测测

Nblock

[:27:]运行看看

[ 本帖最后由 Nblock 于 2007-4-26 13:08 编辑 ]

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\bind_50287.rar'
C:\Documents and Settings\morgan\My Documents\
  bind_50287.rar
    [0] Archive type: RAR
    --> bind_50287.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!

mofunzone

世界最强启发又需要上报支持了
File:         bind_50287.rar
Status:         POSSIBLY INFECTED/MALWARE (Note: this file was only classified as malware by scanners known to generate more false positives than the average scanner. Do not consider these results definately accurate. Also, because of this, results of this scan will not be recorded in the database.)
MD5         ed25b1da1d84bc8a7a5795013f2a5e90
Packers detected:         -

Scanner results
Scan taken on 26 Apr 2007 05:05:09 (GMT)
A-Squared         Found nothing
AntiVir         Found HEUR/Malware
ArcaVir         Found nothing
Avast         Found Win32:QQHelper-BL
AVG Antivirus         Found nothing
BitDefender         Found nothing
ClamAV         Found nothing
Dr.Web         Found nothing
F-Prot Antivirus         Found nothing
F-Secure Anti-Virus         Found nothing
Fortinet         Found nothing
Kaspersky Anti-Virus         Found nothing
NOD32         Found nothing
Norman Virus Control         Found nothing
Panda Antivirus         Found nothing
Rising Antivirus         Found nothing
VirusBuster         Found nothing
VBA32         Found nothing

小邪邪

现在发展到真报或误报都搞不清楚了

mofunzone

原帖由 小邪邪 于 2007-4-25 21:13 发表
现在发展到真报或误报都搞不清楚了

自己运行一下不就知道了
被decompress之后antivir就已知，原文件发上来
不过avast同学还真是怪
File:         barsetup[1].rar
Status:         POSSIBLY INFECTED/MALWARE (Note: this file was only classified as malware by scanners known to generate more false positives than the average scanner. Do not consider these results definately accurate. Also, because of this, results of this scan will not be recorded in the database.)
MD5         259117660a66bc11c2c07edca144ca85
Packers detected:         PE_PATCH

Scanner results
Scan taken on 26 Apr 2007 05:17:35 (GMT)
A-Squared         Found nothing
AntiVir         Found TR/Dldr.QQhelper.DB
ArcaVir         Found nothing
Avast         Found nothing
AVG Antivirus         Found nothing
BitDefender         Found Trojan.Muldrop.BX
ClamAV         Found nothing
Dr.Web         Found nothing
F-Prot Antivirus         Found nothing
F-Secure Anti-Virus         Found nothing
Fortinet         Found nothing
Kaspersky Anti-Virus         Found nothing
NOD32         Found nothing
Norman Virus Control         Found nothing
Panda Antivirus         Found nothing
Rising Antivirus         Found nothing
VirusBuster         Found nothing
VBA32         Found nothing

promised

原帖由 mofunzone 于 2007-4-26 13:21 发表

自己运行一下不就知道了
被decompress之后antivir就已知，原文件发上来
不过avast同学还真是怪
File:         barsetup[1].rar
Status:         POSSIBLY INFECTED/MALWARE (Note: this file was only classifi ...

对你的脱壳水平无语
给你脱死了
脱壳还是老老实实用OD之类的去

mofunzone

原帖由 promised 于 2007-4-25 21:26 发表

对你的脱壳水平无语
给你脱死了
脱壳还是老老实实用OD之类的去

抱歉不是我脱了，运行之后那东西自己脱的

蓝色牛仔裤

第一步就想写注册表!??
实机操作, 贴一张算了,意思意思...

pc9x

释放出了一个temp.exe

蓝色牛仔裤

禁写了注册表之后就over了, 没见任何动作..
等待完整一点的行为分析..