小红伞扫描病毒包~只扫到一个文件?

benlong2006

小弟上班极其无聊就下个病毒包来玩玩,小红伞扫描结果只扫到一个文件,一个毒都没发现,打开压缩包,里面有几十个文件的

will

两个问题：
1.样本包在哪里？
2.红伞扫描的设定是怎么样的？

huanxu

1、什么压缩包？
2、什么设置？？？

benlong2006

scan和guard都设置遇病毒先备份后修复最后删除,不过日 志里面没有说杀到病毒,我的文件放在d盘目录下

benlong2006

压缩包是这个http://bbs.kafan.cn/thread-400276-1-2.html

lomo

原帖由 benlong2006 于 2009-1-5 11:18 发表
压缩包是这个http://bbs.kafan.cn/thread-400276-1-2.html

可能跟你的设置有关
偶的P版扫描情况


The scan has been done completely.
      0 Scanning directories
     45 Files were scanned
     24 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     20 Files not concerned
      2 Archives were scanned
      0 Warnings
      1 Notes

特别是这里的设置


[ 本帖最后由 lomo 于 2009-1-5 12:32 编辑 ]

will

  Total Command-Line Scanner Report
-------------------------------------------------------------------------
  Report for AntiVir V8 Command-Line Scanner :

  0843AF63758DF7C3729F45DC05AEE9F2CAE5F9AD ----- APPL/NirCmd.D.2  
  09014BFF7E0E4514CD962680AC4EF39A7B15B6E3 ----- TR/Crypt.XPACK.Gen  
  105EAF957D12D2371067591B2F11FACE2116CBB8 ----- SPR/YMFlooder.B.46  
  121A54E4D2A93506E1D37D578C405AEDBB623E07 ----- TR/Spy.Agent.34816.A  
  141BDFEECC2C1632D8B340AB0FDC689D0A140473 ----- TR/Drop.Kobcka.1  
  15299B914306CA5FCFCBF527FC0B9EF871A29EEE ----- TR/Dropper.Gen  
  1604ED9AB8735383E40B20C46FE8201E2F60DE86 ----- TR/Proxy.Agent.atf.1  
  1703DA362F7367629C5247DFE897E3C95A89F89C ----- TR/Dropper.Gen  
  2273BF7B178AE6C73A6535ACF9A046971B109DED ----- TR/Rootkit.Gen  
  2469AFE2A0A1A343CC66001AA272C22AFAB65681 ----- TR/Downloader.Gen  
  3055BC98B66541B2729F9A777DE3BFE5FDEBEF51 ----- TR/Crypt.XPACK.Gen  
  312C8A8E64185AF640705479F045F4E6FF8A0E12 ----- TR/Dropper.Gen  
  319C14388DCFE16DDB31C0A8821354B70F6A6D86 ----- TR/Crypt.XPACK.Gen  
  343BF818D30B749DCE37A6B2AD98405A0AF73F19 ----- TR/Hijacker.Gen  
  347AF4227C67CEE3480AD90BB107695BC84CD91D ----- TR/Crypt.XPACK.Gen  
  351B692B2F3EB013696EDFD7066A8A4C19F951F3 ----- TR/Dldr.Agent.any.1  
  401A84785067F7E70A9EFDC887DEDB3CE1C6C194 ----- TR/Crypt.FSPM.Gen  
  4049F9DFF56B34B880B0F1C9D56625BBFBE2D0E3 ----- TR/Unpacked.Gen  
  425EDE27AD07235283E215281FFFAADC1040DA7F ----- TR/Dropper.Gen  
  47211CABC3DE7DB2495C3709FF821F3AA59A7E1D ----- TR/Crypt.DY.28  
  5288EA8F72D7832384A9561077110C3FACA2112E ----- TR/Crypt.XPACK.Gen  
  53669C8E1A141901673F142272E395F257C0FF5A ----- TR/Agent.47104.25  
  5455A9009DDD8A2CA8F6B5A93596054B779DAA23 ----- TR/Downloader.Gen  
