过了nod32和蜘蛛

显示全部楼层 · 发表于 2007-3-22 16:21:41

22222222

显示全部楼层 · 发表于 2007-3-22 16:25:47

Begin scan in 'C:\Documents and Settings\IBM\桌面\2.rar'
C:\Documents and Settings\IBM\桌面\2.rar
  [0] Archive type: RAR
  --> WDD\WDD.EXE
   [DETECTION] Contains suspicious code HEUR/Crypted
   [INFO]    The file was moved to '46743da2.qua'!

End of the scan: 2007年3月22日星期四  16:25
Used time: 00:11 min

The scan has been done completely.

   0 Scanning directories
   3 Files were scanned
   1 viruses and/or unwanted programs were found
   0 files were deleted
   0 files were repaired
   1 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-3-22 16:25:53

-----------------------------SCAN REPORT-----------------------------
F-PROT Antivirus for Windows

Antivirus Scanning Engine version number: 4.3.1
Virus signature file from: 2007-3-22, 3:55

Scan name: [Custom Scan]
Path to scan: C:\Documents and Settings\Administrator\桌面\2.rar

Normal scan
Also scan: Inside subfolders, Compressed files, Streams

Scan started: 2007-3-22, 16:26:13
---------------------------------------------------------------------

[Found virus] <W32/Vampiro.7017 (not disinfectable)> C:\Documents and Settings\Administrator\桌面\2.rar->WDD\WDD.EXE->(NSPack)->(PE_Patch)
[Contains infected objects] C:\Documents and Settings\Administrator\桌面\2.rar
[Quarantined] C:\Documents and Settings\Administrator\桌面\2.rar->WDD\WDD.EXE->(NSPack)->(PE_Patch)

---------------------------------------------------------------------
Scan ended: 2007-3-22, 16:26:16
Duration: 0:00:03

Scan result:

Scanned files:    1
Infected objects:    1
Disinfected objects:    0
Quarantined files:    1
---------------------------------------------------------------------

显示全部楼层 · 发表于 2007-3-22 16:26:24

竟然当壳处理了。。。。。

显示全部楼层 · 发表于 2007-3-22 16:29:15

这个不太好判断是不是可以运行，因为只有注入内存的行为。。
开始讨厌nspack了，什么时候雨伞修复呀

[ 本帖最后由 mofunzone 于 2007-3-22 00:30 编辑 ]

显示全部楼层 · 发表于 2007-3-22 16:36:15

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-3-18
Start time: 2007-3-22 16:29
Engine(s): KAV engine (AVK 17.3377), BD-Engine (BD 17.2421)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: WDD WDD.EXE
In archive: C:\Documents and Settings\Administrator\桌面\2.rar
Status: Virus detected
Virus: Virus.Win32.Vampiro.b (KAV engine)
Object: WDD\WDD.EXE
In archive: C:\Documents and Settings\Administrator\桌面\2.rar
Status: Virus detected
Virus: BehavesLike:Win32.FileInfector (BD-Engine)
Object: 2.rar
Path: C:\Documents and Settings\Administrator\桌面
Status: Move file into quarantine
Virus: Virus.Win32.Vampiro.b (KAV engine), BehavesLike:Win32.FileInfector (BD-Engine)
Analysis complete: 2007-3-22 16:29
1 files checked
1 infected files detected
0 suspected files detected

显示全部楼层 · 发表于 2007-3-22 16:45:23

过不了Cyberhawk

显示全部楼层 · 发表于 2007-3-22 16:48:18

Threat Expert的分析不是很可靠的，虽然会报process creation，可是那个进程到底想干什么很多时候都查不出来

显示全部楼层 · 发表于 2007-3-22 17:54:50

卡巴杀一个

显示全部楼层 · 发表于 2007-3-22 18:03:29

MCAFEE

[病毒样本] 过了nod32和蜘蛛

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

回复 #5 mofunzone 的帖子

本帖子中包含更多资源