发些样本部分没有上报驱逐舰,需要的拿去上报把

起点

如题

密码都是  virus

[ 本帖最后由 navigateqd 于 2006-11-19 00:29 编辑 ]

mofunzone

以后就不要加密了，测试还麻烦，还要解压出来，反而增加危险性
Starting the file scan:

C:\Documents and Settings\Administrator\My Documents\
  suspicious1.rar
  suspicious1.rar:Zone.Identifier
    [0] Archive type: RAR
    --> suspicious1\iexplore.rar
        [1] Archive type: RAR
        --> iexplore.exe
            [DETECTION] Contains suspicious code HEUR/Malware
            [WARNING]   Infected files in archives cannot be repaired!
    --> suspicious1\jkh.rar
        [1] Archive type: RAR
        --> 1\1.exe
            [DETECTION] Contains suspicious code HEUR/Crypted
            [WARNING]   Infected files in archives cannot be repaired!
    --> suspicious1\yui.rar
        [1] Archive type: RAR
        --> up.exe
        [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\My Documents\
  system.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\My Documents\
  sys32.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was deleted!
Starting the file scan:
C:\Documents and Settings\Administrator\My Documents\malware\
  malware.rar
    [0] Archive type: RAR
    --> shell.fne
    --> eAPI.fne
        [DETECTION] Is the Trojan horse TR/Drop.Agen.SN.5.C
        [WARNING]   Infected files in archives cannot be repaired!
    --> Hook.dll
    --> HtmlView.fne
        [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Agent.A Backdoor server programs
        [WARNING]   Infected files in archives cannot be repaired!
    --> internet.fne
    --> krnln.fnr
    --> RegEx.fne
        [WARNING]   The file was ignored!

[ 本帖最后由 mofunzone 于 2006-11-18 16:02 编辑 ]

起点

原帖由 mofunzone 于 2006-11-19 07:58 发表
以后就不要加密了，测试还麻烦，还要解压出来，反而增加危险性
Starting the file scan:

C:\Documents and Settings\Administrator\My Documents\
  suspicious1.rar
  suspicious1.rar:Zone.Identifier
...

s1ck要求的嘛，感觉大家都觉得不加密好些以后就不加密算了

PS  你那个扫描报告是哪个软件生成的 啊  nod32英文版 ?

[ 本帖最后由 navigateqd 于 2006-11-19 18:50 编辑 ]

a99645629

就是就是，加了又要解压，麻烦。