不是用NOD32的不必进来了

solcroft

ESET的人赶紧去和真启发的工程师沟通一下吧

AhnLab-V3	2008.7.4.1	2008.07.04	-
AntiVir	7.8.0.64	2008.07.04	TR/Dldr.Agent.vhb
Authentium	5.1.0.4	2008.07.04	W32/Heuristic-210!Eldorado
Avast	4.8.1195.0	2008.07.04	-
AVG	7.5.0.516	2008.07.04	-
BitDefender	7.2	2008.07.05	Trojan.Sorri.O
CAT-QuickHeal	9.50	2008.07.04	TrojanPSW.OnLineGames.pay
ClamAV	0.93.1	2008.07.04	PUA.Packed.UPack-2
DrWeb	4.44.0.09170	2008.07.05	Trojan.DownLoad.991
eSafe	7.0.17.0	2008.07.03	Suspicious File
eTrust-Vet	31.6.5927	2008.07.04	-
Ewido	4.0	2008.07.04	-
F-Prot	4.4.4.56	2008.07.04	W32/Heuristic-210!Eldorado
F-Secure	7.60.13501.0	2008.07.03	W32/Suspicious_U.gen
Fortinet	3.14.0.0	2008.07.04	-
GData	2.0.7306.1023	2008.07.04	Trojan-Downloader.Win32.Agent.vhb
Ikarus	T3.1.1.26.0	2008.07.05	Trojan-Downloader.Win32.Agent.vhb
Kaspersky	7.0.0.125	2008.07.05	Trojan-Downloader.Win32.Agent.vhb
McAfee	5332	2008.07.04	New Malware.aj
Microsoft	1.3704	2008.07.04	-
NOD32v2	3244	2008.07.05	-
Norman	5.80.02	2008.07.04	W32/Suspicious_U.gen
Panda	9.0.0.4	2008.07.04	Suspicious file
Prevx1	V2	2008.07.05	-
Rising	20.51.42.00	2008.07.04	-
Sophos	4.31.0	2008.07.05	Mal/Packer
Sunbelt	3.1.1509.1	2008.07.04	VIPRE.Suspicious
Symantec	10	2008.07.05	-
TheHacker	6.2.96.371	2008.07.04	W32/Behav-Heuristic-060
TrendMicro	8.700.0.1004	2008.07.04	PAK_Generic.006
VBA32	3.12.6.8	2008.07.04	-
VirusBuster	4.5.11.0	2008.07.04	Packed/Upack
Webwasher-Gateway	6.6.2	2008.07.05	Trojan.Dldr.Agent.vhb

电影结束了

TF一直放行结果....


刚知道你承包了NOD这个月的测试....

[ 本帖最后由 电影结束了 于 2008-7-5 13:54 编辑 ]

风野胤

下载者
下的东西倒是有够渣

s没事和启发较什么劲
什么都能启发的那不叫启发
那叫神启

在线沙盘看有什么动作中
无虚拟机 无ghost 无hips情况下跑了一遍

就是直接联网？
这么单纯的下载者
启发出来才是神。。。。。。


svcos.exe : Not detected by Sandbox (Signature: W32/Suspicious_U.gen)


 [ DetectionInfo ]
   * Sandbox name: NO_MALWARE
   * Signature name: W32/Suspicious_U.gen
   * Compressed: YES
   * TLS hooks: NO
   * Executable type: Application
   * Executable file structure: OK

 [ General information ]
   * File length:        12636 bytes.
   * MD5 hash: 48a78fcf2b3ed76cde11081ae497846d.

 [ Changes to filesystem ]
   * Creates directory C:\233136\.
   * Creates file C:\233136\235821.
   * Deletes file C:\233136\235821.
   * Creates file C:\233136\248766.bat.
   * Deletes file "c:\sample.exe".

 [ Changes to registry ]
   * Accesses Registry key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL".

 [ Network services ]
   * Downloads file from  as C:\233136\235821.
   * Connects to "" on port 80 (TCP).
   * Opens URL: /.

 [ Process/window information ]
   * Creates process "CMD.EXE".

 [ Signature Scanning ]
   * C:\233136\235821 (4096 bytes) : no signature detection.
   * C:\233136\248766.bat (21 bytes) : no signature detection.



(C) 2004-2006 Norman ASA. All Rights Reserved.

