误报还是毒？

显示全部楼层 · 发表于 2009-1-14 15:01:33

误报还是毒？

显示全部楼层 · 发表于 2009-1-14 15:05:09

TO KL

反病毒引擎	版本	最后更新	扫描结果
a-squared	4.0.0.73	2009.01.14	Trojan-Downloader.Win32.Delf.asz!IK
AhnLab-V3	2009.1.13.3	2009.01.14	-
AntiVir	7.9.0.54	2009.01.13	-
Authentium	5.1.0.4	2009.01.13	-
Avast	4.8.1281.0	2009.01.13	-
AVG	8.0.0.229	2009.01.13	-
BitDefender	7.2	2009.01.14	-
CAT-QuickHeal	10.00	2009.01.14	Win32.Backdoor.Hupigon.ngr3
ClamAV	0.94.1	2009.01.14	Trojan.Bifrose-2048
Comodo	927	2009.01.13	-
DrWeb	4.44.0.09170	2009.01.13	Trojan.MulDrop.27533
eSafe	7.0.17.0	2009.01.13	-
eTrust-Vet	31.6.6306	2009.01.13	-
F-Prot	4.4.4.56	2009.01.13	-
F-Secure	8.0.14470.0	2009.01.14	-
Fortinet	3.117.0.0	2009.01.14	-
GData	19	2009.01.14	-
Ikarus	T3.1.1.45.0	2009.01.14	Trojan-Downloader.Win32.Delf.asz
K7AntiVirus	7.10.584	2009.01.09	Trojan-Spy.Win32.Delf.ps
Kaspersky	7.0.0.125	2009.01.14	-
McAfee	5494	2009.01.13	-
McAfee+Artemis	5494	2009.01.13	-
Microsoft	1.4205	2009.01.14	-
NOD32	3763	2009.01.13	-
Norman	5.93.01	2009.01.13	-
Panda	9.5.1.2	2009.01.13	-
PCTools	4.4.2.0	2009.01.13	-
Prevx1	V2	2009.01.14	-
Rising	21.12.21.00	2009.01.14	-
SecureWeb-Gateway	6.7.6	2009.01.13	-
Sophos	4.37.0	2009.01.14	-
Sunbelt	3.2.1831.2	2009.01.09	Trojan.Win32.Packed.gen (v)
Symantec	10	2009.01.14	-
TheHacker	6.3.1.4.219	2009.01.14	-
TrendMicro	8.700.0.1004	2009.01.14	-
VBA32	3.12.8.10	2009.01.13	-
ViRobot	2009.1.14.1558	2009.01.14	-
VirusBuster	4.5.11.0	2009.01.13	-

附加信息

File size: 368331 bytes

MD5...: 227304c6f0de53b6c715e08dda7b1521

[ 本帖最后由 dreams521 于 2009-1-14 15:08 编辑 ]

显示全部楼层 · 发表于 2009-1-14 15:05:49

1.14病毒库，红伞没有报毒

显示全部楼层 · 发表于 2009-1-14 15:21:21

不是毒吧....

看了半天没发现什么可疑的

就是有一个添加了一个自启动项..runonce

但同时也很奇怪...微软的东西怎么没签名...

观望一下..

显示全部楼层 · 发表于 2009-1-14 15:24:41

大约没问题......

但同时也不是微软的东西

显示全部楼层 · 发表于 2009-1-14 15:39:34

是个自动安装鼠标指针的程序
仔细看看也没创建什么文件...就添加了个自启动
从鼠标指针来看也没什么错

我也有点糊涂

显示全部楼层 · 发表于 2009-1-14 16:13:12

• File Info

Name	Value
Size	398336
MD5	04e6aa048b4f631fff4e7681676ae3f5
SHA1	725b9e075aa8beed94978d81741f79df74a93afb
SHA256	65ba8d0850b4ac5a5b5b1888879f56bfa16898971fca3ca9da9076abbfec074c
Process	Active

• Keys Created
• Keys Changed
• Keys Deleted
• Values Created
• Values Changed
• Values Deleted
• Directories Created

Name	Last Write Time	Creation Time	Last Access Time	Attr
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP	2009.01.12 14:48:07.343	2009.01.12 14:47:58.437	2009.01.12 14:48:07.343	0x10

