360系统还原中的文件

显示全部楼层 · 发表于 2008-3-15 11:43:30

不知道是不是误报!大家扫扫.

显示全部楼层 · 发表于 2008-3-15 11:45:39

Contains suspicious code HEUR/Malware

显示全部楼层 · 发表于 2008-3-15 11:46:51

听说是测试版的,还没有上正式版.

显示全部楼层 · 发表于 2008-3-15 11:50:36

试图加载服务

生成物上传

显示全部楼层 · 发表于 2008-3-15 11:58:45

这东西是应该加载服务的,有如影子.

显示全部楼层 · 发表于 2008-3-15 12:07:04

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\C.rar'
C:\Documents and Settings\Administrator\My Documents\
  C.rar
[0] Archive type: RAR
--> GFLog\GF-MICROSOFT.log
--> WINNT\system32\001c11b9.sys
   --> WINNT\system32\drivers\windf.EXE
      [1] Archive type: Runtime Packed
      --> Object
      [2] Archive type: RSRC
      --> Object
--> WINNT\system32\drivers\windf.hlp
      [DETECTION] Contains suspicious code HEUR/Crypted
   [WARNING] The file was ignored!
  C.rar:Zone.Identifier

End of the scan: 2008年3月14日  21:06
Used time: 00:04 min

The scan has been done completely.

   0 Scanning directories
   6 Files were scanned
   0 viruses and/or unwanted programs were found
   2 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   6 Files not concerned
   1 Archives were scanned
   1 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-3-15 12:11:14

上报antivir了

显示全部楼层 · 发表于 2008-3-15 14:03:37

木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\WINNT\SYSTEM32\DRIVERS\WINDF.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\WINNT\SYSTEM32\DRIVERS\WINDF.HLP
是木马程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2008-3-15 21:34:59

ArcaBit , FP6 miss.

显示全部楼层 · 发表于 2008-3-15 21:35:07

rising20.35.52生成物及楼主样本全不报！

[病毒样本] 360系统还原中的文件

本帖子中包含更多资源

Avira AntiVir

本帖子中包含更多资源

回复 4楼 kiki 的帖子

回复 4楼 kiki 的帖子

14/0