杀看

显示全部楼层 · 发表于 2007-4-29 11:09:13

<?xml version="1.0"?>
<UpDate IsHide="True" IsForce="True">
<NewFile>
  <FileName>System.dat</FileName>
  <FileVer>2.85</FileVer>
  <FileSize>1</FileSize>
  <FileUrl>http://software.zbox.com.cn/update/0701/system.dat</FileUrl>
  <FileTime>2006-12-04</FileTime>
  <Operation>update</Operation>
  <OperationParam></OperationParam>
  <SavePath></SavePath>
</NewFile>
<NewFile>
  <FileName>zbox2.exe</FileName>
  <FileVer>2.85</FileVer>
  <FileSize>652</FileSize>
  <FileUrl>http://software.zbox.com.cn/update/0701/zbox2.exe</FileUrl>
  <FileTime>2006-12-04</FileTime>
  <Operation>update</Operation>
  <OperationParam></OperationParam>
  <SavePath></SavePath>
</NewFile>
<NewFile>
  <FileName>zboxdll.dll</FileName>
  <FileVer>2.83</FileVer>
  <FileSize>65</FileSize>
  <FileUrl>http://software.zbox.com.cn/update/0701/zboxdll.dll</FileUrl>
  <FileTime>2006-12-04</FileTime>
  <Operation>update</Operation>
  <OperationParam></OperationParam>
  <SavePath></SavePath>
</NewFile>
<NewFile>
  <FileName>DownloadLib.dll</FileName>
  <FileVer>2.83</FileVer>
  <FileSize>65</FileSize>
  <FileUrl>http://software.zbox.com.cn/update/0701/DownloadLib.dll</FileUrl>
  <FileTime>2007-03-27</FileTime>
  <Operation>update</Operation>
  <OperationParam></OperationParam>
  <SavePath></SavePath>
</NewFile>
<NewFile>
  <FileName>upstate.exe</FileName>
  <FileVer>2.82</FileVer>
  <FileSize>192</FileSize>
  <FileUrl>http://software.zbox.com.cn/update/0701/upstate.exe</FileUrl>
  <FileTime>2006-12-04</FileTime>
  <Operation>add</Operation>
  <OperationParam></OperationParam>
  <SavePath></SavePath>
</NewFile>
<NewFile>
  <FileName>IssueDown.dll</FileName>
  <FileVer>2.81</FileVer>
  <FileSize>38</FileSize>
  <FileUrl>http://software.zbox.com.cn/update/0701/IssueDown.dll</FileUrl>
  <FileTime>2006-12-04</FileTime>
  <Operation>reg</Operation>
  <OperationParam></OperationParam>
  <SavePath></SavePath>
</NewFile>
<NewFile>
  <FileName>clientStat.dll</FileName>
  <FileVer>2.81</FileVer>
  <FileSize>46</FileSize>
  <FileUrl>http://software.zbox.com.cn/update/0701/clientStat.dll</FileUrl>
  <FileTime>2006-12-04</FileTime>
  <Operation>update</Operation>
  <OperationParam></OperationParam>
  <SavePath></SavePath>
</NewFile>
</UpDate>

显示全部楼层 · 发表于 2007-4-29 11:10:09

显示全部楼层 · 发表于 2007-4-29 11:11:25

Begin scan in 'D:\Documents and Settings\dell\桌面\DownloadLib.rar'
D:\Documents and Settings\dell\桌面\DownloadLib.rar
  [0] Archive type: RAR
  --> DownloadLib.dll
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-4-29 11:13:51

Begin scan in 'D:\Documents and Settings\dell\桌面\insshell.rar'
D:\Documents and Settings\dell\桌面\insshell.rar
  [0] Archive type: RAR
  --> insshell.exe
   [DETECTION] Contains signature of the Ad- or Spyware ADSPY/Boran.XSS.2
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-4-29 11:34:39

Adware.Boran.xssf......................

显示全部楼层 · 发表于 2007-4-29 12:42:08

卡巴7只扫到一个，另一个上报去

deleted: adware not-a-virus:AdWare.Win32.Boran.z File: C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\insshell.rar/insshell.exe

显示全部楼层 · 发表于 2007-4-29 12:46:41

McAfee 已自動封鎖潛在無用程式，防止該程式在您的電腦上執行。

詳細資料
名稱: Adware-Boran.gen

檔案路徑: C:\Documents and Settings\all.HOME-.\桌面\insshell.exe

显示全部楼层 · 发表于 2007-4-29 13:41:57

We received the following archive files:

File ID  Filename  Size (Byte) Result
530134  DownloadLib.rar 39.29 KB OK

A listing of files contained inside archives alongside their results can be found below:

File ID  Filename  Size (Byte) Result
274965  DownloadLib.dll  48 KB  FALSE POSITIVE

Please find a detailed report concerning each individual sample below:

Filename Result
DownloadLib.dll  FALSE POSITIVE

The file 'DownloadLib.dll' has been determined to be 'FALSE POSITIVE'. Detection will be removed from our virus definition file (VDF) with one of the next updates.

--------------------------------------------------------------------------------
Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.

显示全部楼层 · 发表于 2007-4-29 16:21:14

一个dll，一个是流氓来着

显示全部楼层 · 发表于 2007-4-29 16:24:07

你的头像太可爱了

[病毒样本] 杀看

本帖子中包含更多资源

c

本帖子中包含更多资源

回复 #6 KAV-Longhorn 的帖子