虚拟机实测，NIS2009在OPDA格盘门样本前倒下了/同寻英文好人士联系Symantec反映

冲冲

原帖由 chinajl 于 2009-8-7 11:31 发表


不以毒小而不报，不以毒少见而疏忽。了解一下OPDA的小白，多少人中标了，损失了多少数据？！

样本的行为是恶劣的，结果是严重的。不能因为其技术含量低而不屑一顾

我的意思不是不该重视，这个问题是不小的，我是在说样本本身，这种行为的毒应该是十多年前的潮流吧，不太清楚历史，那时候我还在学胎教

272513421

好牛叉的病毒

灵魂能力

。。。好高深啊

星夜孤独

我已经通过NIS的隔离区上报了，也在网页里上报了，看看网页上报的回信是什么样的吧

gzy_hao

已经通过NCW上报
如果用的是2009，最好别用NCW上报

星夜孤独

完了。。铁壳不认为这个是病毒。。。
以下是邮件回复全文。。。。


This message is an automatically generated reply.  This system is designed to analyze and process virus submissions into the Symantec Security Response and cannot accept correspondence or inquiries.
Please contact your Technical Support representative if more detailed
information about your submission is required.  Do not reply to this
message.

Below is a status update on your virus submission:

Date: August 7, 2009

li
nc
   


Dear li,

We have analyzed your submission.  The following is a report of our
findings for each file you have submitted:

filename:  X-plore xx.rar
machine: Machine
result: See the developer notes

filename: X-plorexx.exe
machine: Machine
result: See the developer notes

Customer notes:



Developer notes:
X-plore xx.rar is a container file of type  RAR
X-plorexx.exe Our automation was unable to identify any malicious content in this submission.
The file will be stored for further human analysis  This file is contained by   X-plore xx.rar




Should you have any questions about your submission, please contact
your regional technical support from the Symantec website and give them
the tracking number in the subject of this message.

-----------------------------------------------------------------------
This message was generated by Symantec Security Response automation.

For USA:
For electronic support options, Symantec provides On-Line Services at
http://www.symantec.com/techsupp/


--------------------------------------------

wangqd

铁壳也完蛋了？？？

冲冲

这个邮件的意思貌似是说需要提交人工分析

gzy_hao

无限期等待
我还是看看NCW吧

eva90

已经提交给ESET分析了。太狠毒了，直接不提示就格式化硬盘。而且哪个正常软件会在WINDOWS视窗下面进行格式化硬盘的操作呢？？明显就是病毒！