其实我是根据外表来判断它是病毒的。。。。别囧

飘渺虚无

样本是我在一台毒机上杀剩下的小东西之一。见它外表虚假，位置可疑，便将其直接逮捕。大家可以看看是不是真的有问题

zxc84082172

反病毒引擎	版本	最后更新	扫描结果
AhnLab-V3	2008.11.1.0	2008.11.03	-
AntiVir	7.9.0.10	2008.11.02	-
Authentium	5.1.0.4	2008.11.02	-
Avast	4.8.1248.0	2008.11.02	-
AVG	8.0.0.161	2008.11.02	-
BitDefender	7.2	2008.11.03	-
CAT-QuickHeal	9.50	2008.11.03	-
ClamAV	0.94.1	2008.11.03	-
DrWeb	4.44.0.09170	2008.11.03	-
eSafe	7.0.17.0	2008.11.02	-
eTrust-Vet	31.6.6185	2008.11.01	-
Ewido	4.0	2008.11.02	-
F-Prot	4.4.4.56	2008.11.02	-
F-Secure	8.0.14332.0	2008.11.03	-
Fortinet	3.117.0.0	2008.11.02	-
GData	19	2008.11.03	-
Ikarus	T3.1.1.45.0	2008.11.03	-
K7AntiVirus	7.10.514	2008.11.01	-
Kaspersky	7.0.0.125	2008.11.02	-
McAfee	5422	2008.11.02	-
Microsoft	1.4005	2008.11.03	-
NOD32	3576	2008.11.03	a variant of Win32/VB.NQU
Norman	5.80.02	2008.10.31	-
Panda	9.0.0.4	2008.11.02	-
PCTools	4.4.2.0	2008.11.03	-
Prevx1	V2	2008.11.03	-
Rising	21.02.00.00	2008.11.03	-
SecureWeb-Gateway	6.7.6	2008.11.02	-
Sophos	4.35.0	2008.11.03	-
Sunbelt	3.1.1777.2	2008.11.03	-
Symantec	10	2008.11.03	Infostealer
TheHacker	6.3.1.1.137	2008.11.03	-
TrendMicro	8.700.0.1004	2008.11.03	-
VBA32	3.12.8.9	2008.11.02	-
ViRobot	2008.11.3.1448	2008.11.03	-
VirusBuster	4.5.11.0	2008.11.02	-

附加信息

File size: 21859 bytes

MD5...: 2f44c91b13baaa727807d8494da584a0

SHA1..: a0492085d6e596df3e38fd8ff4503a8bafaa5978

SHA256: 61ab9db5436bfe3402ce45de221f36114afc997a77d51e185c3c3ef15335cd5e

SHA512: 90f118731897e670cd90a2190de7fa18ddff71fceeffeae823ab5788421009e7 0a1bd1d18af06f0fa7b076782e24c74c2feefd82364a408d9e921ad36da54b09

PEiD..: -

TrID..: File type identification RAR Archive (83.3%) REALbasic Project (16.6%)

PEInfo: -

[ 本帖最后由 zxc84082172 于 2008-11-3 12:57 编辑 ]

kingmuro

zxc84082172

我还运行了一下
微点报它联网的时候我就结束了
不知道中毒了没
不过我用的是虚拟机

无尽藏海

http://www.threatexpert.com/repo ... 797e295e6f289aca40a

syfwxmh

Hello. This file is already detected. Please update your bases.

Please quote all when answering. Do not forget to include you registration data.
-----------------
Regards, Tatarinov Ivan
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com


> Attachment: virusample1.rar

无尽藏海

Hello.
New malicious software was found in the attached file.
It's detection will be included in the next update. Thank you for your help.

Please quote all when answering. Do not forget to include you registration data.
-----------------
Regards, Tatarinov Ivan
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com


> Attachment: biuzh5830???ccbb.zip

syfwxmh

无语

leonfg

双N的力量...

御擎

抢先了一步