同样的样本，怎么NOD32扫描结果与大蜘蛛扫描结果大不相同？

显示全部楼层 · 发表于 2009-4-4 12:13:33

特别警惕，这些都是未知或者己知病毒样本，除非你确保有足够的防御系统，否则请不以机试毒,本人不承担任何责任,后果自负，也并不代表这是一个新生的病毒、木马或者恶意软件。多引擎在线病毒扫描里也只有多个杀毒软件报毒,因为这可能是某一款杀毒引擎的错误报警,敬请您自己判断分辩。

显示全部楼层 · 发表于 2009-4-4 12:16:35

Starting the file scan:

Begin scan in 'D:\kafan\kafan'
D:\kafan\kafan\promo.exe
[DETECTION] Is the TR/Dldr.FraudLoad.dvf Trojan
[NOTE]    A backup was created as '4a45dff1.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
D:\kafan\kafan\setup.exe
--> Object
   [DETECTION] Contains recognition pattern of the WORM/Koobface.EZ worm
[NOTE]    A backup was created as '4a4adfe4.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
D:\kafan\kafan\tops.exe
[DETECTION] Is the TR/Proxy.GBR Trojan
[NOTE]    A backup was created as '4a46dfee.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
D:\kafan\kafan\yiq.exe
  [0] Archive type: NSIS
[DETECTION] Contains recognition pattern of the DR/Agent.GUT dropper
--> [ProgramFilesDir]/AD4All/Install.exe
   [DETECTION] Contains recognition pattern of the ADSPY/Ourxin adware or spyware
[NOTE]    A backup was created as '4a47dfe9.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
D:\kafan\kafan\yqu.exe
  [0] Archive type: RAR SFX (self extracting)
[DETECTION] Contains recognition pattern of the DR/Agent.GUS dropper
--> yiq.exe
   [DETECTION] Contains recognition pattern of the DR/Agent.GUT dropper
   --> [ProgramFilesDir]/AD4All/Install.exe
      [DETECTION] Contains recognition pattern of the ADSPY/Ourxin adware or spyware
[NOTE]    A backup was created as '4a4bdff2.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
D:\kafan\kafan\3x.exe
  [0] Archive type: NSIS
[DETECTION] Is the TR/TDss.tbt Trojan
--> ProgramFilesDir/HDExtrem.exe
   [DETECTION] Is the TR/Dldr.Agent.tvq Trojan
[NOTE]    A backup was created as '4a04dff9.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
D:\kafan\kafan\file.exe
[DETECTION] Is the TR/Proxy.Small.ZZ Trojan
[NOTE]    A backup was created as '4a42dfea.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
D:\kafan\kafan\fv.exe
[DETECTION] Contains recognition pattern of the WORM/Autorun.abqo worm
[NOTE]    A backup was created as '4a04dff7.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
D:\kafan\kafan\install0.exe
[DETECTION] Is the TR/Dropper.Gen Trojan
[NOTE]    A backup was created as '4a49dfef.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
D:\kafan\kafan\InstallAVg_880293.exe
[DETECTION] Is the TR/FakeXPA.A.215 Trojan
[NOTE]    A backup was created as '4b33d7a8.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
D:\kafan\kafan\load.exe
[DETECTION] Is the TR/Dropper.Gen Trojan
[NOTE]    A backup was created as '4a37dff1.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
D:\kafan\kafan\load2.exe
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE]    A backup was created as '4b4dd7aa.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

End of the scan: 2009年4月4日  12:18
Used time: 00:03 Minute(s)

The scan has been done completely.

