360杀毒软件无视宏病毒！

本是古典何须时尚 2024-02-17 22:06 37阅读 0赞

一位朋友在打开邮箱里的一个xls文件后就出现了异常现象：每次关闭xls文件都会弹出是否保存窗口：

[![12143_1327029914wAc9.jpg][]][12143_1327029914wAc9.jpg 1]

即使没做任何修改的情况下依然如此。

让朋友检查excel中的安全设置（菜单“工具/宏/安全性”），已经设置成“中”。

[![12143_1327029915LDoh.jpg][]][12143_1327029915LDoh.jpg 1]

怀疑朋友电脑中了病毒，让他把那个可疑的xls文件发给我检查。把该文件上传到多引擎在线扫描网站上检测，结果：

[http://r.virscan.org/report/5b962c07bf4e8890d8ed50d63f8e1833.html][http_r.virscan.org_report_5b962c07bf4e8890d8ed50d63f8e1833.html]

<table> 
 <tbody> 
  <tr> 
   <td align="right"><span><span style="font-size:13px;">扫描结果 :</span></span></td> 
   <td><span><span style="font-size:13px;">&nbsp;&nbsp;75%的杀软(27/36)报告发现病毒</span></span></td> 
  </tr> 
  <tr> 
   <td align="right"><span><span style="font-size:13px;">时间 :</span></span></td> 
   <td><span title="Asia/Chongqing(GMT +0800)"><span style="font-size:13px;">&nbsp;&nbsp;2012/01/20 11:02:05 (CST)</span></span></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <th><a href="http://r.virscan.org/report/5b962c07bf4e8890d8ed50d63f8e1833.html#" rel="nofollow">软件名称<span><img title="" alt="↓" src="http://img.virscan.org/images/arrow-down.gif"></span></a></th> 
   <th><a href="http://r.virscan.org/report/5b962c07bf4e8890d8ed50d63f8e1833.html#" rel="nofollow">引擎版本<span></span></a></th> 
   <th><a href="http://r.virscan.org/report/5b962c07bf4e8890d8ed50d63f8e1833.html#" rel="nofollow">病毒库版本<span></span></a></th> 
   <th style="TEXT-ALIGN: center"><a href="http://r.virscan.org/report/5b962c07bf4e8890d8ed50d63f8e1833.html#" rel="nofollow">病毒库时间<span></span></a></th> 
   <th><a href="http://r.virscan.org/report/5b962c07bf4e8890d8ed50d63f8e1833.html#" rel="nofollow">扫描结果<span></span></a></th> 
   <th style="TEXT-ALIGN: center"><a href="http://r.virscan.org/report/5b962c07bf4e8890d8ed50d63f8e1833.html#" rel="nofollow">时间<span></span></a></th> 
  </tr> 
  <tr title="找到 Virus.X97M.Laroux!IK"> 
   <td><span><span style="font-size:13px;">a-squared</span></span></td> 
   <td>5.1.0.4</td> 
   <td>20120120060237</td> 
   <td style="TEXT-ALIGN: center">2012-01-20</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/Virus.X97M.Laroux!IK.html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">Virus.X97M.Laroux!IK</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">0.417</td> 
  </tr> 
  <tr title="找到 X2000M/Laroux.JA"> 
   <td><span><span style="font-size:13px;">AntiVir</span></span></td> 
   <td>8.2.8.34</td> 
   <td>7.11.21.106</td> 
   <td style="TEXT-ALIGN: center">2012-01-19</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/X2000M/Laroux.JA.html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">X2000M/Laroux.JA</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">0.323</td> 
  </tr> 
  <tr title="没有检测到病毒"> 
   <td><span><span style="font-size:13px;">Arcavir</span></span></td> 
   <td>2011</td> 
   <td>201201191419</td> 
   <td style="TEXT-ALIGN: center">2012-01-19</td> 
   <td> 
    <div> 
     <span><span style="font-size:13px;color:green;">-</span></span> 
    </div></td> 
   <td style="TEXT-ALIGN: center">3.484</td> 
  </tr> 
  <tr title="找到 X97M/Escop.A (Exact)"> 
   <td><span><span style="font-size:13px;">Authentium</span></span></td> 
   <td>5.1.1</td> 
   <td>201201191513</td> 
   <td style="TEXT-ALIGN: center">2012-01-19</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/X97M/Escop.A%20%28Exact%29.html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">X97M/Escop.A&nbsp;(Exact)</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">1.678</td> 
  </tr> 
  <tr title="没有检测到病毒"> 
   <td><span><span style="font-size:13px;">AVAST!</span></span></td> 
   <td>4.7.4</td> 
   <td>120119-2</td> 
   <td style="TEXT-ALIGN: center">2012-01-19</td> 
   <td> 
    <div> 
     <span><span style="font-size:13px;color:green;">-</span></span> 
    </div></td> 
   <td style="TEXT-ALIGN: center">0.012</td> 
  </tr> 
  <tr title="找到 X97M/Laroux"> 
   <td><span><span style="font-size:13px;">AVG</span></span></td> 
   <td>10.0.1405</td> 
   <td>2090/4754</td> 
   <td style="TEXT-ALIGN: center">2012-01-19</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/X97M/Laroux.html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">X97M/Laroux</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">0.086</td> 
  </tr> 
  <tr title="找到 X97M.Escape.D"> 