[ 本帖最后由 风野胤 于 2008-7-5 14:27 编辑 ]

电影结束了

估计是这个....
http://snbjoy.cn/hb/0.exe
http://snbjoy.cn/hb/1.exe
.....
到http://snbjoy.cn/hb/19.exe

[ 本帖最后由 电影结束了 于 2008-7-5 14:14 编辑 ]

kkgh

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.DL.Win32.Undef.vx

用户来源：互联网

软件版本：20.51.50

风野胤

原帖由 电影结束了 于 2008-7-5 14:09 发表
估计是这个....
http://snbjoy.cn/hb/0.exe
http://snbjoy.cn/hb/1.exe
.....
到http://snbjoy.cn/hb/19.exe

Scan Log
Version of virus signature database: 3244 (20080705)
Date: 2008-7-5  Time: 14:19:57
Scanned disks, folders and files: R:\8.exe;R:\0.exe;R:\1.exe;R:\2.exe;R:\3.exe;R:\4.exe;R:\5.exe;R:\6.exe;R:\7.exe;R:\9.exe;R:\10.exe;R:\11.exe;R:\12.exe;R:\13.exe;R:\14.exe;R:\15.exe;R:\16.exe;R:\17.exe;R:\18.exe;R:\19.exe
R:\0.exe - probably unknown NewHeur_PE virus [7]
R:\1.exe - a variant of Win32/PSW.OnLineGames.XZN trojan
R:\2.exe - probably a variant of Win32/PSW.OnLineGames.NML trojan
R:\3.exe - probably a variant of Win32/PSW.OnLineGames.NML trojan
R:\4.exe - probably a variant of Win32/PSW.OnLineGames.NML trojan
R:\5.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
R:\6.exe - probably a variant of Win32/PSW.OnLineGames.NML trojan
R:\7.exe - probably unknown NewHeur_PE virus [7]
R:\9.exe - probably a variant of Win32/PSW.OnLineGames.NML trojan
R:\10.exe - probably a variant of Win32/PSW.OnLineGames.NML trojan
R:\11.exe - a variant of Win32/PSW.QQPass.NCZ trojan
R:\12.exe - a variant of Win32/PSW.OnLineGames.XZN trojan
R:\13.exe - a variant of Win32/PSW.OnLineGames.XZN trojan
R:\14.exe - a variant of Win32/PSW.OnLineGames.XZN trojan
R:\15.exe - a variant of Win32/PSW.OnLineGames.XZN trojan
R:\16.exe - probably a variant of Win32/PSW.OnLineGames.NML trojan
R:\17.exe - probably a variant of Win32/PSW.OnLineGames.NML trojan
R:\18.exe - probably a variant of Win32/PSW.OnLineGames.NML trojan
R:\19.exe - probably a variant of Win32/PSW.OnLineGames.NML trojan
Number of scanned objects: 20
Number of threats found: 19
Number of cleaned objects: 0
Time of completion: 14:20:01  Total scanning time: 4 sec (00:00:04)

Notes:
[7] Object is probably infected with an unknown virus.




唯一没报的8

8.exe : Not detected by Sandbox (Signature: NO_VIRUS)


 [ DetectionInfo ]
   * Sandbox name: NO_MALWARE
   * Signature name: NO_VIRUS
   * Compressed: YES
   * TLS hooks: NO
   * Executable type: Application
   * Executable file structure: OK

 [ General information ]
   * Application uses MFC.DLL.
   * Decompressing UPX3.
   * File length:        32256 bytes.
   * MD5 hash: 056124ed919b3a2871e85653db4d109f.

这个没有任何威胁了
本身没有威胁
下载的东西又是全杀
自己上报的激情都没有了。。。。。

[ 本帖最后由 风野胤 于 2008-7-5 14:31 编辑 ]

醉一生爱妍

http://zfzuguo.cn/updater.txt

barbara

这帖子的标题够嘲讽
不过也不必这么狭隘

拒绝出站啥事情也没有
ess的自动模式给放过去了
漏掉的一个会弄出点麻烦

solcroft

让我想起千XX经典语录里的一句
高危病毒上报马上入库，不入库说明没啥威胁性
呵呵

PS：劝某人分析病毒不要只懂得看沙盘

[ 本帖最后由 solcroft 于 2008-7-5 16:22 编辑 ]