又见江苏老客户6个货色[MD5: 9ECFEF 78A8A5 B2CA7F 5E97A6 F8AA61 68E818]

显示全部楼层 · 发表于 2007-6-30 17:43:03

卡巴 1 个

已删除: 木马程序 Backdoor.Win32.Agent.ahj 文件: C:\Documents and Settings\SkyFire\桌面\样本.rar/样本\10034.exe

显示全部楼层 · 发表于 2007-6-30 17:54:36

RS四个

显示全部楼层 · 发表于 2007-6-30 17:56:30

费尔两个。。。。

显示全部楼层 · 发表于 2007-6-30 18:10:38

5个。。。

[Scan path] C:\Documents and Settings\Administrator\桌面\样本
C:\Documents and Settings\Administrator\桌面\样本\10034.exe infected with Trojan.Popwin
>>C:\Documents and Settings\Administrator\桌面\样本\1040.exe\data001 - Ok
>C:\Documents and Settings\Administrator\桌面\样本\1040.exe\data002 - Ok
>C:\Documents and Settings\Administrator\桌面\样本\1040.exe\data003 - Ok
>C:\Documents and Settings\Administrator\桌面\样本\1040.exe\data004 - Ok
C:\Documents and Settings\Administrator\桌面\样本\1040.exe - Ok
>>C:\Documents and Settings\Administrator\桌面\样本\ad_2243.exe\data001 is an adware program Adware.Borlander
C:\Documents and Settings\Administrator\桌面\样本\ad_2243.exe - archive contains infected objects
C:\Documents and Settings\Administrator\桌面\样本\bind_50263.exe infected with Trojan.DownLoader.origin
C:\Documents and Settings\Administrator\桌面\样本\insshell.exe is an adware program Adware.Borlander
C:\Documents and Settings\Administrator\桌面\样本\my_70045.exe infected with Trojan.DownLoader.24708

显示全部楼层 · 发表于 2007-6-30 18:34:36

Scan performed at: 2007-6-30 18:34:11
Scanning Log
NOD32 version 2365 (20070630) NT
Command line: C:\Documents and Settings\EQ2\桌面\样本.rar
Operating memory - is OK

Date: 30.6.2007 Time: 18:34:16
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\样本.rar
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?样本\10034.exe - a variant of Win32/Agent.NEO trojan
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?样本\ad_2243.exe ?NSIS ?insshell.exe - Win32/Adware.Boran application - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?样本\1040.exe ?NSIS ?acpidisk.sys - a variant of Win32/Adware.Cinmus application - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?样本\insshell.exe - Win32/Adware.Boran application - was a part of the deleted object
Number of scanned files: 9
Number of threats found: 4
Number of files cleaned: 1
Time of completion: 18:34:17 Total scanning time: 1 sec (00:00:01)

显示全部楼层 · 发表于 2007-6-30 18:51:26

显示全部楼层 · 发表于 2007-6-30 18:58:13

3
  [0] Archive type: RAR
  --> Ñù±¾\10034.exe
   [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Agent.ahj.555 Backdoor server programs
  --> Ñù±¾\bind_50263.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> Ñù±¾\my_70045.exe
   [DETECTION] Contains suspicious code HEUR/Malware

奇怪了双字节又不对了……

显示全部楼层 · 发表于 2007-6-30 19:03:05

那两个又是nsis antivir的噩梦~

显示全部楼层 · 发表于 2007-6-30 21:18:05

病毒: Backdoor.Win32.Agent.ahj
文件: 10034.exe
目录: C:\Documents and Settings\Administrator\Local Settings\Temp\~DTU\B68B48C9DED9C59BEACA8BF023D6B4D4\样本
进程: Defendio.exe
病毒: Win32:Adware-gen. [Adw]
文件: 1040.exe
目录: C:\Documents and Settings\Administrator\Local Settings\Temp\~DTU\B68B48C9DED9C59BEACA8BF023D6B4D4\样本
进程: Defendio.exe
病毒: Backdoor.Win32.Agent.ahj
文件: 10034.exe
目录: C:\Documents and Settings\Administrator\Local Settings\Temp\~DTU\B68B48C9DED9C59BEACA8BF023D6B4D4\样本
进程: Defendio.exe

[病毒样本] 又见江苏老客户6个货色[MD5: 9ECFEF 78A8A5 B2CA7F 5E97A6 F8AA61 68E818]

本帖子中包含更多资源

本帖子中包含更多资源