   <td><span><span style="font-size:13px;">BitDefender</span></span></td> 
   <td>7.90123.7902459</td> 
   <td>7.40668</td> 
   <td style="TEXT-ALIGN: center">2012-01-20</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/X97M.Escape.D.html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">X97M.Escape.D</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">4.075</td> 
  </tr> 
  <tr title="没有检测到病毒"> 
   <td><span><span style="font-size:13px;">ClamAV</span></span></td> 
   <td>0.97.1</td> 
   <td>14327</td> 
   <td style="TEXT-ALIGN: center">2012-01-20</td> 
   <td> 
    <div> 
     <span><span style="font-size:13px;color:green;">-</span></span> 
    </div></td> 
   <td style="TEXT-ALIGN: center">0.011</td> 
  </tr> 
  <tr title="找到 UnclassifiedMalware"> 
   <td><span><span style="font-size:13px;">Comodo</span></span></td> 
   <td>5.1</td> 
   <td>11315</td> 
   <td style="TEXT-ALIGN: center">2012-01-19</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/UnclassifiedMalware.html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">UnclassifiedMalware</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">2.114</td> 
  </tr> 
  <tr title="没有检测到病毒"> 
   <td><span><span style="font-size:13px;">CP Secure</span></span></td> 
   <td>1.3.0.5</td> 
   <td>2012.01.19</td> 
   <td style="TEXT-ALIGN: center">2012-01-19</td> 
   <td> 
    <div> 
     <span><span style="font-size:13px;color:green;">-</span></span> 
    </div></td> 
   <td style="TEXT-ALIGN: center">0.015</td> 
  </tr> 
  <tr title="找到 X97M.Escape.4"> 
   <td><span><span style="font-size:13px;">Dr.Web</span></span></td> 
   <td>7.0.0.11250</td> 
   <td>2012.01.20</td> 
   <td style="TEXT-ALIGN: center">2012-01-20</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/X97M.Escape.4.html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">X97M.Escape.4</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">11.257</td> 
  </tr> 
  <tr title="找到 X97M/Escop.A (exact)"> 
   <td><span><span style="font-size:13px;">F-Prot</span></span></td> 
   <td>4.6.2.117</td> 
   <td>20120119</td> 
   <td style="TEXT-ALIGN: center">2012-01-19</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/X97M/Escop.A%20%28exact%29.html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">X97M/Escop.A&nbsp;(exact)</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">0.789</td> 
  </tr> 
  <tr title="找到 Virus.MSExcel.Laroux.ja [AVP]"> 
   <td><span><span style="font-size:13px;">F-Secure</span></span></td> 
   <td>7.02.73807</td> 
   <td>2012.01.10.04</td> 
   <td style="TEXT-ALIGN: center">2012-01-10</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/Virus.MSExcel.Laroux.ja%20[AVP].html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">Virus.MSExcel.Laroux.ja&nbsp;[AVP]</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">0.162</td> 
  </tr> 
  <tr title="找到 X97M.Escape.D [Engine:A]"> 
   <td><span><span style="font-size:13px;">GData</span></span></td> 
   <td>22.3553</td> 
   <td>20120120</td> 
   <td style="TEXT-ALIGN: center">2012-01-20</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/X97M.Escape.D%20[Engine:A].html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">X97M.Escape.D&nbsp;[Engine:A]</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">4.798</td> 
  </tr> 
  <tr title="找到 Virus.X97M.Laroux"> 
   <td><span><span style="font-size:13px;">Ikarus</span></span></td> 
   <td>T3.1.32.20.0</td> 
   <td>2012.01.19.80282</td> 
   <td style="TEXT-ALIGN: center">2012-01-19</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/Virus.X97M.Laroux.html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">Virus.X97M.Laroux</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">5.068</td> 
  </tr> 
  <tr title="找到 Virus:XM/Manalo.B"> 
   <td><span><span style="font-size:13px;">Microsoft</span></span></td> 
   <td>1.8001</td> 
   <td>2012.01.20</td> 
   <td style="TEXT-ALIGN: center">2012-01-20</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/Virus:XM/Manalo.B.html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">Virus:XM/Manalo.B</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">3.362</td> 
  </tr> 
  <tr title="找到 X97M/Escop.A virus"> 
   <td><span><span style="font-size:13px;">NOD32</span></span></td> 
   <td>3.0.21</td> 
   <td>6809</td> 
