瑞星的一个误杀

qxc0574

书上的驱动例子没想到被当成了木马！
http://virscan.org/report/6947b9efe7e58bd60a6a957ae76fb356.html

a-squared	3.0.0.126	2007.12.18	2007-12-18	-	4.420
AntiVir	7.6.0.45	7.0.1.118	2007-12-18	-	3.440
Arcavir	1.0.4	200712181502	2007-12-18	-	1.802
AVAST	1.0.8	071218-0	2007-12-18	-	3.047
AVG	7.5.49.442	269.17.1/1183	2007-12-13	-	1.814
BitDefender	7.60825.960480	7.16373	2007-12-19	-	3.395
CA (VET)	9.0.0.143	31.3.5386	2007-12-18	-	10.767
ClamAV	0.91.2	5174	2007-12-19	-	0.007
Comodo	2.11	2.0.0.377	2007-12-18	-	0.821
CP Secure	1.1.0.655	2007.12.18	2007-12-18	-	4.682
Dr.WEB	4.44.0.9170	2007.12.18	2007-12-18	-	3.417
ewido	4.0.0.2	2007.12.18	2007-12-18	-	1.977
F-PROT	4.4.1.52	20071218	2007-12-18	-	1.479
F-SECURE	5.51.6100	2007.12.18.09	2007-12-18	-	3.220
IKARUS	T3.1.01.15	2007.12.19.70012	2007-12-19	-	1.194
MKS_VIR	2.01	2007.12.18	2007-12-18	-	3.528
NOD32	2.70.10	2731	2007-12-18	-	0.004
NORMAN	5.91.08	5.90	2007-12-17	-	5.023
nProtect	2007-12-19.00	1094933	2007-12-19	-	4.651
Prevx	V2	20071219	2007-12-19	-	5.160
QuickHeal	9.00	2007.12.18	2007-12-18	-	2.420
SOPHOS	2.49.1	4.21	2007-12-19	-	7.549
The Hacker	6.2.9	v00164	2007-12-18	-	0.906
VBA32	3.12.2.5	20071218.1224	2007-12-18	-	1.850
ViRobot	20071218	2007.12.18	2007-12-18	-	0.380
VirusBuster	4.3.19:9	9.117.6/11.0	2007-12-18	-	1.849
卡巴斯基	5.5.10	2007.12.19	2007-12-19	-	6.455
安博士V3	2007.12.18.01	2007.12.18	2007-12-18	-	0.936
江民杀毒	10.00.650	2007.12.18	2007-12-18	-	1.128
熊猫卫士	9.04.03.0001	2007.12.19	2007-12-19	-	2.560
瑞星	19.0	20.23.12.00	2007-12-18	RootKit.CallGate.h	0.849
赛门铁克	1.3.0.24	20071218.007	2007-12-18	-	0.421
趋势	8.500-1001	4.894.15	2007-12-18	-	0.038
迈克菲	5.2.00	5188	2007-12-18	-	1.834
金山毒霸	2007.6.20.249	2007.12.19	2007-12-19	-	0.726
飞塔	2.81-3.11	8.449	2007-12-03	-	0.257

qxc0574

尊敬的客户，您好！
    您的邮件已经收到，感谢您对瑞星的支持。

    我们已经详细分析过您的问题和文件，以下是您上传的文件的分析结果：
    1.文件名：simplest.bat
    不是病毒

    2.文件名：simplest.sys
    病毒名：RootKit.CallGate.h

    您所上报的病毒文件将在瑞星2008的20.23.10版本(瑞星2007的19.54.10版本)中处理解决。

啊弥陀佛

Disassembly of File: simplest.sys
Code Offset = 00000200, Code Size = 00000020
Data Offset = 00000000, Data Size = 00000000
Number of Objects = 0002 (dec), Imagebase = 00010000h
   Object01: .text    RVA: 00000200 Offset: 00000200 Size: 00000020 Flags: 68000020
   Object02: .reloc   RVA: 00000220 Offset: 00000220 Size: 00000020 Flags: 42000040

+++++++++++++++++++ MENU INFORMATION ++++++++++++++++++
        There Are No Menu Resources in This Application
+++++++++++++++++ DIALOG INFORMATION ++++++++++++++++++
        There Are No Dialog Resources in This Application
+++++++++++++++++++ IMPORTED FUNCTIONS ++++++++++++++++++
Number of Imported Modules =    0 (decimal)

+++++++++++++++++++ IMPORT MODULE DETAILS +++++++++++++++
+++++++++++++++++++ EXPORTED FUNCTIONS ++++++++++++++++++
Number of Exported Functions = 0000 (decimal)


+++++++++++++++++++ ASSEMBLY CODE LISTING ++++++++++++++++++
//********************** Start of Code in Object .text **************
Program Entry Point = 00010200 (simplest.sys File Offset:00000420)

//******************** Program Entry Point ********
:00010200 55                      push ebp
:00010201 8BEC                    mov ebp, esp
:00010203 B8820100C0              mov eax, C0000182
:00010208 C9                      leave
:00010209 C20800                  ret 0008

:0001020C 00000000000000000000    BYTE 10 DUP(0)
:00010216 00000000000000000000    BYTE 10 DUP(0)

dyinggod

看，看不懂

googlehack

真是绝了！

就一家查杀……

baichi

没看出来是误杀。关注中。

moonsilver

此问题将在瑞星新版本中解决

cy6266812

谁都有误杀，说起误杀瑞星算少的了，俺现在用红伞，俺就不说什么了

一定要注册

貌似不是误杀。

我是小菜鸟

占位留名，继续关注中，看看到底是什么东东