这个病毒有点怪，监控不报，扫描报

cy6266812

这个病毒有点怪，解压时，监控不报，


但手动扫描会报


大家看看是不是个例！


 Archive type: RAR SFX (self extracting)
  --> Setup.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [INFO]      The file was deleted!

[ 本帖最后由 cy6266812 于 2008-1-10 12:15 编辑 ]

hshhua01

Starting the file scan:

Begin scan in 'D:\BOOK\xc.rar'
D:\BOOK\xc.rar
  [0] Archive type: RAR
    --> §Ú¤k¨à¬Û¤ù.com
      [1] Archive type: RAR SFX (self extracting)
      --> Setup.exe
          [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [INFO]      The file was deleted!

cy6266812

原帖由 hshhua01 于 2008-1-10 11:50 发表
Starting the file scan:

Begin scan in 'D:\BOOK\xc.rar'
D:\BOOK\xc.rar
  [0] Archive type: RAR
    --> §Ú¤k¨à¬Û¤ù.com
      [1] Archive type: RAR SFX (self extracting)
   ...

你解压了吗？


 [Guard] Malware found

[ 本帖最后由 cy6266812 于 2008-1-10 11:55 编辑 ]

无尽藏海

的确监控不报~
谁有沙盘运行下试试

[ 本帖最后由 无尽藏海 于 2008-1-10 11:59 编辑 ]

闪电战

看报的内容就知道了，其实是个RAR自解压包，被改成.com扩展名
监控当然不报

无尽藏海

学习了

mofunzone

开压缩包监控才会报，antivir的智能扩展识别会识别出这个是rar而不是exe，因为是一个自解压文件

Graybird

Starting the file scan:

Begin scan in 'E:\xc.rar'
E:\xc.rar
  [0] Archive type: RAR
  --> §Ú¤k¨à¬Û¤ù.com
      [DETECTION] Contains detection pattern of the dropper DR/PSW.Magania.cuo
      [1] Archive type: RAR SFX (self extracting)
      --> Setup.exe
          [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [INFO]      The file was deleted!

豫孤鸟

学习了！

sjducker

Access to the data has been denied!
Warning: A virus or unwanted program has been found in the HTTP Data.

Requested URL:  bbs.kafan.cn/attachment.php?aid=181824
Information:  Contains detection pattern of the dropper DR/PSW.Magania.cuo  


--------------------------------------------------------------------------------
Generated by AntiVir WebGuard 7.01.00.13, AVE 7.6.0.46, VDF 7.0.1.218