   <td style="TEXT-ALIGN: center">2012-01-19</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/X97M/Escop.A%20virus.html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">X97M/Escop.A&nbsp;virus</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">0.018</td> 
  </tr> 
  <tr title="找到 X97M.Escape.D"> 
   <td><span><span style="font-size:13px;">nProtect</span></span></td> 
   <td>20120119.01</td> 
   <td>11825533</td> 
   <td style="TEXT-ALIGN: center">2012-01-19</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/X97M.Escape.D.html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">X97M.Escape.D</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">1.269</td> 
  </tr> 
  <tr title="找到 XM97.Laroux.ja"> 
   <td><span><span style="font-size:13px;">Quick Heal</span></span></td> 
   <td>11.00</td> 
   <td>2012.01.18</td> 
   <td style="TEXT-ALIGN: center">2012-01-18</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/XM97.Laroux.ja.html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">XM97.Laroux.ja</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">0.912</td> 
  </tr> 
  <tr title="找到 XM/Laroux-AP"> 
   <td><span><span style="font-size:13px;">Sophos</span></span></td> 
   <td>3.27.0</td> 
   <td>4.73</td> 
   <td style="TEXT-ALIGN: center">2012-01-20</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/XM/Laroux-AP.html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">XM/Laroux-AP</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">4.635</td> 
  </tr> 
  <tr title="没有检测到病毒"> 
   <td><span><span style="font-size:13px;">Sunbelt</span></span></td> 
   <td>3.9.2526.2</td> 
   <td>11424</td> 
   <td style="TEXT-ALIGN: center">2012-01-19</td> 
   <td> 
    <div> 
     <span><span style="font-size:13px;color:green;">-</span></span> 
    </div></td> 
   <td style="TEXT-ALIGN: center">0.697</td> 
  </tr> 
  <tr title="找到 X97M/Generico"> 
   <td><span><span style="font-size:13px;">The Hacker</span></span></td> 
   <td>6.7.0.1</td> 
   <td>v00383</td> 
   <td style="TEXT-ALIGN: center">2012-01-19</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/X97M/Generico.html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">X97M/Generico</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">0.505</td> 
  </tr> 
  <tr title="没有检测到病毒"> 
   <td><span><span style="font-size:13px;">VBA32</span></span></td> 
   <td>3.12.16.4</td> 
   <td>20120119.1207</td> 
   <td style="TEXT-ALIGN: center">2012-01-19</td> 
   <td> 
    <div> 
     <span><span style="font-size:13px;color:green;">-</span></span> 
    </div></td> 
   <td style="TEXT-ALIGN: center">3.706</td> 
  </tr> 
  <tr title="没有检测到病毒"> 
   <td><span><span style="font-size:13px;">ViRobot</span></span></td> 
   <td>20120119</td> 
   <td>2012.01.19</td> 
   <td style="TEXT-ALIGN: center">2012-01-19</td> 
   <td> 
    <div> 
     <span><span style="font-size:13px;color:green;">-</span></span> 
    </div></td> 
   <td style="TEXT-ALIGN: center">0.346</td> 
  </tr> 
  <tr title="找到 EXCEL.97.Escop.A"> 
   <td><span><span style="font-size:13px;">VirusBuster</span></span></td> 
   <td>5.4.0.10</td> 
   <td>14.1.177.0/7439040</td> 
   <td style="TEXT-ALIGN: center">2012-01-20</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/EXCEL.97.Escop.A.html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">EXCEL.97.Escop.A</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">0.042</td> 
  </tr> 
  <tr title="找到 Virus.MSExcel.Laroux.ja"> 
   <td><span><span style="font-size:13px;">卡巴斯基</span></span></td> 
   <td>5.5.10</td> 
   <td>2012.01.20</td> 
   <td style="TEXT-ALIGN: center">2012-01-20</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/Virus.MSExcel.Laroux.ja.html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">Virus.MSExcel.Laroux.ja</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">0.040</td> 
  </tr> 
  <tr title="找到 X97M/Ecsys"> 
   <td><span><span style="font-size:13px;">安博士V3</span></span></td> 
   <td>2012.01.19.03</td> 
   <td>2012.01.19</td> 
   <td style="TEXT-ALIGN: center">2012-01-19</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/X97M/Ecsys.html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">X97M/Ecsys</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">3.852</td> 
  </tr> 
  <tr title="没有检测到病毒"> 
