一度讓我以為誤報的trojan-過很多

显示全部楼层 · 发表于 2007-5-13 13:57:58

virustotal-
notepad.exe有
F-Secure       6.70.13030.0       05.11.2007       W32/QQPass.BIH
Ikarus       T3.1.1.7       05.13.2007       Trojan-Dropper.Win32.Microjoin.R
McAfee       5029       05.11.2007       New Win32
NOD32v2       2262       05.12.2007       Win32/PSW.QQPass.NAQ
Norman       5.80.02       05.11.2007       W32/QQPass.BIH
----------------
rundll32.exe
McAfee       5029       05.11.2007       New Win32
NOD32v2       2262       05.12.2007       Win32/PSW.QQPass.NAQ
應該不是誤報吧?因為過很多....-全部檔下來的只有咖啡與nod32

因為我還有瞞多樣本要處理的...所以請高手鑑定了...

显示全部楼层 · 发表于 2007-5-13 14:00:28

PCC PASS

显示全部楼层 · 发表于 2007-5-13 14:00:37

费尔报
W32/QQ

显示全部楼层 · 发表于 2007-5-13 14:00:46

Thank you for your submission. Below you can see the current status of the uploaded files.

--------------------------------------------------------------------------------

We received the following archive files:

File ID  Filename  Size (Byte) Result
542956  trojan-2.rar 44.34 KB OK

A listing of files contained inside archives alongside their results can be found below:

File ID  Filename  Size (Byte) Result
542957  rundll32.exe  32 KB  UNDER ANALYSIS
542958  notepad.exe  65 KB  UNDER ANALYSIS

Please find a detailed report concerning each individual sample below:

Filename Result
rundll32.exe  UNDER ANALYSIS

The file 'rundll32.exe' has been determined to be 'UNDER ANALYSIS'.

Filename Result
notepad.exe  UNDER ANALYSIS

The file 'notepad.exe' has been determined to be 'UNDER ANALYSIS'.

--------------------------------------------------------------------------------
Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.

显示全部楼层 · 发表于 2007-5-13 14:00:49

Symantec不报

显示全部楼层 · 发表于 2007-5-13 14:01:40

卡吧不报

显示全部楼层 · 发表于 2007-5-13 14:22:57

C:\Documents and Settings\moonsilver\桌面\trojan-
2.rar>>rundll32.exe

C:\Documents and Settings\moonsilver\桌面\trojan-
2.rar>>notepad.exe

Worm.QQ.TopFox.bz

rising

瑞星报顶狐QQ蠕虫

[ 本帖最后由 moonsilver 于 2007-5-13 14:24 编辑 ]

显示全部楼层 · 发表于 2007-5-13 14:36:14

运行了里面的二个文件都没动做(我没有QQ的)
2007-05-13 14:29:31 运行应用程序
操作:允许
进程路径:D:\windows\Explorer.EXE
文件路径:D:\Documents and Settings\dell\桌面\notepad.exe

2007-05-13 14:31:16 运行应用程序
操作:允许
进程路径:D:\windows\Explorer.EXE
文件路径:D:\Documents and Settings\dell\桌面\rundll32.exe

[ 本帖最后由 scottxzt 于 2007-5-13 14:37 编辑 ]

显示全部楼层 · 发表于 2007-5-13 14:39:53

晕，都是微软自己的东西

显示全部楼层 · 发表于 2007-5-13 14:45:06

那種東西是可以偽造的~

在我的xp上正常的那兩個檔案並沒有被警報的

所以我才會懷疑這個檔案的

[ 本帖最后由黑衣~魂于 2007-5-13 14:54 编辑 ]

[病毒样本] 一度讓我以為誤報的trojan-過很多

本帖子中包含更多资源

本帖子中包含更多资源

回复 #9 wangjay1980 的帖子