几家报？

千里同风

附件为同一物，个人认为不是病毒，一个是加壳的，以前卡巴和瑞星均直接删除（甚至会指明病毒名）。
PS：运行后会在临时文件夹产生空文本。

asraena

小红伞
Begin scan in 'C:\Documents and Settings\Administrator\桌面\V_013.rar'
C:\Documents and Settings\Administrator\桌面\V_013.rar
  [0] Archive type: RAR
  --> ÓпÇ.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was deleted!

袋鼠吱吱

mcafee启发一个。

yangpizhi

只报了无壳。。。
-----------------------------SCAN REPORT-----------------------------
F-PROT Antivirus for Windows

Antivirus Scanning Engine version number: 4.4.2
Virus signature file from: 2007-12-31, 5:54

Scan name: 12.31
Path to scan: C:\样本 yangpizhi\12.31\|

Thorough scan
Also scan: Inside subfolders, Compressed files, Streams

Scan started: 2007-12-31, 10:34:21
---------------------------------------------------------------------

[Clean]        Boot sector on drive F:
[Clean]        Boot sector on drive E:
[Clean]        Boot sector on drive D:
[Clean]        Boot sector on drive C:
[Clean]        Master Boot Record on disk 0
[Clean]        C:\样本 yangpizhi\12.31\V_013.rar->有壳.exe
[Found security risk]         <W32/Dropper.CIQ (exact, not disinfectable)>        C:\样本 yangpizhi\12.31\V_013.rar->无壳.exe
[Contains infected objects]        C:\样本 yangpizhi\12.31\V_013.rar
[Quarantined]        C:\样本 yangpizhi\12.31\V_013.rar->无壳.exe

---------------------------------------------------------------------
Scan ended:        2007-12-31, 10:34:26
Duration:        0:00:04

Scan result:

Scanned files:                 6
Infected objects:         1
Disinfected objects:         0
Quarantined files:         1
---------------------------------------------------------------------

wangjay1980

deleted: Trojan program Trojan-Dropper.Win32.Agent.ave        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\V_013.rar/无壳.exe

醉一生爱妍

江民杀了。。。。。。。。。

moonsilver

Dropper.Delf.bch

rs

千里同风

希望能有只报“加壳”而不报“无壳”有毒的杀软。

千里同风

原帖由 garyyan456 于 2007-12-31 11:11 发表
江民杀了。。。。。。。。。

两个都杀了还是未加壳的个？

woai_jolin

&#26080 : Not detected by Sandbox (Signature: NO_VIRUS)


[ DetectionInfo ]
    * Sandbox name: NO_MALWARE
    * Signature name: NO_VIRUS
    * Compressed: NO
    * TLS hooks: YES
    * Executable type: Application
    * Executable file structure: OK

[ General information ]
    * File length:         9216 bytes.
    * MD5 hash: a95aa70baacc22fb2d04e34c885f4488.

[ Changes to filesystem ]
    * Creates file C:\WINDOWS\TEMP\9140.txt.

[ Process/window information ]
    * Attemps to NULL C:\WINDOWS\TEMP\9140.txt NULL.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.

This file is not flagged as malicious by the Norman Sandbox Information Center. However, we can not guarantee that the file is harmless. If you still suspect the file to be malicious and if you urgently need to know for sure, please submit it to your local Norman support department for manual analysis.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************