   <td><span><span style="font-size:13px;">安天</span></span></td> 
   <td>2.0.18</td> 
   <td>20120119.15862973</td> 
   <td style="TEXT-ALIGN: center">2012-01-19</td> 
   <td> 
    <div> 
     <span><span style="font-size:13px;color:green;">-</span></span> 
    </div></td> 
   <td style="TEXT-ALIGN: center">0.017</td> 
  </tr> 
  <tr title="找到 XM/Laroux.zb"> 
   <td><span><span style="font-size:13px;">江民杀毒</span></span></td> 
   <td>13.0.900</td> 
   <td>2011.11.26</td> 
   <td style="TEXT-ALIGN: center">2011-11-26</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/XM/Laroux.zb.html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">XM/Laroux.zb</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">1.913</td> 
  </tr> 
  <tr title="找到 X97M/Laroux.OY      "> 
   <td><span><span style="font-size:13px;">熊猫卫士</span></span></td> 
   <td>9.05.01</td> 
   <td>2012.01.19</td> 
   <td style="TEXT-ALIGN: center">2012-01-19</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/X97M/Laroux.OY%20%20%20%20%20%20.html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">X97M/Laroux.OY&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">2.494</td> 
  </tr> 
  <tr title="找到 Macro.Excel.Manalo.a"> 
   <td><span><span style="font-size:13px;">瑞星</span></span></td> 
   <td>20.0</td> 
   <td>23.93.02.01</td> 
   <td style="TEXT-ALIGN: center">2012-01-18</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/Macro.Excel.Manalo.a.html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">Macro.Excel.Manalo.a</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">0.908</td> 
  </tr> 
  <tr title="找到 X97M.Laroux.gen"> 
   <td><span><span style="font-size:13px;">赛门铁克</span></span></td> 
   <td>1.3.0.24</td> 
   <td>20120119.002</td> 
   <td style="TEXT-ALIGN: center">2012-01-19</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/X97M.Laroux.gen.html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">X97M.Laroux.gen</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">0.061</td> 
  </tr> 
  <tr title="找到 X97M_MICRO.A"> 
   <td><span><span style="font-size:13px;">趋势科技</span></span></td> 
   <td>9.500-1005</td> 
   <td>8.722.01</td> 
   <td style="TEXT-ALIGN: center">2012-01-19</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/X97M_MICRO.A.html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">X97M_MICRO.A</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">0.021</td> 
  </tr> 
  <tr title="找到 X97M/Laroux"> 
   <td><span><span style="font-size:13px;">迈克菲</span></span></td> 
   <td>5400.1158</td> 
   <td>6594</td> 
   <td style="TEXT-ALIGN: center">2012-01-19</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/X97M/Laroux.html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">X97M/Laroux</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">11.055</td> 
  </tr> 
  <tr title="找到 Macro.Excel.Agent.644"> 
   <td><span><span style="font-size:13px;">金山毒霸</span></span></td> 
   <td>2009.2.5.15</td> 
   <td>2012.1.20.9</td> 
   <td style="TEXT-ALIGN: center">2012-01-20</td> 
   <td> 
    <div> 
     <a href="http://v.virscan.org/Macro.Excel.Agent.644.html" rel="nofollow"><span><span style="font-size:13px;color:#cc0000;">Macro.Excel.Agent.644</span></span></a> 
    </div></td> 
   <td style="TEXT-ALIGN: center">0.944</td> 
  </tr> 
  <tr title="没有检测到病毒"> 
   <td><span><span style="font-size:13px;">飞塔</span></span></td> 
   <td>4.2.257</td> 
   <td>15.116</td> 
   <td style="TEXT-ALIGN: center">2012-01-19</td> 
   <td> 
    <div> 
     <span><span style="font-size:13px;color:green;">-</span></span> 
    </div></td> 
   <td style="TEXT-ALIGN: center">0.105</td> 
  </tr> 
 </tbody> 
</table>

■Heuristic/Suspicious ■Exact  
注意: 就算报告发现病毒，也可能是杀软误报，请根据查毒结果自行判断

果然包含宏病毒。朋友电脑的360杀毒软件居然无视宏病毒！

[12143_1327029914wAc9.jpg]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/29/20a274b7f62c4dd88bec5300a8e7e3bb.png
[12143_1327029914wAc9.jpg 1]: http://hi.csdn.net/space-12143-do-album-picid-1037724-goto-down.html
[12143_1327029915LDoh.jpg]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/29/fce84c7db2624dfa87d694e2d618d57a.png
[12143_1327029915LDoh.jpg 1]: http://hi.csdn.net/space-12143-do-album-picid-1037725-goto-down.html
[http_r.virscan.org_report_5b962c07bf4e8890d8ed50d63f8e1833.html]: http://r.virscan.org/report/5b962c07bf4e8890d8ed50d63f8e1833.html