一个可疑chm

显示全部楼层 · 发表于 2008-7-9 11:26:25

可疑chm,据说会放出病毒。我现在没有测试环境，没办法测试，劳烦大家了。

[ 本帖最后由 yk1234 于 2008-7-9 11:30 编辑 ]

显示全部楼层 · 发表于 2008-7-9 11:38:30

2008-7-9 JAY11:35:10 Task started
2008-7-9 JAY11:35:11 Detected: VirTool.Win32.Tracer C:\Documents and Settings\Owner\桌面\Crack Tutorial.chm/CHAP6/technology/seh/seh.zip/Sehinasm.zip/ring032/ring032.exe
2008-7-9 JAY11:35:11 Untreated: VirTool.Win32.Tracer C:\Documents and Settings\Owner\桌面\Crack Tutorial.chm/CHAP6/technology/seh/seh.zip/Sehinasm.zip/ring032/ring032.exe Postponed
2008-7-9 JAY11:35:11 Detected: VirTool.Win32.Etricks C:\Documents and Settings\Owner\桌面\Crack Tutorial.chm/CHAP6/technology/seh/seh.zip/Sehinasm.zip/ETricks.zip/ETricks.exe
2008-7-9 JAY11:35:11 Detected: VirTool.Win32.Tracer C:\Documents and Settings\Owner\桌面\Crack Tutorial.chm/CHAP6/technology/seh/seh.zip/Sehinasm.zip/rline32/rline32.exe
2008-7-9 JAY11:35:12 Detected: Trojan.Win32.Agent.edz C:\Documents and Settings\Owner\桌面\Crack Tutorial.chm/CHAP9/Exercise/chap9-3-2.zip/注册机4.EXE/PE_Patch/UPX
2008-7-9 JAY11:35:13 Detected: VirTool.Win32.Tracer C:\Documents and Settings\Owner\桌面\Crack Tutorial.chm/CHAP6/technology/seh/seh.zip/Sehinasm.zip/ring032/ring032.exe
2008-7-9 JAY11:35:20 Untreated: VirTool.Win32.Tracer C:\Documents and Settings\Owner\桌面\Crack Tutorial.chm/CHAP6/technology/seh/seh.zip/Sehinasm.zip/ring032/ring032.exe Skipped by user
2008-7-9 JAY11:35:20 Detected: VirTool.Win32.Etricks C:\Documents and Settings\Owner\桌面\Crack Tutorial.chm/CHAP6/technology/seh/seh.zip/Sehinasm.zip/ETricks.zip/ETricks.exe
2008-7-9 JAY11:35:21 Detected: VirTool.Win32.Tracer C:\Documents and Settings\Owner\桌面\Crack Tutorial.chm/CHAP6/technology/seh/seh.zip/Sehinasm.zip/rline32/rline32.exe
2008-7-9 JAY11:35:22 Detected: Trojan.Win32.Agent.edz C:\Documents and Settings\Owner\桌面\Crack Tutorial.chm/CHAP9/Exercise/chap9-3-2.zip/注册机4.EXE/PE_Patch/UPX
2008-7-9 JAY11:35:22 Task completed

显示全部楼层 · 发表于 2008-7-9 11:58:23

这个不是毒可以放心使用，你搞这个的应该有经验，不要怕，还有我呢。

显示全部楼层 · 发表于 2008-7-9 17:07:30

10来个病毒工具和3个木马

显示全部楼层 · 发表于 2008-7-9 18:35:12

谢谢楼上各位！真巧啊，今天中午用CHM Explorer反编译，弄了半天没把那些病毒分离出来。CHM Explorer是智能实验室做的吧。

显示全部楼层 · 发表于 2008-7-9 19:16:43

信息 2008-07-09  19:13:20 您此次查毒清除了4个病毒
信息 2008-07-09  19:13:20 您此次查毒共查出4个病毒以及危险代码
信息 2008-07-09  19:13:20 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件32个
信息 2008-07-09  19:13:20 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
病毒 2008-07-09  19:13:19 D:\Desktop\chm.zip\Mywork\Guardio\Samples\PE\恶意软件\x54\080708\chm\CHAP9\Exercise\chap9-3-2\注册机4.EXE Win32.Troj.Agent.45274 清除成功
病毒 2008-07-09  19:13:19 D:\Desktop\chm.zip\Mywork\Guardio\Samples\PE\恶意软件\x54\080708\chm\CHAP6\technology\seh\seh\Sehinasm\ETricks\ETricks.exe VTool.Troj.Etricks.e.3584 清除成功
病毒 2008-07-09  19:13:19 D:\Desktop\chm.zip\Mywork\Guardio\Samples\PE\恶意软件\x54\080708\chm\CHAP6\technology\seh\seh\Sehinasm\ring032\ring032.exe VTool.Tracer.2560 清除成功
病毒 2008-07-09  19:13:19 D:\Desktop\chm.zip\Mywork\Guardio\Samples\PE\恶意软件\x54\080708\chm\CHAP6\technology\seh\seh\Sehinasm\rline32\rline32.exe VTool.Tracer.41.2560 清除成功

显示全部楼层 · 发表于 2008-7-9 19:52:16

McAfee MISS

显示全部楼层 · 发表于 2008-7-9 20:12:33

27个提取物

显示全部楼层 · 发表于 2008-7-9 20:18:41

The file 'Crack Tutorial.chm' has been determined to be 'MALWARE'. Our analysts named the threat DR/Virtl.Tracer. The term "DR/" denotes a program that is able to place a virus or a malware discretely on a system.Detection is added to our virus definition file (VDF) starting with version 7.00.05.71.

显示全部楼层 · 发表于 2008-7-9 20:19:31

[病毒样本] 一个可疑chm

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源