlobInst-A	6.734
The Hacker	6.2.9	v00133	2007-11-17	-	0.892
VBA32	3.12.2.5	20071117.1107	2007-11-17	Trojan-Dropper.Win32.Agent.cac	1.237
ViRobot	20071116	2007.11.16	2007-11-16	-	2.769
VirusBuster	4.3.19:9	9.115.1/11.0	2007-11-18	-	0.002
卡巴斯基	5.5.10	2007.11.18	2007-11-18	-	11.448
安博士V3	2007.11.17.00	2007.11.17	2007-11-17	-	1.584
江民杀毒	10.00.650	2007.11.17	2007-11-17	-	2.879
熊猫卫士	9.04.03.0001	2007.11.17	2007-11-17	-	4.554
瑞星	19.0	20.18.61.00	2007-11-18	-	1.809
赛门铁克	1.3.0.24	20071117.004	2007-11-17	-	4.816
趋势	8.500-1001	4.830.44	2007-11-18	-	0.183
迈克菲	5.2.00	5164	2007-11-15	-	2.126
金山毒霸	2007.6.20.249	2007.11.18	2007-11-18	-	34.438
飞塔	2.81-3.11	8.382	2007-11-18	Suspicious	3.521

let11

微点报

程序:
D:\UNINST.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\VISTA.LEGEND-5DT2V28F\LOCAL SETTINGS\TEMP\~NSU.TMP\AU_.EXE
是否删除木马程序及其衍生物?

let11

。。

clovedsm

额……我装了个winavi8.0汉化版，本来金山没报，换了个红伞瞬间把它揪出来了……

浪滔天

卡巴不报
会连接到这个网址：http://fox.soft2cn.com
狐狸少爷汉化作品，难道这个网页带毒？

[ 本帖最后由 浪滔天 于 2007-11-18 23:58 编辑 ]

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 939
Paranoia Database - 48881
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\uninst.exe

C:\Documents and Settings\Uhthn\Desktop\uninst.exe - Suspected TROJAN-DOWNLOADER (HTTP://{REMOVED}/...)

1 Files scanned
0 Infected files found
1 Suspected files found
0 Files disinfected
0 Files deleted

浪滔天

原帖由 let11 于 2007-11-18 23:38 发表
微点报

程序:
D:\UNINST.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\VISTA.LEGEND-5DT2V28F\LOCAL SETTINGS\TEMP\~NSU.TMP\AU_.EXE
是否删除木马程序及其衍生物?

这个生成物和楼主发的样本是完全一样的。

浪滔天

Au_.exe_

No malicious code was found in this file.

Please quote all when answering.

--
Best regards, Alexander Romanenko
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

是个汉化卸载程序，连接到作者的网页，应该是误报吧。

[ 本帖最后由 浪滔天 于 2007-11-19 00:48 编辑 ]

nosferatu

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\uninst.rar'
C:\Documents and Settings\Administrator\桌面\uninst.rar
  [0] Archive type: RAR
  --> uninst.exe
      [DETECTION] Contains detection pattern of the dropper DR/Zlob.Gen
      [INFO]      The file was deleted!

wangjay1980

又开始杀卸载程序了