凌晨礼包13个

显示全部楼层 · 发表于 2007-7-1 11:39:07

发觉IKARUS也不支持NSIS

C:\ABC\QQ\QQ\1881\QQ\internet.exe - Signature 'Backdoor.Win32.Rysoft.a' found
C:\ABC\QQ\QQ\1881\QQ\OICQ木马注册.exe - Signature 'Trojan-PWS.Win32.Lmir.107.d' found
C:\ABC\QQ\QQ\1881\QQ\start.exe
C:\ABC\QQ\QQ\QQ\ShowQQ\{sys}\102350.exe - Signature 'Trojan-Downloader.Win32.Adload.cz' found
C:\ABC\QQ\QQ\QQ\ShowQQ\{sys}\Kuaiso_06006.exe
C:\ABC\QQ\QQ\QQ\ShowQQ\{sys}\M_ayi.exe - Signature 'Trojan-Downloader.Win32.Zlob.aem' found
C:\ABC\QQ\QQ\QQ\ShowQQ\{sys}\QQUpdate.exe
C:\ABC\QQ\QQ\QQ\ShowQQ\{sys}\rjzc139_cns_yassist.exe
C:\ABC\QQ\QQ\QQ\ShowQQ\{sys}\1283\ehuupdate.exe - Signature 'Trojan.Win32.Agent.ut' found
C:\ABC\QQ\QQ\QQ\ShowQQ\{sys}\1283\xboxcenter.dll - Signature 'Trojan.Win32.Agent.ut' found
C:\ABC\QQ\QQ\QQ\ShowQQ\{sys}\2060\tool.exe - Signature 'AdWare.Win32.Dm.g' found
C:\ABC\QQ\QQ\QQ\ShowQQ\{sys}\Kuaiso_06006\$WINDIR\Downloaded Program Files\cnsinsthlper.dll
C:\ABC\QQ\QQ\QQ\ShowQQ\{sys}\Kuaiso_06006\$WINDIR\Downloaded Program Files\cnsmin.dll - Signature 'AdWare.Win32.Boran.i' found

13 Files scanned
(0 Archives with 0 files)
8 Signatures found
0 Suspect code-parts found
Used time: 0:00.750

显示全部楼层 · 发表于 2007-7-1 12:30:08

cnsinsthlper.dll,
cnsmin.dll,
QQUpdate.exe_,
rjzc139_cns_yassist.exe_,
_start.exe_

No malicious code were found in these files.

Please quote all when answering.

--
Best regards, Dmitry Shvetsov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

