中秋佳节在即小心接收文件"礼物.rar"

迈不过友情╰ 2024-02-17 19:33 21阅读 0赞

前几天一位Q友给我传送文件“礼物.rar”，只好接收了。

> 文件说明符 : D:/礼物.rar  
> 属性 : A---  
> 数字签名:否  
> PE文件:否  
> 创建时间 : 2010-9-16 19:58:11  
> 修改时间 : 2010-9-16 19:58:14  
> 大小 : 228370 字节 223.18 KB  
> MD5 : 0aeb9d71c978e070f90d95fe27317350  
> SHA1: 9A0AAFEE836A12E8AA6D6A024E3EB7D28C204F61  
> CRC32: ff1496d7

解压出来：

>   
> 文件说明符 : D:/礼物/打开礼物/再打开/还是打开/接着开/相信我，打开就有了/你不要以为在给你开玩笑/还有呢/呵呵/你有没有被耍的感觉/你觉得会不会没有尽头呢？/有没有点失望呢？/下一个会有了吧！/还是没有？/这回有了吧/怎么还没有啊！/这是最后一层了/做好准备,不要激动哦!.EXE  
> 属性 : A---  
> 数字签名:否  
> PE文件:是  
> 获取文件版本信息大小失败!  
> 创建时间 : 2010-9-16 19:59:34  
> 修改时间 : 2007-9-16 15:35:34  
> 大小 : 916480 字节 895.0 KB  
> MD5 : 38ca55c7c695e14bc80cfa46c80d64b3  
> SHA1: 86D38AD2070E5F1EEFA040A2A3AABC21EB2E5A14  
> CRC32: f3441c43

好深的目录～

这段时间比较忙，没空测试了，直接把压缩包上传到[http://www.virustotal.com][http_www.virustotal.com]扫描，结果如下：