  545F7B8E5273D6BBC1B3FAAC300DAD87517E7C6A ----- DR/Delphi.Gen  
  550C2A15B5B23641553E66124646055D51A901B2 ----- PCK/Telock  
  5870A3BCCC607CD6A19EC9A611B0B7A99FA53732 ----- TR/Agent.20480.LP  
  593F8DDBC5AE7D9594F03DB7E9FDF3AA8171ECA1 ----- TR/Crypt.XPACK.Gen  
  664D58648D2694E2557787DADE4F03D2 ----- TR/Vundo.Gen  
  6700A083E106151DFDBA2B82E28437E691D5429E ----- TR/Dldr.Exchanger.Gen.2.45  
  684C710BCE519CD866C182FE37B3015CA5C06285 ----- TR/Dropper.Gen  
  6909C25B03189C22E19DD188D24B1D7ACCE76D6C ----- TR/Crypt.XPACK.Gen  
  709DE63FAD7816CB72A15930CFC923D63C545401 ----- BDS/Bifrose.GFD  
  712ADC87BC56607079068AEEC239F54F0F41E5FD ----- TR/Dldr.Agent.any.1  
  75D9BCEBC4C65881394A3A8A5B2A02854B9250EC ----- TR/Crypt.XPACK.Gen  
  773E4F856633015FBFCBE044C1DDE89093EF62F6 ----- TR/Hijacker.Gen  
  785F5884B3E2911C5D4423CE580307A52D3300BC ----- TR/Crypt.XPACK.Gen  
  78A2B0633146580EC0C7697E96C4630CB7A27767 ----- TR/Crypt.XPACK.Gen  
  78DE2195928CF7A0FC36F0EDFB41EB08F98B6723 ----- TR/StartPage.HK  
  79DBC6D41B548BA8F1DE6D94DDD208DBEF8AC80F ----- TR/Crypt.XPACK.Gen  
  81C9CD3A8EF0E2A36454DEA769773AADBE12207E ----- SPR/Hacktool.40960  
  827E9C551DB01916BCAE1CA39C8229EBF219D878 ----- TR/Drop.VB.AQE.10  
  82A9A0C2B14981A290828E9CECFE1E3D ----- TR/Spy.Gen  
  839F3D846AC4F3BB4A05E56F86830F00BF4A071B ----- TR/Dropper.Gen  
  872F682F20F3598AF8FADB8893735701FC66A24B ----- TR/Agent.4652  
  8767AAD6A98908875A1FF1C44BD58F629606C263 ----- TR/Unpacked.Gen  
  877E2E713A590CBDA4D16E5DF0164BD72CE09FCD ----- TR/Agent.36352.26  
  87C28F367520DF1972C6EDAB5C0CA1CB3F4FE439 ----- TR/Rootkit.Gen  
  880AA45B80825A1772B6B3A028A26D6ADB80ADCA ----- BDS/Dawhku.A.3  
  882C81EEC9F7BE71F698459CA1A68B994ED6951B ----- TR/Downloader.Gen  
  90E9D6D2B9BBB0F1349669C2C96AFD4B613B18EE ----- TR/Zlob.cks.21  
  925F1A4C6A3BB8336C45562ED387B09C7AB2CD24 ----- TR/Dldr.Exchanger.Gen.2.49  
  932D7C0B12D1CEA17FF0EF05F983ABD9 ----- TR/Dldr.BHOSta  
  93C276B89DC6866F33382DF09A9EC8BCEA51F09E ----- TR/Gendal.35840.5  
  978F17342A78925F28B3A46FCD8DA083 ----- TR/PSW.OnLin.aklo.2  
  988F994FC2B80EDE2749E676ACE10B572C17900D ----- TR/Rootkit.Gen  
  98C0040230A76F94466607DF281B749A22EC770C ----- TR/Agent.26172  

  AntiVir V8 found 56 detections in 61 files.
-------------------------------------------------------------------------
  Task done @ 2009/01/05 һ 12:33:44.05

楼主尽快更新红伞吧

幻石

我的p版扫描结果，病毒库是v7.01.01.68.

