一个，卡巴报木马，红伞官方却认为是 CLEAN

mhj144007

Hello,

Thanks for taking the time to submit your samples to the Norman
Sandbox Information Center.  Customer delight is our top priority at
Norman.  With that in mind we have developed Sandbox Solutions for
organizations that are committed to speedy analysis and debugging.

Norman Sandbox Solutions give your organization the opportunity to
analyze files immediately in your own environment.

To find out how to bring the power of Norman Sandbox into your test
environments follow the links below.

Norman Sandbox Solutions
http://www.norman.com/Product/Sandbox-products/

Norman Sandbox Analyzer
http://www.norman.com/Product/Sandbox-products/Analyzer/

Norman Sandbox Analyzer Pro
http://www.norman.com/Product/Sandbox-products/Analyzer-pro/

Norman SandBox Reporter
http://www.norman.com/Product/Sandbox-products/Reporter/

&#26700 : Not detected by Sandbox (Signature: NO_VIRUS)


[ DetectionInfo ]
    * Sandbox name: NO_MALWARE
    * Signature name: NO_VIRUS

[ General information ]
    * File length:        96573 bytes.
    * MD5 hash: 689ba1d266d20cdc9bad8fcde3059920.

[ Changes to filesystem ]
    * Creates directory C:.
    * Creates directory C:\WINDOWS.
    * Creates directory C:\WINDOWS\TEMP.
    * Creates directory C:\WINDOWS\TEMP\RarSFX0.
    * Creates file C:\WINDOWS\TEMP\RarSFX0\DEL.txt.

[ Changes to registry ]
    * Creates key "HKCU\Software\WinRAR SFX".
    * Sets value "C%%Program Files%"="C:\WINDOWS\TEMP\RarSFX0" in key "HKCU\Software\WinRAR SFX".

[ Signature Scanning ]
    * C:\WINDOWS\TEMP\RarSFX0\DEL.txt (48 bytes) : no signature detection.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.

This file is not flagged as malicious by the Norman Sandbox Information Center. However, we can not guarantee that the file is harmless. If you still suspect the file to be malicious and if you urgently need to know for sure, please submit it to your local Norman support department for manual analysis.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

wangjay1980

Hello
this is not false alarm

Please quote all when answering.
-----------------
Regards, Yampolsky Boris
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com


> Attachment: DEL3.zip

sexing

已检测到: 木马程序 Trojan.RAR.KillFiles.a        URL: http://bbs.kafan.cn/attachment.p ... //data.rar//archive comment
卡7

sexing

2007-6-20 21:28:27        文件: C:\Documents and Settings\Owner\桌面\DEL3.rar        正常        iChecker

真他妈的怪了!卡7下载时候报
已检测到: 木马程序 Trojan.RAR.KillFiles.a        URL: http://bbs.kafan.cn/attachment.p ... //data.rar//archive comment

我想手动扫描一下,听听杀猪声,居然有成了
2007-6-20 21:28:27        文件: C:\Documents and Settings\Owner\桌面\DEL3.rar        正常        iChecker


晕,,撞鬼了吧

野马

不可以运行。

linziboy

被报病毒只是因为自压缩的时候有个删除目录的命令。
Delete=\装机人员工具
这个文件应该定义为危险操作，定义为病毒有点牵强。

lovecho

卡7杀`