帮忙看下

显示全部楼层 · 发表于 2008-9-16 20:30:07

问题倒不大...

我越发觉得，红伞的特征提取太草率了...
我删掉多余数据，红伞就没反应了

显示全部楼层 · 发表于 2008-9-16 20:31:59

大部分都报什么PePatch

运行后也没发现什么问题

文件 unEbookWorkshop.exe 接收于 2008.09.16 14:19:29 (CET)
当前状态: 正在读取 ... 队列中等待中扫描中完成未发现停止

结果: 22/36 (61.12%)

正在读取服务器信息中...
您的文件所排队列位置: 1.
预计开始时间为 37 和 53 秒之间.
扫描完成前请勿关闭窗口.
目前针对您的文件所进行的扫描进程已停止, 我们将会在稍后恢复.
如果您的等候时间超过 5 分钟, 请重新发送文件.
您的文件目前正在被 VirusTotal 扫描中,
结果将会稍后完成时生成.

格式化文本
打印结果

您的文件已过期或不存在.
目前服务已停止, 您的文件将会稍后的未知时间内进行扫描 (位置:
). 您可以继续等待回应 (自动读取) 或者在下面的表单内输入您的电子邮件地址, 并按下 "获取", 当扫描完成时, 系统会自动给您发送电子邮件通知.

Email:

反病毒引擎	版本	最后更新	扫描结果
AhnLab-V3	2008.9.13.0	2008.09.16	Win-Trojan/Xema.variant
AntiVir	7.8.1.28	2008.09.16	TR/PePatch.CP.16
Authentium	5.1.0.4	2008.09.15	W32/Worm.CTI
Avast	4.8.1195.0	2008.09.15	Win32:PePatch-FU
AVG	8.0.0.161	2008.09.16	Win32/PEPatch
BitDefender	7.2	2008.09.16	Worm.Generic.11336
CAT-QuickHeal	9.50	2008.09.16	-
ClamAV	0.93.1	2008.09.16	-
DrWeb	4.44.0.09170	2008.09.16	Trojan.PWS.Gamania.4223
eSafe	7.0.17.0	2008.09.15	Win32.PePatch.cp
eTrust-Vet	31.6.6090	2008.09.15	-
Ewido	4.0	2008.09.16	Trojan.Small
F-Prot	4.4.4.56	2008.09.14	W32/Worm.CTI
F-Secure	8.0.14332.0	2008.09.16	-
Fortinet	3.113.0.0	2008.09.16	W32/PePatch.CP
GData	19	2008.09.16	Win32:PePatch-FU
Ikarus	T3.1.1.34.0	2008.09.16	Packed.Win32.PePatch.cp
K7AntiVirus	7.10.457	2008.09.15	-
Kaspersky	7.0.0.125	2008.09.16	-
McAfee	5384	2008.09.16	New Malware.ha
Microsoft	1.3903	2008.09.16	-
NOD32v2	3445	2008.09.16	-
Norman	5.80.02	2008.09.15	-
Panda	9.0.0.4	2008.09.16	Trj/QQRob.MD
PCTools	4.4.2.0	2008.09.15	Trojan.Patched.U
Prevx1	V2	2008.09.16	-
Rising	20.62.12.00	2008.09.16	-
Sophos	4.33.0	2008.09.16	Mal/Packer
Sunbelt	3.1.1633.1	2008.09.13	-
Symantec	10	2008.09.16	Infostealer.Gampass
TheHacker	6.3.0.9.084	2008.09.15	Trojan/PePatch.cp
TrendMicro	8.700.0.1004	2008.09.16	-
VBA32	3.12.8.5	2008.09.16	Trojan.PWS.Gamania.4223
ViRobot	2008.9.16.1377	2008.09.16	-
VirusBuster	4.5.11.0	2008.09.15	Trojan.Patched.U
Webwasher-Gateway	6.6.2	2008.09.16	Trojan.PePatch.CP.16

附加信息

File size: 602644 bytes

MD5...: 6e1dc85f607260476032281a88f708c4

SHA1..: c4cd050e709c7034477c3f3da5bdd1ab3a157eab

SHA256: c9f5a9994a8a12b834e0ae434c2029cb1e9ab1adcce1984bd70b679d854e25c9

SHA512: 343e999a91718ed304f0b9e6f471a0f8dfa5d020467b2aa7802f6172d59794e5
28fba28fa71c92fe71be75a9760535a4ccf9242699e351e5ccd4f85491601243

PEiD..: Armadillo v1.71

TrID..: File type identification
UPX compressed Win32 Executable (38.5%)
Win32 EXE Yoda's Crypter (33.4%)
Win32 Executable Generic (10.7%)
Win32 Dynamic Link Library (generic) (9.5%)
Win16/32 Executable Delphi generic (2.6%)

PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x576000
timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
UPX0 0x1000 0xf6000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
UPX1 0xf7000 0x7b000 0x7ae00 7.93 a054595233cc2916abda75b404c1b58a
.rsrc 0x172000 0x4000 0x3800 3.52 a1e4f47c70199e4155debae4725eb7a9
ZipGhost 0x176000 0x200 0x200 4.77 d9cec712b9eba327ffbef36b228bbe4c

( 12 imports )
> KERNEL32.DLL: LoadLibraryA, GetProcAddress, ExitProcess
> advapi32.dll: RegCloseKey
> comctl32.dll: ImageList_Add
> comdlg32.dll: GetOpenFileNameA
> gdi32.dll: SaveDC
> ole32.dll: CoInitialize
> oleaut32.dll: VariantCopy
> shell32.dll: ShellExecuteA
> user32.dll: GetDC
> version.dll: VerQueryValueA
> wininet.dll: InternetOpenA
> wsock32.dll: inet_ntoa

( 0 exports )

packers (F-Prot): UPX

packers (Authentium): UPX

packers (Kaspersky): PE_Patch, UPX

显示全部楼层 · 发表于 2008-9-16 20:35:57

那应该是误报了？

显示全部楼层 · 发表于 2008-9-16 23:34:10

确定，无毒。

unewssetupV2.20.exe_

No malicious code were found in these files. Please quote all when answering.

--Best regards, Ilya TolstikhinVirus analyst,

Kaspersky Lab.e-mail: newvirus@kaspersky.com http://www.kaspersky.com/
http://www.kaspersky.com/virusscanner -
free online virus scanner.http://www.kaspersky.com/helpdesk.html - technical support.

[病毒样本] 帮忙看下