• Directories Changed
• Directories Deleted
• Files Created

Name	Size	Last Write Time	Creation Time	Last Access Time	Attr
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\AppStarting.ani	81738	2005.01.19 06:52:20.000	2005.01.19 06:52:20.000	2005.01.19 06:52:20.000	0x20
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\Arrow.ani	154804	2005.01.19 06:58:22.000	2005.01.19 06:58:22.000	2005.01.19 06:58:22.000	0x20
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\Arrow.cur	4286	2005.01.19 09:39:30.000	2005.01.19 09:39:30.000	2005.01.19 09:39:30.000	0x20
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\Arrow_2.ani	51652	2005.01.19 11:09:48.000	2005.01.19 11:09:48.000	2005.01.19 11:09:48.000	0x20
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\Cross.ani	64546	2005.01.19 06:59:50.000	2005.01.19 06:59:50.000	2005.01.19 06:59:50.000	0x20
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\Cross_2.ani	64546	2005.01.19 11:12:48.000	2005.01.19 11:12:48.000	2005.01.19 11:12:48.000	0x20
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\Hand.ani	94632	2005.01.19 07:02:00.000	2005.01.19 07:02:00.000	2005.01.19 07:02:00.000	0x20
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\Hand_2.ani	64546	2005.01.19 11:14:48.000	2005.01.19 11:14:48.000	2005.01.19 11:14:48.000	0x20
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\Handwriting.cur	4286	2005.01.19 07:02:22.000	2005.01.19 07:02:22.000	2005.01.19 07:02:22.000	0x20
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\Help.cur	4286	2005.01.19 07:02:38.000	2005.01.19 07:02:38.000	2005.01.19 07:02:38.000	0x20
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\IBeam.ani	64546	2005.01.19 07:04:32.000	2005.01.19 07:04:32.000	2005.01.19 07:04:32.000	0x20
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\IBeam_2.ani	64546	2005.01.19 11:16:48.000	2005.01.19 11:16:48.000	2005.01.19 11:16:48.000	0x20
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\NO.ani	86036	2005.01.19 07:05:18.000	2005.01.19 07:05:18.000	2005.01.19 07:05:18.000	0x20
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\Setup.inf	2397	2005.01.19 07:26:02.000	2005.01.19 07:26:02.000	2005.01.19 07:26:02.000	0x20
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\SizeAll.ani	68844	2005.01.19 07:06:28.000	2005.01.19 07:06:28.000	2005.01.19 07:06:28.000	0x20
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\SizeAll.cur	4286	2005.01.19 11:17:20.000	2005.01.19 11:17:20.000	2005.01.19 11:17:20.000	0x20
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\SizeNESW.ani	68844	2005.01.19 07:08:00.000	2005.01.19 07:08:00.000	2005.01.19 07:08:00.000	0x20
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\SizeNESW.cur	4286	2005.01.19 11:17:32.000	2005.01.19 11:17:32.000	2005.01.19 11:17:32.000	0x20
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\SizeNS.ani	68844	2005.01.19 07:09:58.000	2005.01.19 07:09:58.000	2005.01.19 07:09:58.000	0x20
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\SizeNS.cur	4286	2005.01.19 11:21:26.000	2005.01.19 11:21:26.000	2005.01.19 11:21:26.000	0x20
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\SizeNWSE.ani	68844	2005.01.19 07:11:28.000	2005.01.19 07:11:28.000	2005.01.19 07:11:28.000	0x20
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\SizeNWSE.cur	4286	2005.01.19 11:19:36.000	2005.01.19 11:19:36.000	2005.01.19 11:19:36.000	0x20
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\SizeWE.ani	68844	2005.01.19 07:13:12.000	2005.01.19 07:13:12.000	2005.01.19 07:13:12.000	0x20
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\SizeWE.cur	4286	2005.01.19 11:20:04.000	2005.01.19 11:20:04.000	2005.01.19 11:20:04.000	0x20
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\UpArrow.ani	68844	2005.01.19 07:25:02.000	2005.01.19 07:25:02.000	2005.01.19 07:25:02.000	0x20
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\UpArrow_2.ani	68844	2005.01.19 11:11:10.000	2005.01.19 11:11:10.000	2005.01.19 11:11:10.000	0x20
C:\Documents and Settings\User\Local Settings\Temp\IXP000.TMP\Wait.ani	111824	2005.01.19 07:17:40.000	2005.01.19 07:17:40.000	2005.01.19 07:17:40.000	0x20

• Files Changed
• Files Deleted
• Directories Hidden
• Files Hidden

Name	Size	Last Write Time	Creation Time	Last Access Time	Attr
C:\WINDOWS\inf\oem0.inf	0	2009.01.12 14:48:12.125	2009.01.12 14:48:12.125	2009.01.12 14:48:12.125	0x20

• Drivers Loaded
• Drivers Unloaded
• Processes Created
• Processes Terminated
• Threads Created

PId	Process Name	TId	Start	Start Mem	Win32 Start	Win32 Start Mem
0x344	svchost.exe	0x170	0x7c810856	MEM_IMAGE	0x7c910760	MEM_IMAGE

• Modules Loaded
• Windows Api Calls
• DNS Queries
• HTTP Queries
• Verdict
[table][tr][td]Auto Analysis Verdict[/td][/tr][tr=#ffbfbf][td]Rated as Suspicious

显示全部楼层 · 发表于 2009-1-14 16:23:51

红色为可疑行为。

显示全部楼层 · 发表于 2009-1-14 16:55:38

这行为算什么？

显示全部楼层 · 发表于 2009-1-14 16:56:32

让我说就是干净的。。。。。解压后看谁还报

[误报文件] 误报还是毒？

本帖子中包含更多资源

Comodo Instant Malware Analysis

回复 7楼星之梦的帖子

回复 9楼星之梦的帖子

[误报文件] 误报还是毒？

本帖子中包含更多资源

Comodo Instant Malware Analysis

回复 7楼 星之梦 的帖子

回复 9楼 星之梦 的帖子

回复 7楼星之梦的帖子

回复 9楼星之梦的帖子