update x5 Zhelatin

显示全部楼层 · 发表于 2008-5-1 21:11:23

TO KL

[ 本帖最后由 zwl2828 于 2008-5-1 21:24 编辑 ]

显示全部楼层 · 发表于 2008-5-1 21:12:31

2008-5-1 21:12:10 Real-time file system protection file C:\Documents and Settings\Don Johnson\桌面\Unknown\1392ca9a0e35571194c30e2c09ac7fcd.exe probably a variant of Win32/Nuwar worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: D:\Program Files\7-Zip\7zG.exe.
2008-5-1 21:12:05 Real-time file system protection file C:\Documents and Settings\Don Johnson\桌面\Unknown\29facdeb8438416b64218fccc202e432.exe probably a variant of Win32/Nuwar worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: D:\Program Files\7-Zip\7zG.exe.
2008-5-1 21:11:59 Real-time file system protection file C:\Documents and Settings\Don Johnson\桌面\Unknown\3dc016012475642bab084c38278ff51e.exe probably unknown NewHeur_PE virus cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: D:\Program Files\7-Zip\7zG.exe.
2008-5-1 21:11:49 Real-time file system protection file C:\Documents and Settings\Don Johnson\桌面\Unknown\52b717d31437618a55059e6147adf2fd.exe probably a variant of Win32/Nuwar worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: D:\Program Files\7-Zip\7zG.exe.

显示全部楼层 · 发表于 2008-5-1 21:14:51

2008-5-1 21:14:38 HTTP filter file http://xianexs.mail.qq.com/cgi-b ... =&&txf_sid= probably a variant of Win32/Statik application connection terminated - quarantined JOHNSON\Don Johnson Threat was detected upon access to web by the application: C:\Program Files\Internet Explorer\iexplore.exe.

显示全部楼层 · 发表于 2008-5-1 21:22:42

启发了良久，发现一个

[Found security risk] <W32/Tibs.M.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\Unknown.rar->1392ca9a0e35571194c30e2c09ac7fcd.exe

---------------------------------------------------------------------
Scan ended: 2008-5-1, 21:22:05
Duration: 0:00:15

Scan result:

Scanned files:    6
Infected objects:    1
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

显示全部楼层 · 发表于 2008-5-1 21:25:15

可能是标准不同就是调用不同
很多的扫描和监控也不同的呵呵

显示全部楼层 · 发表于 2008-5-1 21:25:59

卡巴启发式果然强悍

红伞

显示全部楼层 · 发表于 2008-5-1 21:28:08

显示全部楼层 · 发表于 2008-5-1 21:30:28

ESET的网络启发误报多多。。。。。。

显示全部楼层 · 发表于 2008-5-1 21:33:14

原帖由 PC0amera 于 2008-5-1 21:25 发表
卡巴启发式果然强悍
254461

254462

红伞

254463

我怎么没看到启发式？

[病毒样本] update x5 Zhelatin

本帖子中包含更多资源

本帖子中包含更多资源

另外一个网络启发可以侦测到

F-Prot

回复 4楼 EQ2 的帖子

本帖子中包含更多资源

本帖子中包含更多资源