启发式杀毒，一条特征可以查杀很多变种之十二

solcroft

怎还不见wusuobuzai会员替我讲解，启发式杀毒，一条特征可以查杀很多变种是什么东西

醉一生爱妍

MicroVita AntiSpyware  
_____________________________________________
                                          
             风暴微塔反间谍 T2
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]                  
                   http://221.10.254.214/
----------------------------------------------
开始扫描……


[C:\Documents and Settings\Administrator\桌面\pdhr.zip]
                    …………引擎[2]发现病毒:Win32.Packer3

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\pdhr.zip'
C:\Documents and Settings\morgan\My Documents\
  pdhr.zip
    [0] Archive type: ZIP
    --> pdhr.exe
        [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
      [NOTE]      The file was deleted!

testhawk

2008-6-29 10:40:43        已检测到: Trojan-PSW.Win32.QQPass.cab

Palkia

kav 0

solcroft

传到VT上看看
50次的理念果然就是不入库，因为入库了就会误报

AhnLab-V3	2008.6.27.1	2008.06.27	-
AntiVir	7.8.0.59	2008.06.28	TR/Dldr.Delphi.Gen
Authentium	5.1.0.4	2008.06.29	W32/Downloader.X.gen!Eldorado
Avast	4.8.1195.0	2008.06.28	-
AVG	7.5.0.516	2008.06.29	PSW.Generic6.NDO
BitDefender	7.2	2008.06.29	Trojan.Generic.296481
CAT-QuickHeal	9.50	2008.06.28	TrojanPSW.QQPass.cab
ClamAV	0.93.1	2008.06.28	-
DrWeb	4.44.0.09170	2008.06.28	-
eSafe	7.0.17.0	2008.06.26	Win32.QQPass.cab
eTrust-Vet	31.6.5911	2008.06.27	Win32/VMalum.DCYH
Ewido	4.0	2008.06.27	Trojan.QQPass.cab
F-Prot	4.4.4.56	2008.06.29	W32/Downloader.X.gen!Eldorado
F-Secure	7.60.13501.0	2008.06.26	Trojan-PSW.Win32.QQPass.cab
Fortinet	3.14.0.0	2008.06.28	W32/QQPass.CAB!tr.pws
GData	2.0.7306.1023	2008.06.29	Trojan-PSW.Win32.QQPass.cab
Ikarus	T3.1.1.26.0	2008.06.29	Trojan-Downloader.Win32.Delf.ADG
Kaspersky	7.0.0.125	2008.06.29	Trojan-PSW.Win32.QQPass.cab
McAfee	5327	2008.06.27	Generic PWS.y
Microsoft	1.3704	2008.06.29	-
NOD32v2	3225	2008.06.29	-
Norman	5.80.02	2008.06.27	W32/QQPass.JTP
Panda	9.0.0.4	2008.06.28	Suspicious file
Prevx1	V2	2008.06.29	Malicious Software
Rising	20.50.52.00	2008.06.28	-
Sophos	4.30.0	2008.06.29	Mal/Banspy-F
Sunbelt	3.0.1176.1	2008.06.26	Trojan-PSW.Win32.QQPass.cab
TheHacker	6.2.96.364	2008.06.28	Trojan/PSW.QQPass.cab
TrendMicro	8.700.0.1004	2008.06.27	TSPY_QQPASS.APY
VBA32	3.12.6.8	2008.06.28	Trojan-PSW.Win32.QQPass.cab
VirusBuster	4.5.11.0	2008.06.23	-
Webwasher-Gateway	6.6.2	2008.06.28	Trojan.Dldr.Delphi.Gen

ssy275

sanhu35

报

allinwonderi

[Found downloader]         <W32/Downloader.X.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\pdhr.zip->pdhr.exe

---------------------------------------------------------------------
Scan ended:        2008-6-29, 12:37:21
Duration:        0:00:00

Scan result:

Scanned files:                 6
Infected objects:         1
Disinfected objects:         0
Quarantined files:         0
---------------------------------------------------------------------

allinwonderi

[Scanning : C:\Documents and Settings\All Users\Documents\Test]


C:\Documents and Settings\All Users\Documents\Test\pdhr.zip<ZIP>:pdhr.exe<PECompact2>:pdhr.exe <- Trojan.Psw.Qqpass.Cab : No action



Scanned objects : 3

Infected objects : 1