过卡巴和NOD32的病毒

wangjay1980

Hello,

FlashUpdate.exe_ - Backdoor.Win32.BlackHole.mi

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vyacheslav Zakorzhevsky
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: FlashUpdate.rar

woai_jolin

Starting the file scan:

Begin scan in 'G:\v\FlashUpdate.EXE'
G:\v\FlashUpdate.EXE
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [INFO]      The file was deleted!


End of the scan: 2008年2月1日  23:55
Used time: 00:06 min

The scan has been done completely.

      0 Scanning directories
      1 Files were scanned
      1 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      0 Files not concerned
      0 Archives were scanned
      0 Warnings
      0 Notes

ESET pass

woai_jolin

Scan Log
Version of virus signature database: 2844 (20080201)
Date: 2008-2-1  Time: 23:55:50
Scanned disks, folders and files: G:\v\C
G:\v\C\Program Files\WindowsUpdate\1.bat - BAT/KillAV.EC trojan - cleaned by deleting - quarantined [1]
G:\v\C\Program Files\WindowsUpdate\1.vbs - is OK
G:\v\C\Program Files\WindowsUpdate\18.exe - probably a variant of Win32/BlackHole trojan - cleaned by deleting - quarantined [1]
G:\v\C\Program Files\WindowsUpdate\8.dll - a variant of Win32/BlackHole trojan - cleaned by deleting - quarantined [1]
G:\v\C\Program Files\WindowsUpdate\MSN.reg - is OK
G:\v\C\Program Files\WindowsUpdate\__tmp_rar_sfx_access_check_36543812 - is OK
G:\v\C\WINDOWS\lsas.dll - a variant of Win32/BlackHole trojan - cleaned by deleting - quarantined [1]
G:\v\C\WINDOWS\lsas.exe - probably a variant of Win32/BlackHole trojan - cleaned by deleting - quarantined [1]
Number of scanned objects: 8
Number of threats found: 5
Time of completion: 23:56:03  Total scanning time: 13 sec (00:00:13)

Notes:
[1] Object has been deleted as it only contained the virus body.

woai_jolin

2008-2-1 23:57:12        Kernel        File  'G:\v\C\Program Files\WindowsUpdate\MSN.reg' was sent to ESET for analysis.       
2008-2-1 23:56:58        Kernel        File  'G:\v\C\Program Files\WindowsUpdate\1.vbs' was sent to ESET for analysis.

sam.to

原帖由 冷_冷 于 2008-2-1 21:56 发表
SBie 跑了跑
194322194323

Hello,

1.bat_ - Trojan.BAT.Runner.l,
1.vbs_ - Trojan.VBS.Runner.as,
18.exe_, 8.dll, lsas.dll, lsas.exe_ - Backdoor.Win32.BlackHole.mi,
MSN.reg_ - Trojan.WinREG.MessengerSecurity.a

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

__tmp_rar_sfx_access_check_36543812

This file has 0 bytes length.

Please quote all when answering.

--
Best regards, Yury Nesmachny
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

sam.to

Reg也报毒,有趣有趣

墨色丹青

金山PASS

gho

扫描报告
2008年2月2日 15:38:01 - 15:38:02
计算机名称: CN-89FF4B9EA4D6
扫描类型: 扫描指定目标
目标: I:\hanxiaojun\FlashUpdate.rar


--------------------------------------------------------------------------------

结果
没发现恶意软件

冷冷

只要对电脑有害的，杀毒软件都会认为是敌人----病毒！

IK  更新后找到可以代码！
I:\virus\FlashUpdate.rar:\FlashUpdate.EXE - Suspect code-parts found (Level: 90)
I:\virus\FlashUpdate.rar

        2 Files scanned
          (1 Archiv with 1 file)
        0 Signatures found
        1 Suspect code-part found
        Used time: 0:01.766