我这扫描设置了扫描引导扇区和追踪扫描快捷方式目标文件，所以扫的文件数多，但是发现58个毒。。

report：

The scan has been done completely.
      0 Scanning directories
     79 Files were scanned
     58 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     21 Files not concerned
      3 Archives were scanned
      0 Warnings
      1 Notes

[ 本帖最后由 幻石 于 2009-1-5 12:52 编辑 ]

幻石

Begin scan in 'G:\download\c#.rar'
G:\download\c#.rar
    [0] Archive type: RAR
    --> C#\0843AF63758DF7C3729F45DC05AEE9F2CAE5F9AD
      [DETECTION] Contains recognition pattern of the APPL/NirCmd.D.2 application
    --> C#\09014BFF7E0E4514CD962680AC4EF39A7B15B6E3
      [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    --> C#\105EAF957D12D2371067591B2F11FACE2116CBB8
      [DETECTION] Contains recognition pattern of the SPR/YMFlooder.B.46 program
    --> C#\121A54E4D2A93506E1D37D578C405AEDBB623E07
      [DETECTION] Is the TR/Spy.Agent.34816.A Trojan
    --> C#\141BDFEECC2C1632D8B340AB0FDC689D0A140473
      [DETECTION] Is the TR/Drop.Kobcka.1 Trojan
    --> C#\15299B914306CA5FCFCBF527FC0B9EF871A29EEE
      [DETECTION] Is the TR/Dropper.Gen Trojan
    --> C#\1604ED9AB8735383E40B20C46FE8201E2F60DE86
      [DETECTION] Is the TR/Proxy.Agent.atf.1 Trojan
    --> C#\1703DA362F7367629C5247DFE897E3C95A89F89C
      [DETECTION] Is the TR/Dropper.Gen Trojan
    --> C#\2273BF7B178AE6C73A6535ACF9A046971B109DED
      [DETECTION] Is the TR/Rootkit.Gen Trojan
      --> C#\2469AFE2A0A1A343CC66001AA272C22AFAB65681
          [DETECTION] Is the TR/Downloader.Gen Trojan
      --> C#\3055BC98B66541B2729F9A777DE3BFE5FDEBEF51
          [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
      --> C#\312C8A8E64185AF640705479F045F4E6FF8A0E12
          [DETECTION] Is the TR/Dropper.Gen Trojan
    --> C#\319C14388DCFE16DDB31C0A8821354B70F6A6D86
      [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    --> C#\343BF818D30B749DCE37A6B2AD98405A0AF73F19
      [DETECTION] Is the TR/Hijacker.Gen Trojan
    --> C#\347AF4227C67CEE3480AD90BB107695BC84CD91D
      [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    --> C#\351B692B2F3EB013696EDFD7066A8A4C19F951F3
      [DETECTION] Is the TR/Dldr.Agent.any.1 Trojan
    --> C#\401A84785067F7E70A9EFDC887DEDB3CE1C6C194
      [DETECTION] Is the TR/Crypt.FSPM.Gen Trojan
    --> C#\4049F9DFF56B34B880B0F1C9D56625BBFBE2D0E3
      [DETECTION] Is the TR/Unpacked.Gen Trojan
    --> C#\425EDE27AD07235283E215281FFFAADC1040DA7F
      [DETECTION] Is the TR/Dropper.Gen Trojan
    --> C#\47211CABC3DE7DB2495C3709FF821F3AA59A7E1D
      [DETECTION] Is the TR/Crypt.DY.28 Trojan
    --> C#\5288EA8F72D7832384A9561077110C3FACA2112E
      [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    --> C#\53669C8E1A141901673F142272E395F257C0FF5A
      [DETECTION] Is the TR/Agent.47104.25 Trojan
      --> C#\550C2A15B5B23641553E66124646055D51A901B2
          [DETECTION] This file has been compressed using unusual runtime compression (PCK/Telock). Please verify the origin of this file.
    --> C#\5870A3BCCC607CD6A19EC9A611B0B7A99FA53732
      [DETECTION] Is the TR/Agent.20480.LP Trojan
    --> C#\593F8DDBC5AE7D9594F03DB7E9FDF3AA8171ECA1
      [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    --> C#\6700A083E106151DFDBA2B82E28437E691D5429E
      [DETECTION] Is the TR/Dldr.Exchanger.Gen.2.45 Trojan
