红伞一个

nosferatu

zhr5898

费尔过·····

woai_jolin

eset pass

鱼是一只我

江民 过~~~~

458506

发现病毒: not-a-virus:RiskTool.Win32.WFPDisabler.a

下载网页内容时, 发现病毒.

地址: bbs.kafan.cn

jick117

BD报：

chenyilong58

AntiVir PersonalEdition Premium
Report file date: 星期四 2008年1月24日  09:16

Scanning for 1065753 virus strains and unwanted programs.

Licensed to:      chen yilong
Serial number:    1101089080-PEPWE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Username:         Administrator
Computer name:    GHOST-A70CF650B

Version information:
BUILD.DAT    : 308           17199 Bytes  2007-09-19 13:44:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  2007-08-23 06:16:30
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  2007-08-16 05:23:52
LUKE.DLL     : 7.0.5.3      147496 Bytes  2007-08-14 08:32:48
LUKERES.DLL  : 7.0.6.1       10280 Bytes  2007-08-21 05:35:22
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  2007-07-18 06:36:36
ANTIVIR1.VDF : 7.0.1.95    3367424 Bytes  2007-12-14 04:29:02
ANTIVIR2.VDF : 7.0.2.0      948736 Bytes  2008-01-15 09:16:30
ANTIVIR3.VDF : 7.0.2.36     347648 Bytes  2008-01-23 00:34:50
AVEWIN32.DLL : 7.6.0.48    3080704 Bytes  2008-01-15 06:29:26
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  2007-02-26 03:36:28
AVPREF.DLL   : 7.0.2.2       25640 Bytes  2007-07-18 00:39:18
AVREP.DLL    : 7.0.0.1      155688 Bytes  2007-12-14 04:29:10
AVPACK32.DLL : 7.6.0.3      360488 Bytes  2008-01-15 06:29:28
AVREG.DLL    : 7.0.1.6       30760 Bytes  2007-07-18 00:17:08
AVARKT.DLL   : 1.0.0.20     278568 Bytes  2007-08-28 05:26:34
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  2007-07-18 00:10:20
NETNT.DLL    : 7.0.0.0        7720 Bytes  2007-03-08 04:09:44
RCIMAGE.DLL  : 7.0.1.30    2576424 Bytes  2007-08-07 05:51:08
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  2007-08-21 06:03:20
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  2007-07-23 02:37:22

Configuration settings for the scan:
Jobname..........................: ShlExt
Configuration file...............: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\63588582.avp
Logging..........................: low
Primary action...................: delete
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: off
Scan memory......................: on
Process scan.....................: off
Scan registry....................: off
Search for rootkits..............: off
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: high
Deviating risk categories........: +APPL,+JOKE,+SPR,

Start of the scan: 星期四 2008年1月24日  09:16

Starting the file scan:

Begin scan in 'd:\我的文档\桌面\wfpdisable.rar'
d:\我的文档\桌面\wfpdisable.rar
  [0] Archive type: RAR
  --> wfpdisable.exe
      [DETECTION] Contains detection pattern of the SPR/WFPDis.A program
      [INFO]      A backup was created as '4807e755.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!


End of the scan: 星期四 2008年1月24日  09:16
Used time: 00:03 min

The scan has been done completely.

      0 Scanning directories
      2 Files were scanned
      1 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired

leonfg

不是病毒
not-a-virus:RiskTool.Win32.WFPDisabler.a

woai_jolin

wfpdisable.exe : Not detected by Sandbox (Signature: NO_VIRUS)


[ DetectionInfo ]
    * Sandbox name: NO_MALWARE
    * Signature name: NO_VIRUS
    * Compressed: NO
    * TLS hooks: NO
    * Executable type: Application
    * Executable file structure: OK

[ General information ]
    * File length:        28672 bytes.
    * MD5 hash: 3edfbe0ed74a35a6fffe15c37e5a3c24.

[ Process/window information ]
    * Checks if privilege "SeDebugPrivilege" is available.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.

This file is not flagged as malicious by the Norman Sandbox Information Center. However, we can not guarantee that the file is harmless. If you still suspect the file to be malicious and if you urgently need to know for sure, please submit it to your local Norman support department for manual analysis.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

冷冷

-------------------------------------------------------------------------------cav
I:\virus\test/wfpdisable.exe: PUA.Tool.WFPDisable FOUND
----------- SCAN SUMMARY -----------
Known viruses: 195458
Engine version: 0.92
Scanned directories: 1
Scanned files: 1
Infected files: 1
Data scanned: 0.03 MB
Time: 6.843 sec (0 m 6 s)