刚才在伞区看到的，不知有没有重发了。NOD32报未知启发

显示全部楼层 · 发表于 2008-2-1 14:41:57

最近大家对于NOD32的讨论好多。这个样本是它报未知启发的。也许是我火星。嗯收藏一下。不知道这种可以让NOD32报启发的东东在样本区多不多？
PS:蜘蛛报“可能的木马下载者”
——————————
更正一下，里面两个文件EXE的被报未知启发。JS的NOD32和DR WEB都无视。

[ 本帖最后由 hyxuzhimin 于 2008-2-1 15:07 编辑 ]

显示全部楼层 · 发表于 2008-2-1 14:46:34

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.Win32.Undef.bun
病毒： Trojan.DL.Script.JS.Agent.mcz

MAC 地址：00:00:00:00:00:00

用户来源：局域网

软件版本：20.29.40

显示全部楼层 · 发表于 2008-2-1 14:47:57

nod32的那虚拟机技术彻底的被人鄙视了。。
但是我个人的想法还是认为nod32还是有一点那么虚拟的技术
但是和bd比起来相差太多
我一直也是这么认为的

显示全部楼层 · 发表于 2008-2-1 14:48:16

费尔报木马一个

显示全部楼层 · 发表于 2008-2-1 14:48:35

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Win32.Undef.bun
病毒： Trojan.DL.Script.JS.Agent.mcz

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.29.40

显示全部楼层 · 发表于 2008-2-1 14:49:58

avast被过

显示全部楼层 · 发表于 2008-2-1 14:55:26

费尔，扫描3个，杀了1个

显示全部楼层 · 发表于 2008-2-1 14:55:42

ClamAV

I:\virus\test/a/a.exe: Broken.Executable FOUND

----------- SCAN SUMMARY -----------
Known viruses: 201320
Engine version: 0.92
Scanned directories: 2
Scanned files: 1
Infected files: 1
Data scanned: 0.00 MB
Time: 6.328 sec (0 m 6 s)

IKARUS
I:\virus\test\a\a.exe - Signature 'Win32.SuspectCrc' found

1 File scanned
(0 Archives with 0 files)
1 Signature found
0 Suspect code-parts found
Used time: 0:00.000

显示全部楼层 · 发表于 2008-2-1 14:58:49

Begin scan in 'C:\Documents and Settings\Administrator\桌面\NOD32报未知启发.rar'
C:\Documents and Settings\Administrator\桌面\NOD32报未知启发.rar
  [0] Archive type: RAR
  --> a\a.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> a[3].js
   [DETECTION] Contains detection pattern of the HTML script virus HTML/Silly.Gen
   [INFO]    The file was deleted!

End of the scan: 2008年2月1日  14:58
Used time: 00:06 min

The scan has been done completely.

   0 Scanning directories
   3 Files were scanned
   0 viruses and/or unwanted programs were found
   2 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   3 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-2-1 15:02:01

红伞
[0] Archive type: RAR
  --> a\a.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> a[3].js
   [DETECTION] Contains detection pattern of the HTML script virus HTML/Silly.Gen
   [INFO]    The file was deleted!
顺便说一句，其实没什么好争论的，杀软没有哪一款是最好的，各有各的特色和长处，关键是要适合自己，适合的才是最好的

[病毒样本] 刚才在伞区看到的，不知有没有重发了。NOD32报未知启发

本帖子中包含更多资源

3/2