误报？

欠妳緈諨

多引擎上都是一些误报王们在报[:1:]

492052134

过卡巴哦

wangjay1980

2008-6-24 JAY11:57:15 Kill Process Module  Process exit C:\Documents and Settings\Owner\桌面\mc.exe
2008-6-24 JAY11:56:49 Kill Process Module  Process start C:\Documents and Settings\Owner\桌面\mc.exe
2008-6-24 JAY11:56:49 Kill Process Module  Placed in group Low Restricted
2008-6-24 JAY11:56:08 WinRAR.exe  Create C:\Documents and Settings\Owner\桌面\mc.exe

chima287

-----------------------------SCAN REPORT-----------------------------
F-PROT for Windows
防病毒扫描引擎版本号: 4.4.4
病毒库: 2008-6-24, 3:34
扫描名称: [自定义扫描]
路径扫描: C:\Downloads\mc.rar
正常扫描
也可以扫描: 子文件夹, 压缩文件, 数据流
已开始扫描: 2008-6-24, 12:14:48
---------------------------------------------------------------------
[发现可能为病毒：] <W32/PWStealer1!Generic (not disinfectable)> C:\Downloads\mc.rar->mc.exe->(NSPack)->(PE_Patch)
[包含被传染的对象] C:\Downloads\mc.rar
[已隔离] C:\Downloads\mc.rar->mc.exe->(NSPack)->(PE_Patch)
---------------------------------------------------------------------
扫描已结束: 2008-6-24, 12:14:56
用时: 0:00:07
扫描结果:
已扫描的文件:   1
已感染的对象:  1
已清除的对象:  0
已隔离的文件:  1
---------------------------------------------------------------------









Avira AntiVir Premium
Report file date: 2008年6月24日 星期二  12:50
Scanning for 1355845 virus strains and unwanted programs.
Licensed to:      lfj li
Serial number:    1101570194-PEPWE-0001
Platform:         Windows XP
Windows version:  (Service Pack 3)  [5.1.2600]
Boot mode:        Normally booted
Username:         Administrator
Computer name:    2FCF09AEF0F0486
Version information:
BUILD.DAT     : 8.1.0.344       19214 Bytes   2008-5-28 17:00:00
AVSCAN.EXE    : 8.1.2.12       311553 Bytes   2008-3-18 03:02:58
AVSCAN.DLL    : 8.1.1.0         53505 Bytes    2008-2-7 02:43:38
LUKE.DLL      : 8.1.2.9        151809 Bytes   2008-2-28 02:41:24
LUKERES.DLL   : 8.1.2.1         12033 Bytes   2008-2-21 02:28:42
ANTIVIR0.VDF  : 6.40.0.0     11030528 Bytes   2007-7-18 06:36:36
ANTIVIR1.VDF  : 7.0.3.2       5447168 Bytes    2008-3-7 06:07:50
ANTIVIR2.VDF  : 7.0.4.195     2546176 Bytes   2008-6-14 01:47:04
ANTIVIR3.VDF  : 7.0.4.241      331264 Bytes   2008-6-23 15:29:30
Engineversion : 8.1.0.59  
AEVDF.DLL     : 8.1.0.5        102772 Bytes    2008-4-2 06:36:34
AESCRIPT.DLL  : 8.1.0.44       278907 Bytes   2008-6-20 16:45:02
AESCN.DLL     : 8.1.0.22       119157 Bytes   2008-6-20 16:44:38
AERDL.DLL     : 8.1.0.20       418165 Bytes   2008-4-25 01:24:52
AEPACK.DLL    : 8.1.1.6        364918 Bytes   2008-6-20 16:44:30
AEOFFICE.DLL  : 8.1.0.20       192891 Bytes   2008-6-20 16:44:02
AEHEUR.DLL    : 8.1.0.32      1274231 Bytes   2008-6-20 16:43:46
AEHELP.DLL    : 8.1.0.15       115063 Bytes   2008-5-29 06:08:42
AEGEN.DLL     : 8.1.0.29       307573 Bytes   2008-6-20 16:42:06
AEEMU.DLL     : 8.1.0.6        430451 Bytes    2008-5-7 09:04:34
AECORE.DLL    : 8.1.0.31       168310 Bytes    2008-6-6 04:56:46
AVWINLL.DLL   : 1.0.0.7         14593 Bytes   2008-1-23 11:07:54
AVPREF.DLL    : 8.0.0.1         25857 Bytes   2008-2-18 04:37:52
AVREP.DLL     : 7.0.0.1        155688 Bytes   2007-4-16 07:26:48
AVREG.DLL     : 8.0.0.0         30977 Bytes   2008-1-23 11:07:50
AVARKT.DLL    : 1.0.0.23       307457 Bytes   2008-2-12 02:29:24
AVEVTLOG.DLL  : 8.0.0.11       114945 Bytes   2008-2-28 02:31:32
SQLITE3.DLL   : 3.3.17.1       339968 Bytes   2008-1-22 11:28:04
SMTPLIB.DLL   : 1.2.0.19        28929 Bytes   2008-1-23 11:08:40
NETNT.DLL     : 8.0.0.1          7937 Bytes   2008-1-25 06:05:12
RCIMAGE.DLL   : 8.0.0.31      2564353 Bytes   2008-2-28 03:19:52
RCTEXT.DLL    : 8.0.32.0        86273 Bytes    2008-3-6 05:45:46
Configuration settings for the scan:
Jobname..........................: ShlExt
Configuration file...............: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7504d59b.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: off
Scan registry....................: off
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Start of the scan: 2008年6月24日 星期二  12:50
Starting the file scan:
Begin scan in 'C:\Downloads\mc.rar'
C:\Downloads\mc.rar
  [0] Archive type: RAR
    --> mc.exe
          [DETECTION] Contains suspicious code HEUR/Crypted
      [NOTE]      The file was deleted!

End of the scan: 2008年6月24日 星期二  12:51
Used time: 00:32 min
The scan has been done completely.
      0 Scanning directories
      2 Files were scanned
      0 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      1 Archives were scanned
      0 Warnings
      1 Notes

两个杀软全杀

[ 本帖最后由 chima287 于 2008-6-24 12:53 编辑 ]

无尽藏海

小邪邪

连mcafee也启发报壳了

woai_jolin

Hello,

Thanks for taking the time to submit your samples to the Norman
Sandbox Information Center.  Customer delight is our top priority at
Norman.  With that in mind we have developed Sandbox Solutions for
organizations that are committed to speedy analysis and debugging.

Norman Sandbox Solutions give your organization the opportunity to
analyze files immediately in your own environment.

To find out how to bring the power of Norman Sandbox into your test
environments follow the links below.

Norman Sandbox Solutions
http://www.norman.com/Product/Sandbox-products/

Norman Sandbox Analyzer
http://www.norman.com/Product/Sandbox-products/Analyzer/

Norman Sandbox Analyzer Pro
http://www.norman.com/Product/Sandbox-products/Analyzer-pro/

Norman SandBox Reporter
http://www.norman.com/Product/Sandbox-products/Reporter/

mc.exe : INFECTED with W32/Suspicious_N.gen (Signature: W32/Suspicious_N.gen)


[ DetectionInfo ]
    * Sandbox name: W32/Suspicious_N.gen
    * Signature name: W32/Suspicious_N.gen
    * Compressed: YES
    * TLS hooks: NO
    * Executable type: Application
    * Executable file structure: OK

[ General information ]
    * File length:        34738 bytes.
    * MD5 hash: cb0c67dde85799f76edc768686069b01.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

ssy275

qigang

RS20.50.10未杀！