   1 Scanned directories
   30 Files were scanned
   16 Viruses and/or unwanted programs were found
   0 Files were classified as suspicious
   12 files were deleted
   0 Viruses and unwanted programs were repaired
   12 Files were moved to quarantine
   0 Files were renamed
   0 Files cannot be scanned
   14 Files not concerned
   4 Archives were scanned
   0 Warnings
   12 Notes

显示全部楼层 · 发表于 2009-4-4 12:18:33

上报6个到金山

显示全部楼层 · 发表于 2009-4-4 13:18:01

谢谢楼主分享

显示全部楼层 · 发表于 2009-4-4 14:47:50

AVK9个

显示全部楼层 · 发表于 2009-4-4 16:30:45

EAV六个红伞杀出13个

显示全部楼层 · 发表于 2009-4-4 17:34:32

文件或对象名称病毒名称最终处理状态
E:\My Documents\桌面\test\12个样本\load.exe Backdoor.Generic.158408 已移动至隔离区
E:\My Documents\桌面\test\12个样本\file.exe DeepScan:Generic.Malware.SFYddldg.9558E950 已移动至隔离区
E:\My Documents\桌面\test\12个样本\yiq.exe Dropped:Application.Generic.9 已移动至隔离区
E:\My Documents\桌面\test\12个样本\yqu.exe Dropped:Application.Generic.9 已移动至隔离区
E:\My Documents\桌面\test\12个样本\3x.exe Dropped:Trojan.TDss.DP 已移动至隔离区
E:\My Documents\桌面\test\12个样本\load2.exe Rootkit.16381 已移动至隔离区
E:\My Documents\桌面\test\12个样本\promo.exe Trojan.FakeAlert.AZL 已移动至隔离区
E:\My Documents\桌面\test\12个样本\install0.exe Trojan.Generic.1549874 已移动至隔离区
E:\My Documents\桌面\test\12个样本\setup.exe Win32.Worm.Koobface.AR 已移动至隔离区
E:\My Documents\桌面\test\12个样本\fv.exe Worm.Generic.48274 已移动至隔离区

显示全部楼层 · 发表于 2009-4-4 17:36:14

2009/4/4 17:35:12 已清除病毒 Net-Worm.Win32.Koobface.fc G:\Temp\Virus\12个样本.rar/12个样本\setup.exe//PE_Patch.UPX//UPX
2009/4/4 17:35:12 已清除病毒 Worm.Win32.AutoRun.abqo G:\Temp\Virus\12个样本.rar/12个样本\fv.exe
2009/4/4 17:35:12 已清除木马程序 Backdoor.Win32.Frauder.asm G:\Temp\Virus\12个样本.rar/12个样本\load.exe
2009/4/4 17:35:12 已清除木马程序 Packed.Win32.Klone.bl G:\Temp\Virus\12个样本.rar/12个样本\tops.exe
2009/4/4 17:35:12 已清除木马程序 Trojan-Downloader.Win32.FraudLoad.dtv G:\Temp\Virus\12个样本.rar/12个样本\install0.exe
2009/4/4 17:35:12 已清除木马程序 Trojan-Downloader.Win32.FraudLoad.dwk G:\Temp\Virus\12个样本.rar/12个样本\InstallAVg_880293.exe
2009/4/4 17:35:12 已清除木马程序 Trojan-Proxy.Win32.Small.zz G:\Temp\Virus\12个样本.rar/12个样本\file.exe
2009/4/4 17:35:12 已清除木马程序 Trojan.Win32.Agent.bvvx G:\Temp\Virus\12个样本.rar/12个样本\load2.exe
2009/4/4 17:35:12 已清除木马程序 Trojan.Win32.Subster.k G:\Temp\Virus\12个样本.rar/12个样本\promo.exe
2009/4/4 17:35:12 已清除木马程序 Trojan.Win32.TDSS.tbt G:\Temp\Virus\12个样本.rar/12个样本\3x.exe

Miss 2,To KL

显示全部楼层 · 发表于 2009-4-4 19:58:42

nod32扫描结果是红叉.一般不太相信nod32的能力

显示全部楼层 · 发表于 2009-4-4 22:44:17

eav12个

[病毒样本] 同样的样本，怎么NOD32扫描结果与大蜘蛛扫描结果大不相同？

本帖子中包含更多资源

BD 10个