显示全部楼层 · 发表于 2007-7-1 13:11:19

QQ[1].part1.rar\QQ\QQ\ShowQQ\{sys}\102350.exe;D:\Documents and Settings\dell\桌面\QQ[1].part1.rar;Adware.Dmedia;;
Kuaiso_06006.exe\data001;D:\Documents and Settings\dell\桌面\QQ[1].part1.rar\QQ\QQ\ShowQQ\{sys}\Kuaiso_06006.exe;Adware.Softomate;;
QQ\QQ\ShowQQ\{sys}\Kuaiso_06006.exe;D:\Documents and Settings\dell\桌面\QQ[1].part1.rar\QQ\QQ\ShowQQ\{sys};Archive contains infected objects;;
M_ayi.exe\data001;D:\Documents and Settings\dell\桌面\QQ[1].part1.rar\QQ\QQ\ShowQQ\{sys}\M_ayi.exe;Trojan.DownLoader.10682;;
QQ\QQ\ShowQQ\{sys}\M_ayi.exe;D:\Documents and Settings\dell\桌面\QQ[1].part1.rar\QQ\QQ\ShowQQ\{sys};Archive contains infected objects;;
data001\ylive.exe;D:\Documents and Settings\dell\桌面\QQ[1].part1.rar\QQ\QQ\ShowQQ\{sys}\rjzc139_cns_yassist.exe\data001;Adware.Yassist;;
data001\yhelper.dll;D:\Documents and Settings\dell\桌面\QQ[1].part1.rar\QQ\QQ\ShowQQ\{sys}\rjzc139_cns_yassist.exe\data001;Adware.Yassist;;
data001\Assist\yasbar.dll;D:\Documents and Settings\dell\桌面\QQ[1].part1.rar\QQ\QQ\ShowQQ\{sys}\rjzc139_cns_yassist.exe\data001;Adware.Yassist;;
data001;D:\Documents and Settings\dell\桌面\QQ[1].part1.rar\QQ\QQ\ShowQQ\{sys}\rjzc139_cns_yassist.exe;Archive contains infected objects;;
rjzc139_cns_yassist.exe\data002;D:\Documents and Settings\dell\桌面\QQ[1].part1.rar\QQ\QQ\ShowQQ\{sys}\rjzc139_cns_yassist.exe;Adware.Cdn;;
rjzc139_cns_yassist.exe\data003;D:\Documents and Settings\dell\桌面\QQ[1].part1.rar\QQ\QQ\ShowQQ\{sys}\rjzc139_cns_yassist.exe;Adware.Cdn;;
rjzc139_cns_yassist.exe\data004;D:\Documents and Settings\dell\桌面\QQ[1].part1.rar\QQ\QQ\ShowQQ\{sys}\rjzc139_cns_yassist.exe;Adware.Cdn;;
QQ\QQ\ShowQQ\{sys}\rjzc139_cns_yassist.exe;D:\Documents and Settings\dell\桌面\QQ[1].part1.rar\QQ\QQ\ShowQQ\{sys};Archive contains infected objects;;
QQ[1].part1.rar\QQ\QQ\ShowQQ\{sys}\QQUpdate.exe;D:\Documents and Settings\dell\桌面\QQ[1].part1.rar;Trojan.DownLoader.11008;;
QQ[1].part1.rar;D:\Documents and Settings\dell\桌面;Archive contains infected objects;;
QQ[1].part2.rar\QQ\QQ\ShowQQ\{sys}\1283\ehuupdate.exe;D:\Documents and Settings\dell\桌面\QQ[1].part2.rar;Trojan.Ehu;;
QQ[1].part2.rar\QQ\QQ\ShowQQ\{sys}\2060\tool.exe;D:\Documents and Settings\dell\桌面\QQ[1].part2.rar;Adware.Caishow;;
QQ[1].part2.rar\QQ\QQ\ShowQQ\{sys}\Kuaiso_06006\$WINDIR\Downloaded Program Files\cnsmin.dll;D:\Documents and Settings\dell\桌面\QQ[1].part2.rar;Adware.Cdn;;
QQ[1].part2.rar\QQ\QQ\ShowQQ\{sys}\Kuaiso_06006\$WINDIR\Downloaded Program Files\cnsinsthlper.dll;D:\Documents and Settings\dell\桌面\QQ[1].part2.rar;Adware.Cdn;;
QQ[1].part2.rar\QQ\1881\QQ\OICQ木马注册.exe;D:\Documents and Settings\dell\桌面\QQ[1].part2.rar;BackDoor.Parmor;;
QQ[1].part2.rar;D:\Documents and Settings\dell\桌面;Archive contains infected objects;;

显示全部楼层 · 发表于 2007-7-1 13:22:43

internet.exe;D:\Documents and Settings\dell\桌面\新建文件夹\QQ\1881\QQ;Trojan.PWS.Rysoft;;
OICQ木马注册.exe;D:\Documents and Settings\dell\桌面\新建文件夹\QQ\1881\QQ;BackDoor.Parmor;;
102350.exe;D:\Documents and Settings\dell\桌面\新建文件夹\QQ\QQ\ShowQQ\{sys};Adware.Dmedia;;
Kuaiso_06006.exe\data001;D:\Documents and Settings\dell\桌面\新建文件夹\QQ\QQ\ShowQQ\{sys}\Kuaiso_06006.exe;Adware.Softomate;;
Kuaiso_06006.exe;D:\Documents and Settings\dell\桌面\新建文件夹\QQ\QQ\ShowQQ\{sys};Archive contains infected objects;;
M_ayi.exe\data001;D:\Documents and Settings\dell\桌面\新建文件夹\QQ\QQ\ShowQQ\{sys}\M_ayi.exe;Trojan.DownLoader.10682;;
M_ayi.exe;D:\Documents and Settings\dell\桌面\新建文件夹\QQ\QQ\ShowQQ\{sys};Archive contains infected objects;;
QQUpdate.exe;D:\Documents and Settings\dell\桌面\新建文件夹\QQ\QQ\ShowQQ\{sys};Trojan.DownLoader.11008;;
data001\ylive.exe;D:\Documents and Settings\dell\桌面\新建文件夹\QQ\QQ\ShowQQ\{sys}\rjzc139_cns_yassist.exe\data001;Adware.Yassist;;
data001\yhelper.dll;D:\Documents and Settings\dell\桌面\新建文件夹\QQ\QQ\ShowQQ\{sys}\rjzc139_cns_yassist.exe\data001;Adware.Yassist;;
data001\Assist\yasbar.dll;D:\Documents and Settings\dell\桌面\新建文件夹\QQ\QQ\ShowQQ\{sys}\rjzc139_cns_yassist.exe\data001;Adware.Yassist;;
data001;D:\Documents and Settings\dell\桌面\新建文件夹\QQ\QQ\ShowQQ\{sys}\rjzc139_cns_yassist.exe;Archive contains infected objects;;
rjzc139_cns_yassist.exe\data002;D:\Documents and Settings\dell\桌面\新建文件夹\QQ\QQ\ShowQQ\{sys}\rjzc139_cns_yassist.exe;Adware.Cdn;;
rjzc139_cns_yassist.exe\data003;D:\Documents and Settings\dell\桌面\新建文件夹\QQ\QQ\ShowQQ\{sys}\rjzc139_cns_yassist.exe;Adware.Cdn;;
rjzc139_cns_yassist.exe\data004;D:\Documents and Settings\dell\桌面\新建文件夹\QQ\QQ\ShowQQ\{sys}\rjzc139_cns_yassist.exe;Adware.Cdn;;
rjzc139_cns_yassist.exe;D:\Documents and Settings\dell\桌面\新建文件夹\QQ\QQ\ShowQQ\{sys};Archive contains infected objects;;
ehuupdate.exe;D:\Documents and Settings\dell\桌面\新建文件夹\QQ\QQ\ShowQQ\{sys}\1283;Trojan.Ehu;;
xboxcenter.dll;D:\Documents and Settings\dell\桌面\新建文件夹\QQ\QQ\ShowQQ\{sys}\1283;Adware.Filmweb;;
tool.exe;D:\Documents and Settings\dell\桌面\新建文件夹\QQ\QQ\ShowQQ\{sys}\2060;Adware.Caishow;;
cnsinsthlper.dll;D:\Documents and Settings\dell\桌面\新建文件夹\QQ\QQ\ShowQQ\{sys}\Kuaiso_06006\$WINDIR\Downloaded Program Files;Adware.Cdn;;
cnsmin.dll;D:\Documents and Settings\dell\桌面\新建文件夹\QQ\QQ\ShowQQ\{sys}\Kuaiso_06006\$WINDIR\Downloaded Program Files;Adware.Cdn;;

