掃到一隻可疑樣本

juijui

昨晚全面掃毒，掃完竟發現紅傘報 WARNING 1隻...
把它捉出來給大家測試看看...
因為VT掃描只有少數幾家報，所以不知是否誤報... @@~

File ID  Filename Size (Byte) Result
25021881  symlcrst.rar 206.24 KB OK

A listing of files contained inside archives alongside their results can be found below:

File ID  Filename Size (Byte) Result
25021858  symlcrst.dll  287.79 KB  MALWARE


Please find a detailed report concerning each individual sample below:

Filename Result
symlcrst.dll  MALWARE

The file 'symlcrst.dll' has been determined to be 'MALWARE'. Detectionis added to our virus definition file (VDF) starting with version7.00.04.31. Please note that Avira's proactive heuristic detectionmodule AHeAD detected this threat up front without the latest VDFupdate as: Worm/Pykse.I.


VT
檔案 symlcrst.dll 接收於 2008.05.18 01:38:27 (CET)
當前狀態: 正在讀取 ... 隊列中 等待中 掃瞄中 完成 未發現 停止
結果: 1/32 (3.13%)
Webwasher-Gateway 6.6.2 2008.05.13 Worm.Pykse.I


紅傘官網要明天才會回信
所以也寄給卡巴分析

卡巴的回覆
Hello,

symlcrst.dll - IM-Worm.Win32.Pykse.o

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

看來不是誤報了!!!

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\symlcrst.rar'
C:\Documents and Settings\morgan\My Documents\
  symlcrst.rar
    [0] Archive type: RAR
      --> symlcrst.dll
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Contains detection pattern of the worm WORM/Pykse.I
            [WARNING]   Infected files in archives cannot be repaired!
      [NOTE]      The file was deleted!

Palkia

rs kv kav 0

qigang

RS20.44.62未杀！

wangjay1980

LS 好辛苦

BING126

McAfee  MISS

allinwonderi

TO ALL

电影结束了

Date,Virus Name,Virus Type,User,Filename,Scan Type
2008-5-18 21:00:50,IM.Worm.Pykse.l.aquq,病毒,wangcheng,F:\symlcrst.rar>>symlcrst.dll>>emb-1.exe,Manual scan