作者ominia (下雨天睡觉天)
看板AntiVirus
标题Re: [问题] combofix被小红伞判断有毒？
时间Mon Apr 20 14:02:29 2009
※ 引述《kaosps2 (三下男)》之铭言：
: 今天用小红伞扫电脑
: 发现combofix居然被判定为病毒
: 以下是小红伞的报告
: 我只复制这个档案的部份
: 因为我当初把置底下载完後
: 把置底的三个程式全部塞到压缩档里
: D:\SYSTEM\SOURCE\解毒.rar
: [0] Archive type: RAR
: --> ComboFix.exe
: [DETECTION] Contains recognition pattern of the SPR/Tool.2992910 program
: --> ComboFix.exe
: [1] Archive type: RAR SFX (self extracting)
: --> 32788R22FWJFW\NirCmd.cfexe
: [DETECTION] Contains recognition pattern of the APPL/NirCmd.E.2.B
: application
: --> 32788R22FWJFW\nircmd.com
: [DETECTION] Contains recognition pattern of the APPL/NirCmd.E.2.B
: application
: --> 32788R22FWJFW\NirCmdC.cfexe
: [DETECTION] Contains recognition pattern of the APPL/NirCmd.E.1.B
: application
: --> 32788R22FWJFW\psexec.cfexe
: [2] Archive type: RSRC
: --> Object
: [DETECTION] Contains recognition pattern of the APPL/PsExec.E
: application
: [NOTE] A backup was created as '4a1517e7.qua' ( QUARANTINE )
: [NOTE] The file was deleted!
: 怎麽会这样呢.....
这是正常的，combofix属於封装程式，里面有些档案会被某些防毒软体判断为恶意程式，
combofix执行时候一定要在安全模式或是防毒软体关闭情况下执行,因为它的AV-TEST会
被防毒软体挡掉
--
※ 发信站: 批踢踢实业坊(ptt.cc)
◆ From: 220.130.83.70