样本更新 有了 ess扫描硬盘第一次可疑样本

Giggs

已检测到: 木马程序 Trojan-Downloader.Win32.Delf.bcm        URL: http://bbs.kafan.cn/attachment.p ... xe//PE_Patch//UPack
第一个

The EQs

根据壳的结构来判断的。。。偶不知道AVIRA是怎么判断结构的。。但是偶知道一个小毒/正常文件能通过加壳达到报那个。。。。

Giggs

呵呵
Start of the scan: 2007年6月1日  17:57

Starting the file scan:

Begin scan in 'E:\tnbdi.rar'
E:\tnbdi.rar
  [0] Archive type: RAR
  --> tnbdi.dll
      [DETECTION] Is the Trojan horse TR/Hijack.Ob.241664
      [INFO]      A backup was created as '46c1ede8.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!


End of the scan: 2007年6月1日  17:57
Used time: 00:03 min

The scan has been done completely.

      0 Scanning directories
      2 Files were scanned
      1 viruses and/or unwanted programs were found
      0 classified as suspicious:
      1 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found
第二个

欠妳緈諨

红伞对威金几乎都是那么报的，这么说难道AVAST也是玩的这种花样

The EQs

几乎？？？AVIRA正常的情况下是直接报viking的。。。

foxhound

AVG Anti-Spyware 7.5 Downloader.Delf.bcm : 已清除.

欠妳緈諨

最近几个月威金样本几乎没见红伞报过VIKING,全是报GEN，AVAST也是，全Win32Tibs-ADO!

蓝色牛仔裤

六一节过得不错～蜘蛛喜欢六一？！


[Scan path] C:\Documents and Settings\Administrator\桌面\kv.rar
>>C:\Documents and Settings\Administrator\桌面\kv.rar\kvmonxp32.exe infected with Trojan.MulDrop.6262
>>>>>>C:\Documents and Settings\Administrator\桌面\kv.rar\kvmonxp43.exe\data001 infected with Trojan.DownLoader.origin
>>>C:\Documents and Settings\Administrator\桌面\kv.rar\kvmonxp43.exe\data002 infected with Trojan.DownLoader.21714
>C:\Documents and Settings\Administrator\桌面\kv.rar\kvmonxp43.exe - archive contains infected objects
C:\Documents and Settings\Administrator\桌面\kv.rar - archive contains infected objects

[Scan path] C:\Documents and Settings\Administrator\桌面\tnbdi.rar
>C:\Documents and Settings\Administrator\桌面\tnbdi.rar\tnbdi.dll is an adware program Adware.QQHelp
C:\Documents and Settings\Administrator\桌面\tnbdi.rar - archive contains infected objects

taihuxian

Virus: Trojan-Downloader.Win32.Delf.bcm (2x)

Virus found while downloading Web content.

Address: bbs.kafan.cn
Virus: Trojan-Downloader.Win32.QQHelper.vl

Virus found while downloading Web content.

Address: bbs.kafan.cn

aoyang

看了20楼的回复，感觉AVAST还不错，以后给同事装杀软就这个了，防御不错还免费。
微点始终都是要收费的，以前帮同事装杀软不是装微点就是东方这两免费的东东