VT上面的很多都报,但卡巴说沒惡意

sam.to

rt

syfwxmh

这个我只能说vt上报的多不一定就是毒~你可以运行下看看行为或者od一下

wangjay1980

没恶意

sam.to

剛測了数个,自行退出,沒太多時間,不測試了

saga3721

蠕虫名称：Worm.Win32.VB.ex

程序：
C:\DOCUMENTS AND SETTINGS\\桌面\3C1814800DCBB1E91B40A5875FBC5AAF2C900D08
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?

wangjay1980

原帖由 saga3721 于 2008-12-21 21:54 发表
蠕虫名称：Worm.Win32.VB.ex

程序：
C:\DOCUMENTS AND SETTINGS\\桌面\3C1814800DCBB1E91B40A5875FBC5AAF2C900D08
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?

WORM？

2008-12-21 22:01:31 3C1814800DCBB1E91B40A5875FBC5AAF2C900D08.exe  添加到 低限制组
2008-12-21 22:01:31 3C1814800DCBB1E91B40A5875FBC5AAF2C900D08.exe 启动进程 C:\Documents and Settings\Administrator\桌面\3C1814800DCBB1E91B40A5875FBC5AAF2C900D08.exe
2008-12-21 22:01:32 3C1814800DCBB1E91B40A5875FBC5AAF2C900D08.exe  退出进程 C:\Documents and Settings\Administrator\桌面\3C1814800DCBB1E91B40A5875FBC5AAF2C900D08.exe

[ 本帖最后由 wangjay1980 于 2008-12-21 22:08 编辑 ]

su-tt

ESS无视之

挪威的冬天

信息        2008-12-21  22:21:58        您此次查毒共查出3个病毒以及危险代码                       
信息        2008-12-21  22:21:58        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件10个                       
信息        2008-12-21  22:21:58        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
风险程序        2008-12-21  22:21:58        D:\Desktop\13\3C1814800DCBB1E91B40A5875FBC5AAF2C900D08        Win32.NotVirus.Compress.a.14336        跳过，未处理       
病毒        2008-12-21  22:21:52        D:\Desktop\13\3E605102D2A8CFB2E84EDEEDD24866160833EEE7        Win32.Troj.WpaKill.a.135168        跳过，未处理       
病毒        2008-12-21  22:21:52        D:\Desktop\13\03DCC507ADC6DEE0E03F77CFF57BEA56DF1C0CCF.ex3e        Win32.Troj.Agent.cf.46936        跳过，未处理       

金山毒霸可信认证查询结果如下:

报告生成于:   2008/12/21 22:22

2F7D85385A87CC80CFDE9ABD8EA09482DF357A9E      --------      安全(*)


3E605102D2A8CFB2E84EDEEDD24866160833EEE7      --------      可疑的


3C1814800DCBB1E91B40A5875FBC5AAF2C900D08      --------      风险程序


03DCC507ADC6DEE0E03F77CFF57BEA56DF1C0CCF.ex3e      --------      未知
winjvd32.dll      --------      未知


3E1C760D0F57F3C78518FB4DC087AB74D2B0A06E      --------      分析中


理论文件总数:        6
实际文件总数:        6

其中:

分析中: 1
安全: 1
可疑的: 1
风险程序: 1
未知: 2

识别率为: 66%

saga3721

原帖由 wangjay1980 于 2008-12-21 22:03 发表


WORM？

这就是卡巴的依据？
红伞的回复是这样子地：
We received the following archive files:

File ID	Filename	Size (Byte)	Result
25216528	13.RAR	184.03 KB	OK

A listing of files contained inside archives alongside their results can be found below:

File ID	Filename	Size (Byte)	Result
1253750	3E605102D2A8CFB2E84E...E7	37.5 KB	FALSE POSITIVE
25216529	winjvd32.dll	31.5 KB	MALWARE
25216530	03DCC507ADC6DEE0...CF.ex3e	45.84 KB	MALWARE
254055	2F7D85385A87CC80CFDE...9E	52.5 KB	FALSE POSITIVE
213469	3C1814800DCBB1E91B40...08	14 KB	MALWARE
534188	3E1C760D0F57F3C78518...6E	34 KB	FALSE POSITIVE

Please find a detailed report concerning each individual sample below:

Filename	Result
3E605102D2A8CFB2E84E...E7	FALSE POSITIVE

The file '3E605102D2A8CFB2E84EDEEDD24866160833EEE7' has been determined to be 'FALSE POSITIVE'. In particular this means that this file is not malicious but a false alarm. Detection will not be removed due to the fact that the file does not belong to a regular piece of software. This software can be used for an evasion of security protections in several computer programs. If we will find some malicious code inside the suspicious file anyway, we will integrate the pattern recognition in one of our next updates. In case AntiVir can detect this file we will not change or remove our detection.

Filename	Result
winjvd32.dll	MALWARE

The file 'winjvd32.dll' has been determined to be 'MALWARE'.
Our analysts named the threat TR/Spy.Gen. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.This malware is detected by a special detection routine from the engine module.

Filename	Result
03DCC507ADC6DEE0...CF.ex3e	MALWARE

The file '03DCC507ADC6DEE0E03F77CFF57BEA56DF1C0CCF.ex3e' has been determined to be 'MALWARE'.
Our analysts named the threat TR/Dropper.Gen. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.This malware is detected by a special detection routine from the engine module.

Filename	Result
2F7D85385A87CC80CFDE...9E	FALSE POSITIVE

The file '2F7D85385A87CC80CFDE9ABD8EA09482DF357A9E' has been determined to be 'FALSE POSITIVE'. In particular this means that this file is not malicious but a false alarm. Detection will not be removed due to the fact that the file does not belong to a regular piece of software. This software can be used for an evasion of security protections in several computer programs. If we will find some malicious code inside the suspicious file anyway, we will integrate the pattern recognition in one of our next updates. In case AntiVir can detect this file we will not change or remove our detection.

Filename	Result
3C1814800DCBB1E91B40...08	MALWARE

The file '3C1814800DCBB1E91B40A5875FBC5AAF2C900D08' has been determined to be 'MALWARE'.
Our analysts named the threat Worm/VB.BV. The term "WORM/" denotes a worm that is able to spread itself for instance over the Internet (using eMail, peer-to-peer networks, IRC networks etc.).Detection will be added to our virus definition file (VDF) with one of the next updates.

Filename	Result
3E1C760D0F57F3C78518...6E	FALSE POSITIVE

The file '3E1C760D0F57F3C78518FB4DC087AB74D2B0A06E' has been determined to be 'FALSE POSITIVE'. In particular this means that this file is not malicious but a false alarm. Detection will not be removed due to the fact that the file does not belong to a regular piece of software. This software can be used for an evasion of security protections in several computer programs. If we will find some malicious code inside the suspicious file anyway, we will integrate the pattern recognition in one of our next updates. In case AntiVir can detect this file we will not change or remove our detection.

sam.to

再上报3C1814800到卡巴