可疑文件，红伞报，卡巴飘

水晶

原帖由 SONGBOWEN 于 2008-6-13 00:56 发表
我也不太敢确定，帮别人修机器的时候，随手复制来的……
红伞报“W32/Stanit”，我怕是误报，就用卡巴又扫了一次，最新病毒库，没报……

SONGBOWEN

还是有点问题……
我又比较了一下正常的红警2里的这几个文件，发现都比红伞报的这几个要小4KB左右。。。

qigang

不可疑。可疑红伞的能力吧。

allinwonderi

[Scanning : C:\Documents and Settings\All Users\Documents\Test]


C:\Documents and Settings\All Users\Documents\Test\test.rar<RAR>:Inject.exe <- W32.Licum.A : No action
C:\Documents and Settings\All Users\Documents\Test\test.rar<RAR>:Mph.exe <- W32.Licum.A : No action
C:\Documents and Settings\All Users\Documents\Test\test.rar<RAR>:ra2.exe <- W32.Licum.A : No action
C:\Documents and Settings\All Users\Documents\Test\test.rar<RAR>:RegSetup.exe <- W32.Licum.A : No action



Scanned objects : 5

Infected objects : 4

SIGKILL

Please find a detailed report concerning each individual sample below:
燜ilename         Result
Inject.exe          MALWARE

The file 'Inject.exe' has been determined to be 'MALWARE'. Our analysts named the threat W32/Stanit. The term "W32/" denotes a file virus or malware that runs on 32 Bit Windows systems (Windows 95 and higher) only.Detection is added to our virus definition file (VDF) starting with version 6.31.00.202. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: W32/Stanit.

燜ilename         Result
Mph.exe          MALWARE

The file 'Mph.exe' has been determined to be 'MALWARE'. Our analysts named the threat W32/Stanit. The term "W32/" denotes a file virus or malware that runs on 32 Bit Windows systems (Windows 95 and higher) only.Detection is added to our virus definition file (VDF) starting with version 6.31.00.202. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: W32/Stanit.

燜ilename         Result
ra2.exe          MALWARE

The file 'ra2.exe' has been determined to be 'MALWARE'. Our analysts named the threat W32/Stanit. The term "W32/" denotes a file virus or malware that runs on 32 Bit Windows systems (Windows 95 and higher) only.Detection is added to our virus definition file (VDF) starting with version 6.31.00.202. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: W32/Stanit.

燜ilename         Result
RegSetup.exe          MALWARE

The file 'RegSetup.exe' has been determined to be 'MALWARE'. Our analysts named the threat W32/Stanit. The term "W32/" denotes a file virus or malware that runs on 32 Bit Windows systems (Windows 95 and higher) only.Detection is added to our virus definition file (VDF) starting with version 6.31.00.202. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: W32/Stanit.