我把让nis2011睡着、神器NPE倒下、小A残废、360连尸骨都找不着的样本提取了(已解决）

jayavira

ess kill1个，另一个不是病毒啊

2010-10-24 13:52:10        文件系统实时防护        文件        D:\下载文件夹\SysLive.exe        可能是 Win32/AutoRun.Delf.EP 蠕虫 的变种        通过删除清除 - 已隔离        WWW-738C9D7CF42\Administrator        在应用程序新建的文件上发生事件: D:\Program Files\WinRAR\WinRAR.exe.

http://camas.comodo.com/cgi-bin/ ... 9ffc390d357fc85e6d6

aaa839

We received the following archive files:
File ID         Filename        Size (Byte)        Result
25927825         virus.rar        119.92 KB        OK


A listing of files contained inside archives alongside their results can be found below:File ID         Filename        Size (Byte)        Result
25927826         CHANGE.LOG         568 Byte         UNDER ANALYSIS
25927827         CHANGE.LOG         460 Byte         UNDER ANALYSIS
25710438         AutoRun.inf         167 Byte         CLEAN
25927828         SysLive.exe         44.69 KB         MALWARE
12900536         INFO2         20 Byte         KNOWN CLEAN
19467257         DESKTOP.INI         65 Byte         KNOWN CLEAN
7958267         install.exe         150.02 KB         KNOWN CLEAN



Please find a detailed report concerning each individual sample below: Filename        Result
CHANGE.LOG         UNDER ANALYSIS


The file 'CHANGE.LOG' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
CHANGE.LOG         UNDER ANALYSIS


The file 'CHANGE.LOG' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
AutoRun.inf         CLEAN


The file 'AutoRun.inf' has been determined to be 'CLEAN'. Our analysts did not discover any malicious content.
Filename        Result
SysLive.exe         MALWARE


The file 'SysLive.exe' has been determined to be 'MALWARE'. Our analysts named the threat Worm/Abuse.AW. The term "WORM/" denotes a worm that is able to spread itself for instance over the Internet (using eMail, peer-to-peer networks, IRC networks etc.).Detection is added to our virus definition file (VDF) starting with version 7.01.06.204. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: TR/Crypt.XPACK.Gen.
Filename        Result
INFO2         KNOWN CLEAN


The file 'INFO2' has been determined to be 'KNOWN CLEAN'. In particular this means that we could not find any malicious content. Please note that the file is part of 'Microsoft Windows XP Mode 1 '.
Filename        Result
DESKTOP.INI         KNOWN CLEAN


The file 'DESKTOP.INI' has been determined to be 'KNOWN CLEAN'. In particular this means that we could not find any malicious content. Please note that the file is part of 'Microsoft Windows XP Mode 1 '.
Filename        Result
install.exe         KNOWN CLEAN


The file 'install.exe' has been determined to be 'KNOWN CLEAN'. In particular this means that we could not find any malicious content. Please note that the file is part of 'Ashampoo ClipFinder HD 0 '.

Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.

pipi1987

1x to avg

xukai3100

360没反应

hansyu

启发，to xandora(panda)

XMonster

360 无压力kill

xiaoyaosanren

老毒了 有图有真相

fatezero

KIS

检测到威胁: Trojan.Win32.AutoRun.ard           AutoRun.inf               
检测到威胁: Worm.Win32.Abuse.aw         SysLive.exe/

s8706042

PC-Cillin 2011: Mal_Otorun1

superkill

mse 发现一个SysLive.exe