NOD 32屏蔽的压缩包。。。

显示全部楼层 · 发表于 2007-4-19 16:03:20

卡巴7不是有启发的吗??

显示全部楼层 · 发表于 2007-4-19 16:12:01

因为病毒库，没启发还是什么的，卡巴竟全部没报？？

[bind_50025.exe]
BD标准引擎 |  DeepScan:Generic.Dld.ADL.C17B5754

[jubao149.exe]
大蜘蛛BETA引擎|  Trojan.Click.2217

[dodolook078.exe]
[PlugQuery1039.exe]

[hy1001.exe]
大蜘蛛BETA引擎|  Trojan.DownLoader.origin
NOD32标准引擎|  未查明的 NewHeur_PE 病毒 [7]
BD标准引擎 |  Trojan.Downloader.AVE

[340.exe]
大蜘蛛BETA引擎|  Trojan.Click.origin packed by BINARYRES

[41701.exe]
大蜘蛛BETA引擎|  Trojan.Popwin.origin
NOD32标准引擎|  可能是Win32/Agent.NEO 木马的变形版本。
BD标准引擎 |  Trojan.Popwin.AJ

[57111.exe]
大蜘蛛BETA引擎|  Trojan.Popwin.origin
NOD32标准引擎|  可能是Win32/Agent.NEO 木马的变形版本。
BD标准引擎 |  Trojan.Popwin.AJ

显示全部楼层 · 发表于 2007-4-19 17:32:52

卡巴7.0报2个启发
quarantined: virus Downloader (modification) File: C:\Documents and Settings\NICE\桌面\92sky_0312.rar/92sky_0312.exe//data.rar/bind_50025.exe
quarantined: virus Downloader (modification) File: C:\Documents and Settings\NICE\桌面\92sky_0312.rar/92sky_0312.exe//data.rar/hy1001.exe//PEPatch

显示全部楼层 · 发表于 2007-4-19 17:38:24

红伞报6个

Starting the file scan:

Begin scan in 'C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\92sky_0312.rar'
C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\92sky_0312.rar
  [0] Archive type: RAR
--> 92sky_0312.exe
   [1] Archive type: RAR SFX (self extracting)
   --> bind_50025.exe
      [DETECTION] Contains suspicious code HEUR/Malware
   --> jubao149.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
   --> hy1001.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
   --> 340.exe
      [DETECTION] Contains suspicious code HEUR/Malware
   --> 41701.exe
      [DETECTION] Is the Trojan horse TR/Popwin.AJ
   --> 57111.exe
      [DETECTION] Is the Trojan horse TR/Popwin.AJ
   [INFO]    The file was moved to '469a388a.qua'!

End of the scan: 2007年4月19日  21:37
Used time: 00:04 min

The scan has been done completely.

   0 Scanning directories
   10 Files were scanned
   6 viruses and/or unwanted programs were found
   2 classified as suspicious:
   0 files were deleted
   0 files were repaired
   1 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   2 Archives were scanned
   0 Warnings
   0 Notes
   0 Hidden objects were found

显示全部楼层 · 发表于 2007-4-19 23:12:17

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\92sky_0312.rar'
C:\Documents and Settings\morgan\My Documents\
  92sky_0312.rar
[0] Archive type: RAR
--> 92sky_0312.exe
      [1] Archive type: RAR SFX (self extracting)
      --> bind_50025.exe
         [DETECTION] Is the Trojan horse TR/Agent.20480.57
         [WARNING] Infected files in archives cannot be repaired!
      --> jubao149.exe
         [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
         [WARNING] Infected files in archives cannot be repaired!
      --> dodolook078.exe
      --> hy1001.exe
         [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
         [WARNING] Infected files in archives cannot be repaired!
      --> PlugQuery1039.exe
      --> 340.exe
         [DETECTION] Contains suspicious code HEUR/Malware
         [WARNING] Infected files in archives cannot be repaired!
      --> 41701.exe
         [DETECTION] Is the Trojan horse TR/Popwin.AJ
         [WARNING] Infected files in archives cannot be repaired!
      --> 57111.exe
         [DETECTION] Is the Trojan horse TR/Popwin.AJ
         [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-4-19 23:14:01

玩主动防御最怕就是看见病毒包了

显示全部楼层 · 发表于 2007-4-20 03:15:26

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\92sky_0312.rar'
C:\Documents and Settings\Administrator\桌面\92sky_0312.rar
  [0] Archive type: RAR
--> 92sky_0312.exe
   [1] Archive type: RAR SFX (self extracting)
   --> bind_50025.exe
      [DETECTION] Is the Trojan horse TR/Agent.20480.57
   --> jubao149.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
   --> hy1001.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
   --> 340.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Banload.ckm
   --> 41701.exe
      [DETECTION] Is the Trojan horse TR/Popwin.AJ
   --> 57111.exe
      [DETECTION] Is the Trojan horse TR/Popwin.AJ
   [INFO]    The file was moved to '469ac04b.qua'!

显示全部楼层 · 发表于 2007-4-20 04:12:11

和14#的一样```

显示全部楼层 · 发表于 2007-4-20 09:00:54

费尔的。。。。。。。。。。。

显示全部楼层 · 发表于 2007-4-20 13:27:47

AVS报 8个

[病毒样本] NOD 32屏蔽的压缩包。。。

回复 #10 200530040058 的帖子

本帖子中包含更多资源

本帖子中包含更多资源