    --> C#\684C710BCE519CD866C182FE37B3015CA5C06285
      [DETECTION] Is the TR/Dropper.Gen Trojan
    --> C#\6909C25B03189C22E19DD188D24B1D7ACCE76D6C
      [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    --> C#\709DE63FAD7816CB72A15930CFC923D63C545401
      [DETECTION] Contains a recognition pattern of the (harmful) BDS/Bifrose.GFD back-door program
    --> C#\712ADC87BC56607079068AEEC239F54F0F41E5FD
      [DETECTION] Is the TR/Dldr.Agent.any.1 Trojan
    --> C#\75D9BCEBC4C65881394A3A8A5B2A02854B9250EC
      [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    --> C#\773E4F856633015FBFCBE044C1DDE89093EF62F6
      [DETECTION] Is the TR/Hijacker.Gen Trojan
    --> C#\785F5884B3E2911C5D4423CE580307A52D3300BC
      [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    --> C#\78A2B0633146580EC0C7697E96C4630CB7A27767
      [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    --> C#\78DE2195928CF7A0FC36F0EDFB41EB08F98B6723
      [DETECTION] Is the TR/StartPage.HK Trojan
    --> C#\79DBC6D41B548BA8F1DE6D94DDD208DBEF8AC80F
      [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    --> C#\81C9CD3A8EF0E2A36454DEA769773AADBE12207E
      [DETECTION] Contains recognition pattern of the SPR/Hacktool.40960 program
    --> C#\827E9C551DB01916BCAE1CA39C8229EBF219D878
      [DETECTION] Is the TR/Drop.VB.AQE.10 Trojan
    --> C#\82A9A0C2B14981A290828E9CECFE1E3D
      [DETECTION] Is the TR/Spy.Gen Trojan
    --> C#\839F3D846AC4F3BB4A05E56F86830F00BF4A071B
      [DETECTION] Is the TR/Dropper.Gen Trojan
    --> C#\872F682F20F3598AF8FADB8893735701FC66A24B
      [DETECTION] Is the TR/Agent.4652 Trojan
    --> C#\8767AAD6A98908875A1FF1C44BD58F629606C263
      [DETECTION] Is the TR/Unpacked.Gen Trojan
    --> C#\877E2E713A590CBDA4D16E5DF0164BD72CE09FCD
      [DETECTION] Is the TR/Agent.36352.26 Trojan
    --> C#\87C28F367520DF1972C6EDAB5C0CA1CB3F4FE439
      [DETECTION] Is the TR/Rootkit.Gen Trojan
    --> C#\880AA45B80825A1772B6B3A028A26D6ADB80ADCA
      [DETECTION] Contains a recognition pattern of the (harmful) BDS/Dawhku.A.3 back-door program
    --> C#\882C81EEC9F7BE71F698459CA1A68B994ED6951B
      [DETECTION] Is the TR/Downloader.Gen Trojan
      --> C#\90E9D6D2B9BBB0F1349669C2C96AFD4B613B18EE
        --> Object
          [2] Archive type: RSRC
          --> Object
            --> Object
              [4] Archive type: RSRC
              --> Object
                [DETECTION] Is the TR/Zlob.cks.21 Trojan
          --> Object
            [DETECTION] Is the TR/Zlob.6656.2 Trojan
    --> C#\925F1A4C6A3BB8336C45562ED387B09C7AB2CD24
      [DETECTION] Is the TR/Dldr.Exchanger.Gen.2.49 Trojan
    --> C#\932D7C0B12D1CEA17FF0EF05F983ABD9
      [DETECTION] Is the TR/Dldr.BHOSta Trojan
    --> C#\93C276B89DC6866F33382DF09A9EC8BCEA51F09E
      [DETECTION] Is the TR/Gendal.35840.5 Trojan
    --> C#\978F17342A78925F28B3A46FCD8DA083
      [DETECTION] Is the TR/PSW.OnLin.aklo.2 Trojan
    --> C#\988F994FC2B80EDE2749E676ACE10B572C17900D
      [DETECTION] Is the TR/Rootkit.Gen Trojan
    --> C#\98C0040230A76F94466607DF281B749A22EC770C
      [DETECTION] Is the TR/Agent.26172 Trojan
    [NOTE]      A backup was created as '498f8e4a.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!

will

统计里面计数不准  有些会重复计数