毒5个，过咖啡。已更新。

显示全部楼层 · 发表于 2007-7-7 11:39:34

费尔启发。

显示全部楼层 · 发表于 2007-7-7 12:24:01

江苏下载者永远过不了SOPHOS

[ 本帖最后由 promised 于 2007-7-7 12:26 编辑 ]

显示全部楼层 · 发表于 2007-7-7 12:41:43

原帖由 promised 于 2007-7-7 12:24 发表

江苏下载者永远过不了SOPHOS

nod怎么就不杀那个江苏下载者嘛
扫描进行于：2007/7/7 12:34:28
扫描日志
NOD32版本 2383 (20070706) NT
命令行： D:\病毒\毒.rar
C:\Program Files\Eset\nod32.exe - 是正常的
1 的MBR区.物理磁盘 - 是正常的
1 的启动引导区.物理磁盘 - 是正常的
日期： 7.7.2007 时间：12:34:30
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：D:\病毒\毒.rar
D:\病毒\毒.rar >>RAR >>ad341.exe >>NSIS >>cpush.dll - Win32/Adware.BHO.AV 应用程序
D:\病毒\毒.rar >>RAR >>bind_50119.exe - 可能是 Win32/TrojanDownloader.QQHelper.NCO 木马的一个变种
D:\病毒\毒.rar >>RAR >>dodolook078.exe >>NSIS >>System.dll - 是正常的
D:\病毒\毒.rar >>RAR >>dodolook078.exe >>NSIS >>1099.exe >>NSIS >>System.dll - 是正常的
D:\病毒\毒.rar >>RAR >>dodolook078.exe >>NSIS >>1099.exe >>NSIS >>DoSSSetup.dll - 是正常的
D:\病毒\毒.rar >>RAR >>dodolook078.exe >>NSIS >>1099.exe >>NSIS >>acpidisk.sys - Win32/Adware.Cinmus 应用程序的变种
D:\病毒\毒.rar >>RAR >>my_70018.exe - Win32/TrojanDownloader.QQHelper.NDD 木马的变种
D:\病毒\毒.rar >>RAR >>PlugQuery1039.exe - 是正常的
D:\病毒\毒.rar:Zone.Identifier - 是正常的
已扫描的文件数目：9
已发现的病毒数目：4
完成时间： 12:34:31 总扫描时间：1 秒 (00:00:01)

显示全部楼层 · 发表于 2007-7-7 15:08:50

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\555.rar'
C:\Documents and Settings\Administrator\桌面\
  555.rar
[0] Archive type: RAR
--> 504.exe
      [DETECTION] Is the Trojan horse TR/Adload.L.2
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    A backup was created as '46c43bd0.qua'  ( QUARANTINE )
      [INFO]    The file was deleted!

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\毒.rar'
C:\Documents and Settings\Administrator\桌面\
  毒.rar
[0] Archive type: RAR
--> ad341.exe
--> bind_50119.exe
      [DETECTION] Is the Trojan horse TR/Agent.20480.200
      [WARNING] Infected files in archives cannot be repaired!
--> dodolook078.exe
--> my_70018.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
--> PlugQuery1039.exe
      [INFO]    A backup was created as '47013c20.qua'  ( QUARANTINE )
      [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-7-7 15:22:17

Hello,

bind_50119.exed - Trojan-Downloader.Win32.QQHelper.rb,
my_70018.exed - Trojan-Downloader.Win32.QQHelper.rg

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

dodolook078.exed - not-a-virus:AdWare.Win32.Cinmus.f

This file is an Advertizing Tool, It's detection will be included in the next
update of extended databases set. See more info about
extended databases here: http://www.kaspersky.com/extraavupdates

PlugQuery1039.exed

No malicious code was found in this file.

Please quote all when answering.

--
Best regards, Denis Maslennikov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

> Attachment: 5.zip

Hello,

504.exey - not-a-virus:AdWare.Win32.AdMoke.ar

This file is an Advertizing Tool, It's detection will be included in the next
update of extended databases set. See more info about
extended databases here: http://www.kaspersky.com/extraavupdates

Please quote all when answering.

--
Best regards, Boris Yampolsky
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

> Attachment: 555.zip

显示全部楼层 · 发表于 2007-7-7 15:31:46

原帖由风雪于 2007-7-7 11:13 发表
费尔两个一个木马一个广告。

不对哦，费尔四个，剩一个拦截

显示全部楼层 · 发表于 2007-7-7 15:43:26

看图片

显示全部楼层 · 发表于 2007-7-7 15:45:17

3...

[Scan path] C:\Documents and Settings\Administrator\桌面\virus\ad341.exe
>>C:\Documents and Settings\Administrator\桌面\virus\ad341.exe\data001 is an adware program Adware.Newads
C:\Documents and Settings\Administrator\桌面\virus\ad341.exe - archive contains infected objects

[Scan path] C:\Documents and Settings\Administrator\桌面\virus\bind_50119.exe
C:\Documents and Settings\Administrator\桌面\virus\bind_50119.exe infected with Trojan.DownLoader.26006

[Scan path] C:\Documents and Settings\Administrator\桌面\virus\my_70018.exe
C:\Documents and Settings\Administrator\桌面\virus\my_70018.exe infected with Trojan.DownLoader.26006

显示全部楼层 · 发表于 2007-7-7 15:45:39

费尔今天更新病毒库，我没有更新，三天就更新少见。

显示全部楼层 · 发表于 2007-7-7 15:47:16

AVAST杀一个广告

[病毒样本] 毒5个，过咖啡。已更新。

回复 #10 F-Secure 的帖子

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源