假冒正常文件，实际是病毒

显示全部楼层 · 发表于 2008-4-27 18:16:22

Starting the file scan:

Begin scan in 'E:\AV\list.rar'
E:\AV\list.rar
  [0] Archive type: RAR
  --> ad_2500.exe
   [DETECTION] Is the Trojan horse TR/Downloader.Gen
  --> s03.exe
   [DETECTION] Contains detection pattern of the dropper DR/Drop.Agent.qoa.2
  --> dodolook572.exe
   [DETECTION] Contains detection pattern of the dropper DR/Cinmus.ewx
   [NOTE]    The file was deleted!

[ 本帖最后由 Exia 于 2008-4-28 06:26 编辑 ]

显示全部楼层 · 发表于 2008-4-27 20:05:00

原帖由 sbbdms 于 2008-4-27 18:02 发表
奇怪，之前卡巴明明报Heur.Downloader（修改），怎么上报后。。。
Hello.
No malicious software was found in the attached file.
-----------------
Regards, Namestnikov Yury
Virus Analyst, Kaspersky L ...

因为他们比较懒，不用真正的卡巴扫描
而是用简易的卡巴引擎
这种时候只有上图他们才知道
我上报了

显示全部楼层 · 发表于 2008-4-27 20:08:44

D:\download\最新病毒样本.rar>>最新病毒样本.exe TrojanProxy.Delf.CA.rhbr 木马还未处理

显示全部楼层 · 发表于 2008-4-27 20:12:18

defender看来有点用处；

显示全部楼层 · 发表于 2008-4-27 20:14:57

McAfee:
Adware-BDSearch.dldr
報廣告軟體??

显示全部楼层 · 发表于 2008-4-27 20:15:04

McAfee Adware-BDSearch

显示全部楼层 · 发表于 2008-4-27 20:29:22

Start of the scan: 2008年4月27日  20:29

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\最新病毒样本.rar'
C:\Documents and Settings\Administrator\桌面\最新病毒样本.rar
  [0] Archive type: RAR
  --> ￗ￮￐ￂﾲﾡﾶﾾ￑￹ﾱﾾ.exe
   [DETECTION] Is the Trojan horse TR/Proxy.Delf.CA
   [NOTE]    The file was moved to 'bdd9d741.qua'!

End of the scan: 2008年4月27日  20:29
Used time: 00:10 min

The scan has been done completely.

   0 Scanning directories
   2 Files were scanned
   1 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   1 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   0 Warnings
   1 Notes

显示全部楼层 · 发表于 2008-4-27 20:32:39

ArcaVir
[Scanning : C:\Documents and Settings\All Users\Documents\Test]

C:\Documents and Settings\All Users\Documents\Test\最新病毒样本.rar<RAR>:最新病毒样本.exe<FSG>:最新病毒样本.exe<DLLRES>:AAA0.exe <- Variant:Adware.Ejik.bh : No action

Scanned objects : 4

Infected objects : 1

显示全部楼层 · 发表于 2008-4-27 21:06:22

rising20.41.62未杀！

显示全部楼层 · 发表于 2008-4-27 21:08:28

驱逐舰:报广告程序

[病毒样本] 假冒正常文件，实际是病毒

回复 10楼冷冷的帖子

本帖子中包含更多资源

4/0

[病毒样本] 假冒正常文件，实际是病毒

回复 10楼 冷冷 的帖子

本帖子中包含更多资源

4/0

回复 10楼冷冷的帖子