样本两个,AVK报,大家帮我看看是不是误报

显示全部楼层 · 发表于 2008-2-10 00:30:18

用AVK杀出来的,第二个比较大,分包了

[ 本帖最后由 mutt2008 于 2008-2-10 00:44 编辑 ]

显示全部楼层 · 发表于 2008-2-10 00:32:26

样本？
比较大的，先压缩分割后上传

显示全部楼层 · 发表于 2008-2-10 00:39:01

感染病毒: not-a-virus:RiskTool.Win32.HideExec.h
文件: HIDECMD[1].rar
目录: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\B64X7CKM
进程: Maxthon.exe

显示全部楼层 · 发表于 2008-2-10 00:40:27

我运行了也没什么现象哦~虚拟机里~

显示全部楼层 · 发表于 2008-2-10 00:41:13

卡巴系的就不用扫了
发现危险软件
RiskTool.Win32.HideExec.h (riskware)
C:\Documents and Settings\GUNDAM\桌面\HIDECMD.rar\HIDECMD.EXE

--------------------------------------------------------------------------------

统计信息
已扫描:
文件: 2
未扫描: 0
结果:
病毒: 0
间谍软件: 0
可疑对象: 0
危险软件: 1

显示全部楼层 · 发表于 2008-2-10 00:46:18

到底是不是病毒?

显示全部楼层 · 发表于 2008-2-10 00:53:04

传到多引擎看一下吧

显示全部楼层 · 发表于 2008-2-10 02:18:12

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\My Documents.rar'
C:\Documents and Settings\Administrator\My Documents\
  My Documents.rar
   [DETECTION] Is the Trojan horse TR/Dropper.Sma.LE.3
   [WARNING] The file was ignored!
[0] Archive type: RAR
--> inst.exe
      [DETECTION] Contains detection pattern of the SPR/VB.df.2 program
      [WARNING] Infected files in archives cannot be repaired!
--> HIDECMD.EXE
      [WARNING] The file was ignored!

显示全部楼层 · 发表于 2008-2-10 03:27:27

IK
I:\virus\test\HIDECMD.EXE - Signature 'Trojan.Win32.Agent.aks' found
I:\virus\test\inst.exe - Signature 'Trojan.HackTool.Vb.DF' found

2 Files scanned
(0 Archives with 0 files)
2 Signatures found
0 Suspect code-parts found
Used time: 0:04.328

显示全部楼层 · 发表于 2008-2-10 16:52:49

2008-2-10 16:59:00 Kernel File 'E:\virus\HIDECMD\HIDECMD.EXE' was sent to ESET for analysis.
2008-2-10 16:58:50 Kernel File 'E:\virus\inst\inst.exe' was sent to ESET for analysis.

[病毒样本] 样本两个,AVK报,大家帮我看看是不是误报

本帖子中包含更多资源