刚看到的，没几个报的[MD5: 2FEC85 95C870]

显示全部楼层 · 发表于 2007-12-7 18:41:17

sophos
C:\ABC\runtime.sys
>>> Virus 'Troj/Pushu-Gen' found in file C:\ABC\runtime.sys
C:\ABC\startdrv.exe
>>> Virus 'Mal/Dropper-O' found in file C:\ABC\startdrv.exe

显示全部楼层 · 发表于 2007-12-7 18:42:44

Starting the file scan:

Begin scan in 'E:\样本.rar'
E:\样本.rar
  [0] Archive type: RAR
  --> runtime.sys
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.DPE.1
  --> startdrv.exe
   [DETECTION] Contains detection pattern of the worm WORM/Ntech.AA
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-12-7 18:44:10

检测到：木马程序 Trojan-Downloader.Win32.Agent.dpe 文件　: F:\du\样本.rar/runtime.sys

显示全部楼层 · 发表于 2007-12-7 18:50:07

MicroVita AntiSpyware 100 C
_____________________________________________

         风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]
               http://221.10.254.214/
----------------------------------------------
开始扫描……

正在检查启动……
[C:\Documents and Settings\Administrator\桌面\Virus\NNNFF\runtime.sys]
                  …………发现Spy！报告:[2]
文件信息:  大小:5504  MD5:2fec851b6ffdcefbd250a7fa88c629a6

文件数:2 病毒数:1  比重:0.5
OK  扫描完毕！

  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎
[2] 文件特征码引擎
[1] 文件启发式引擎

[ 本帖最后由 FBAV 于 2007-12-7 18:56 编辑 ]

显示全部楼层 · 发表于 2007-12-7 18:56:35

貌似很多报runtime.sys

显示全部楼层 · 发表于 2007-12-7 19:04:49

小A 报 Win32:Agent-MEB [Trj]

显示全部楼层 · 发表于 2007-12-7 19:58:58

C:\样本.rar\runtime.sys - infected with BackDoor.Bulknet

Archive contains an infected item

DRWEB 4.44

显示全部楼层 · 发表于 2007-12-7 21:56:48

startdrv.exe_ - Trojan.Win32.Pakes.bss
This file is already detected. Please update your antivirus bases.

显示全部楼层 · 发表于 2007-12-7 22:04:37

D:\病毒测试\未解压样本\样本.rar » RAR » runtime.sys - Win32/Rootkit.Agent.NDF trojan

显示全部楼层 · 发表于 2007-12-7 22:06:36

就报驱动

[扫描] [Level 2] 在 E:\Documents and Settings\Administrator\桌面\win\样本.rar>>runtime.sys 检测到 Downloader.Agent.dpe

[病毒样本] 刚看到的，没几个报的[MD5: 2FEC85 95C870]

本帖子中包含更多资源