显示全部楼层 · 发表于 2007-7-1 13:37:18

DR。WEB 真是厉害，杀我盘中的WIN优化，EQ的规则文件，360，网上交易软件

显示全部楼层 · 发表于 2007-7-1 16:16:42

蜘蛛漏了一个：star.exe

显示全部楼层 · 发表于 2007-7-1 16:35:29

微点:

时间处理结果木马名称木马进程名木马文件创建者
2007-07-01 16:34:18 处理成功未知间谍软件 C:\PROGRAM FILES\3721\HELPER.DLL D:\QQ\QQ\SHOWQQ\{SYS}\RJZC139_CNS_YASSIST.EXE
2007-07-01 16:34:12 延时删除未知间谍软件 C:\PROGRAM FILES\3721\CNSM.DLL D:\QQ\QQ\SHOWQQ\{SYS}\RJZC139_CNS_YASSIST.EXE
2007-07-01 16:34:00 延时删除未知木马 C:\PROGRAM FILES\3721\CNSM.DLL D:\QQ\QQ\SHOWQQ\{SYS}\RJZC139_CNS_YASSIST.EXE
2007-07-01 16:32:30 处理成功 Trojan-Downloader.Win32.Delf.ax D:\QQ\QQ\SHOWQQ\{SYS}\M_AYI.EXE C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-07-01 16:32:27 处理成功 Trojan-Downloader.Win32.Adload.bx D:\QQ\QQ\SHOWQQ\{SYS}\102350.EXE C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-07-01 16:32:06 处理成功 Trojan-Downloader.Win32.Adload.bx D:\QQ\QQ\SHOWQQ\{SYS}\102350.EXE C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-07-01 16:31:39 处理成功 Backdoor.Win32.Rysoft.b D:\QQ\1881\QQ\INTERNET.EXE C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-07-01 16:31:37 处理成功 Trojan-Downloader.Win32.Agent.acb D:\QQ\QQ\SHOWQQ\{SYS}\2060\TOOL.EXE C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-07-01 16:31:35 处理成功 Trojan.Win32.Agent.vp D:\QQ\QQ\SHOWQQ\{SYS}\1283\XBOXCENTER.DLL C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-07-01 16:31:33 处理成功 Trojan-Downloader.Win32.Delf.ax D:\QQ\QQ\SHOWQQ\{SYS}\M_AYI.EXE C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-07-01 16:31:30 处理成功 Trojan-Downloader.Win32.Adload.bx D:\QQ\QQ\SHOWQQ\{SYS}\102350.EXE C:\PROGRAM FILES\WINRAR\WINRAR.EXE

我还有几个没手动运行

显示全部楼层 · 发表于 2007-7-1 16:42:49

补充一下,好象没杀3721和雅虎,不过微点不杀流氓的

[病毒样本] 凌晨礼包13个

DR。WEB 15

解压后，17个