放个样本

显示全部楼层 · 发表于 2008-3-16 10:53:39

symantec pass

显示全部楼层 · 发表于 2008-3-16 10:56:00

"10:55" "文件监控" "文件" "PACKER-GEN.006" "index_02.exe (C:\Documents and Settings\Administrator\桌面\index_02.rar.td)" "隔离成功" ""
"10:55" "文件监控" "文件" "---" "C:\Documents and Settings\Administrator\桌面\index_02.rar.td (C:\Documents and Settings\Administrator\桌面\index_02.rar.td)" "隔离成功" ""

显示全部楼层 · 发表于 2008-3-16 14:00:58

Begin scan in 'C:\Documents and Settings\haha\桌面\index_02.rar'
C:\Documents and Settings\haha\桌面\index_02.rar
  [0] Archive type: RAR
  --> index_02.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.45056
   [INFO]    A backup was created as '4840b821.qua'  ( QUARANTINE )

显示全部楼层 · 发表于 2008-3-16 15:47:47

金山KL

显示全部楼层 · 发表于 2008-3-16 20:50:01

[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\index_02.rar->index_02.exe->(UPack)

---------------------------------------------------------------------
Scan ended: 2008-3-16, 20:49:59
Duration: 0:00:01

Scan result:

Scanned files:    6
Infected objects:    1
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

显示全部楼层 · 发表于 2008-3-16 21:32:18

发现未知间谍软件，是否删除？
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.687\INDEX_02.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\~XVID296.TMP
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2008-3-16 21:38:33

呵,没过瑞星竟过了卡巴,看来现在的毒大多数都是冲着卡巴来的啊!

[病毒样本] 放个样本