> File name: 
> 
> **礼物.rar** 
> 
> 
> Submission date: 
> 
> **2010-09-16 14:20:36 (UTC)** 
> 
> 
> Current status: 
> 
> **queued** **queued** **analysing****finished** 
> 
> 
> Result: 
> 
> **12/ 43 (27.9%)** 
> 
> 
> <table style="width: 700px;"> 
> <tbody> 
> <tr> 
> <th>Antivirus</th> 
> <th>Version</th> 
> <th>Last Update</th> 
> <th>Result</th> 
> </tr> 
> <tr> 
> <td>AhnLab-V3</td> 
> <td>2010.09.16.01</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>AntiVir</td> 
> <td>8.2.4.52</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>Antiy-AVL</td> 
> <td>2.0.3.7</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>Authentium</td> 
> <td>5.2.0.5</td> 
> <td>2010.09.16</td> 
> <td>W32/Joke.OA</td> 
> </tr> 
> <tr> 
> <td>Avast</td> 
> <td>4.8.1351.0</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>Avast5</td> 
> <td>5.0.594.0</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>AVG</td> 
> <td>9.0.0.851</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>BitDefender</td> 
> <td>7.2</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>CAT-QuickHeal</td> 
> <td>11.00</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>ClamAV</td> 
> <td>0.96.2.0-git</td> 
> <td>2010.09.16</td> 
> <td>Trojan.Downloader-20749</td> 
> </tr> 
> <tr> 
> <td>Comodo</td> 
> <td>6097</td> 
> <td>2010.09.16</td> 
> <td>TrojWare.Win32.Trojan.Chifrax.~A</td> 
> </tr> 
> <tr> 
> <td>DrWeb</td> 
> <td>5.0.2.03300</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>Emsisoft</td> 
> <td>5.0.0.37</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>eSafe</td> 
> <td>7.0.17.0</td> 
> <td>2010.09.15</td> 
> <td>Win32.Backdoor.Grayb</td> 
> </tr> 
> <tr> 
> <td>eTrust-Vet</td> 
> <td>36.1.7859</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>F-Prot</td> 
> <td>4.6.1.107</td> 
> <td>2010.09.16</td> 
> <td>W32/Joke.OA</td> 
> </tr> 
> <tr> 
> <td>F-Secure</td> 
> <td>9.0.15370.0</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>Fortinet</td> 
> <td>4.1.143.0</td> 
> <td>2010.09.16</td> 
> <td>Joke/ScreenRoses</td> 
> </tr> 
> <tr> 
> <td>GData</td> 
> <td>21</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>Ikarus</td> 
> <td>T3.1.1.88.0</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>Jiangmin</td> 
> <td>13.0.900</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>K7AntiVirus</td> 
> <td>9.63.2522</td> 
> <td>2010.09.15</td> 
> <td>JokeProgram</td> 
> </tr> 
> <tr> 
> <td>Kaspersky</td> 
> <td>7.0.0.125</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>McAfee</td> 
> <td>5.400.0.1158</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>McAfee-GW-Edition</td> 
> <td>2010.1C</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>Microsoft</td> 
> <td>1.6103</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>NOD32</td> 
> <td>5455</td> 
> <td>2010.09.16</td> 
> <td>probably a variant of Win32/Agent.KOQBDXW</td> 
> </tr> 
> <tr> 
> <td>Norman</td> 
> <td>6.06.06</td> 
> <td>2010.09.15</td> 
> <td>Suspicious_Gen2.ADGOQ</td> 
> </tr> 
> <tr> 
> <td>nProtect</td> 
> <td>2010-09-16.02</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>Panda</td> 
> <td>10.0.2.7</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>PCTools</td> 
> <td>7.0.3.5</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>Prevx</td> 
> <td>3.0</td> 
> <td>2010.09.16</td> 
> <td>High Risk Worm</td> 
> </tr> 
> <tr> 
> <td>Rising</td> 
> <td>22.65.03.04</td> 
> <td>2010.09.16</td> 
> <td>Trojan.Win32.Generic.522A7A89</td> 
> </tr> 
> <tr> 
> <td>Sophos</td> 
> <td>4.57.0</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>Sunbelt</td> 
> <td>6882</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>SUPERAntiSpyware</td> 
> <td>4.40.0.1006</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>Symantec</td> 
> <td>20101.1.1.7</td> 
> <td>2010.09.16</td> 
> <td>Joke.Rosenu</td> 
> </tr> 
> <tr> 
> <td>TheHacker</td> 
> <td>6.7.0.0.020</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>TrendMicro</td> 
> <td>9.120.0.1004</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>TrendMicro-HouseCall</td> 
> <td>9.120.0.1004</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>VBA32</td> 
> <td>3.12.14.0</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>ViRobot</td> 
> <td>2010.8.25.4006</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> <tr> 
> <td>VirusBuster</td> 
> <td>12.65.9.0</td> 
> <td>2010.09.16</td> 
> <td>-</td> 
> </tr> 
> </tbody> 
> </table>
> 
> <table style="width: 700px;"> 
> <tbody> 
> <tr> 
> <th> 
> <div style="display: inline; float: left; padding-top: 5px;"> 
> Additional information 
> </div> 
> <div style="display: inline; float: right;"> 
> Show all 
> 
> </div> </th> 
> </tr> 
> <tr> 
> <td>MD5&nbsp;&nbsp;&nbsp;: 0aeb9d71c978e070f90d95fe27317350</td> 
> </tr> 
> <tr> 
> <td>SHA1&nbsp;&nbsp;: 9a0aafee836a12e8aa6d6a024e3eb7d28c204f61</td> 
> </tr> 
> <tr> 
> <td>SHA256: f248370694ec8001ebf05368dde3062a615e7a1365d5038d2c88a50756068e6a</td> 
> </tr> 
> </tbody> 
> </table>

可能是个恶意程序，也可能只是一个玩笑程序，反正还是小心为妙！

[http_www.virustotal.com]: http://www.virustotal.com