一个

显示全部楼层 · 发表于 2007-5-27 14:24:03

呵呵

显示全部楼层 · 发表于 2007-5-27 14:25:43

antivir dr.web挂
只有nod杀了一个
扫描日志
NOD32版本 2291 (20070525) NT
命令行： C:\Documents and Settings\morgan\My Documents\00. ?
?rar
正在检查NOD32.EXE文件的CRC：状态正常
D:\Eset\nod32.exe - 是正常的
扫描系统内存中：没有进行 (选项已关闭)
扫描MBR及引导区中：没有进行 (选项已关闭)
日期： 26.5.2007  时间：23:25:22
已关闭反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\ ?
?morgan\My Documents\00.rar
C:\Documents and Settings\morgan\My Documents\00.rar  ?
?>>RAR >>SVCHOST.EXE - 未查明的 NewHeur_PE 病毒 [7]
C:\Documents and Settings\morgan\My Documents\00.rar  ?
?>>RAR >>vbZLibAPI.dll >>UPX v12_m2_dll - 是正常的
C:\Documents and Settings\morgan\My Documents\00.rar  ?
?>>RAR >>COMCTL32.ocx - 是正常的
C:\Documents and Settings\morgan\My Documents\00.rar  ?
?>>RAR >>vbZLib1.dll >>UPX v12_m2_dll - 是正常的
已扫描的文件数目：5
已发现的病毒数目：1
活动的病毒数目：1
完成时间： 23:25:25 总扫描时间：3 秒 (00:00:03)
注意：
[7] 该文件可能感染上未知病毒。

显示全部楼层 · 发表于 2007-5-27 14:25:57

C:\Documents and Settings\moonsilver\桌面\00.rar>
>SVCHOST.EXE

Worm.VB.ane

显示全部楼层 · 发表于 2007-5-27 14:26:38

不过运行后没什么行为。。
上报看看。。

显示全部楼层 · 发表于 2007-5-27 14:27:30

直接分析出malware
Thank you for your submission. Below you can see the current status of the uploaded files.

We received the following archive files:
File ID    Filename    Size (Byte) Result
556358    00.rar 397.44 KB OK

A listing of files contained inside archives alongside their results can be found below:
File ID    Filename    Size (Byte) Result
552840    SVCHOST.EXE    32 KB    MALWARE
554669    vbZLibAPI.dll    7 KB    CLEAN
554670    COMCTL32.ocx    467.5 KB    CLEAN
554668    vbZLib1.dll    34.5 KB    CLEAN

Please find a detailed report concerning each individual sample below:
Filename Result
SVCHOST.EXE    MALWARE

The file 'SVCHOST.EXE' has been determined to be 'MALWARE'. Our analysts discovered that the file is a Trojan. In general this kind of programs contains harmful functionality called payload. Detection will be added to our virus definition file (VDF) with one of the next updates.
Filename Result
vbZLibAPI.dll    CLEAN

The file 'vbZLibAPI.dll' has been determined to be 'CLEAN'.
Filename Result
COMCTL32.ocx    CLEAN

The file 'COMCTL32.ocx' has been determined to be 'CLEAN'.
Filename Result
vbZLib1.dll    CLEAN

The file 'vbZLib1.dll' has been determined to be 'CLEAN'.
Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.

显示全部楼层 · 发表于 2007-5-27 14:28:30

KV报

显示全部楼层 · 发表于 2007-5-27 14:29:53

费尔报病毒

显示全部楼层 · 发表于 2007-5-27 14:31:14

detected: virus Virus.Win32.AutoRun.x URL: http://bbs.kafan.cn/attachment.php?aid=76685//SVCHOST.EXE

显示全部楼层 · 发表于 2007-5-27 14:33:37

KIS 7
已经删除: 病毒 Virus.Win32.AutoRun.x 文件: D:\Downloads\00.rar/SVCHOST.EXE

显示全部楼层 · 发表于 2007-5-27 14:34:06

驅逐艦miss

[病毒样本] 一个

本帖子中包含更多资源

本帖子中包含更多资源