360safe说是木马

鱼是一只我

360safe说是木马
驱逐舰 红伞 nod都没有报

The EQs

Service load:	0%       100%
File:	111.rar
Status:	OK
MD5	cfe141b2fa49bdfe65cd6ebe8c797661
Packers detected:	-
Scanner results
Scan taken on 15 Mar 2007 05:14:49 (GMT)
AntiVir	Found nothing
ArcaVir	Found nothing
Avast	Found nothing
AVG Antivirus	Found nothing
BitDefender	Found nothing
ClamAV	Found nothing
Dr.Web	Found nothing
F-Prot Antivirus	Found nothing
F-Secure Anti-Virus	Found nothing
Fortinet	Found nothing
Kaspersky Anti-Virus	Found nothing
NOD32	Found nothing
Norman Virus Control	Found nothing
Panda Antivirus	Found nothing
VirusBuster	Found nothing
VBA32	Found nothing

kp2006

金山报

zzh161

费尔报，估计是个国产的

allenhippo

以下转贴 http://www.viyazone.cn/read.php?791

早晨群里的朋友截图求助:msup6.exe是什么东东.我看了一下很眼熟,接着就查看了我的病毒样本文件夹,果然有这个病毒[图1]看日期是07-03-05发现的,文件信息如下
File: msup6.exe
Size: 36864 bytes
Modified: 2007年3月5日, 18:00:16
MD5: 552581B8C57CA2269A144402A5FEF2F1
SHA1: B8728B174438032E52BAE9E116661F873D311150
CRC32: 1C1DA5B5
目前只有瑞星报Trojan.MNLess.cx,微点报Trojan.Win32.Delf.acn,其他的暂时没报,该病毒有如下特征:生成自身在%system32%下只要它存在QQ第一次登录就退出,以后均正常,还会结束一些其他的程序如theworld等.该程序用C++6.0编写,未加壳,通过简单反编译得出如下字符[图2],baidu搜索发现与此病毒的相关信息不是很多,但是根据网友和群里这位朋友的反映都是和快乐无极的某些软件有关,比如windows**大师和快乐无极电影网站里面下载的专业播放器有关(我没有拿到他说的软件也没去测试网站,只是推测而已)总之建议大家自己小心.
处理办法:结束进程,直接删除即可

绅博周幸

Thank you for your submission. Below you can see the current status of the uploaded files.


--------------------------------------------------------------------------------


We received the following archive files:



File ID  Filename  Size (Byte) Result
223574  111.rar 14.769 OK

A listing of files contained inside archives alongside their results can be found below:

File ID  Filename  Size (Byte) Result
198133  msup6.exe  36.864  FALSE POSITIVE


Please find a detailed report concerning each individual sample below:

Filename Result
msup6.exe  FALSE POSITIVE

The file 'msup6.exe' has been determined to be 'FALSE POSITIVE'. In particular this means that this file is not malicious but a false alarm. Detection is removed from our virus definition file (VDF) with the version: 6.37.00.232.


--------------------------------------------------------------------------------
Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.

xxl

例子：
今天偶然发现我的电脑C:\Program Files\Common Files里又多了一个cpush的文件夹，不过里面没有东西。我又查了一下注册表，还好，没被安装。

当时删了卡巴换成微点就是因为只要用到IE内核上网，就会中一些流氓插件。而且每次都是这个cpush，还有一个叫什么ad1322.exe好像（用卡巴斯基杀毒可以杀出来，但是防不住）。

不过微点的优势还是显出来了，这东西虽然建了一个文件夹，但是应该没有安装成功（以前用卡巴斯基的时候会写进注册表cpush项）。但是我觉得还不完美。

我用的是规则包5，希望微点越来越好！

cpush
是搜狗广告软件

绅博周幸

全部都是误报误杀，红伞早就排除了

Dear Sir or Madam,

Thank you for your email to Avira's virus lab.
Tracking number: INC00017544.




We received the following archive files:


File ID  Filename  Size (Byte) Result
223574  111.rar 14.769 OK

A listing of files contained inside archives alongside their results can be found below:

File ID  Filename  Size (Byte) Result
198133  msup6.exe  36.864  FALSE POSITIVE


Please find a detailed report concerning each individual sample below:

Filename Result
msup6.exe  FALSE POSITIVE

The file 'msup6.exe' has been determined to be 'FALSE POSITIVE'. In particular this means that this file is not malicious but a false alarm. Detection is removed from our virus definition file (VDF) with the version: 6.37.00.232.


现在红伞都38.57版本了，它在37.232版本就排除了，貌似是1个月前的事了

hsjj2005

这玩意前段时间中过  不知道会不会是飘云版QQ生成的