[MD5: 9C2AE4 7FE81F A30D00 1AFA59 41F20F 65FFBB]

qianwenxiang

6个

promised

yayad解包杀
c:\ABC\Yayad4HaoFang070112\Yayad4HaoFang070112.exe
c:\ABC\Yayad4HaoFang070112\Yayad4HaoFang070112\script.bin
c:\ABC\Yayad4HaoFang070112\Yayad4HaoFang070112\$INSTDIR\AdCore.dll\AdCore.dll - Signature 'not-a-virus:AdWare.Win32.Yayadu.b' found
c:\ABC\Yayad4HaoFang070112\Yayad4HaoFang070112\$INSTDIR\AdPop.Exe\AdPop.exe - Signature 'not-a-virus:AdWare.Win32.Yayadu.b' found
c:\ABC\Yayad4HaoFang070112\Yayad4HaoFang070112\$INSTDIR\autoupdate.dll\autoupdate.dll
c:\ABC\Yayad4HaoFang070112\Yayad4HaoFang070112\$INSTDIR\Uninstall.exe\Uninstall.exe
c:\ABC\样本(2).rar:\windows.exe - Signature 'Trojan-Downloader.Win32.Zlob.and' found
c:\ABC\样本(2).rar
c:\ABC\样本(4).rar:\FlashRun.dll
c:\ABC\样本(4).rar:\gzs.exe - Signature 'MalwareScope.Worm.Viking.3' found
c:\ABC\样本(4).rar:\0013.exe - Signature 'Trojan-Clicker.Win32.BHO.n' found
c:\ABC\样本(4).rar:\doit.exe - Signature 'Backdoor.Win32.Agent.ahj' found
c:\ABC\样本(4).rar

[ 本帖最后由 promised 于 2007-7-9 16:04 编辑 ]

The EQs

Scan performed at: 2007-7-9 15:52:21
Scanning Log
NOD32 version 2384 (20070708) NT
Command line: C:\Documents and Settings\EQ2\桌面\样本(4).rar C:\Documents and Settings\EQ2\桌面\样本(2).rar
Operating memory - is OK

Date: 9.7.2007  Time: 15:52:27
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\样本(4).rar; C:\Documents and Settings\EQ2\桌面\样本(2).rar
C:\Documents and Settings\EQ2\桌面\样本(4).rar ?RAR ?gzs.exe - Win32/Pacex.Gen virus
C:\Documents and Settings\EQ2\桌面\样本(4).rar ?RAR ?doit.exe - a variant of Win32/TrojanDownloader.Delf.NSA trojan
C:\Documents and Settings\EQ2\桌面\样本(2).rar ?RAR ?windows.exe - probably unknown NewHeur_PE virus [7]
Number of scanned files: 7
Number of threats found: 3
Number of files cleaned: 2
Time of completion: 15:52:36 Total scanning time: 9 sec (00:00:09)

Notes:
[7] File is probably infected with an unknown virus.

287669789

kav3.5监控只报两个，未运行病毒文件

[ 本帖最后由 287669789 于 2007-7-9 15:56 编辑 ]

wangjay1980

detected: virus Packed.Win32.NSAnti.n        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾(4).rar/gzs.exe
detected: Trojan program Trojan-Clicker.Win32.BHO.n        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾(4).rar/0013.exe//PE_Patch.PECompact//PecBundle//PECompact
detected: virus Virus.Win32.AutoRun.z        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾(4).rar/doit.exe
detected: adware not-a-virus:AdWare.Win32.Yayadu.b        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾(2).rar/Yayad4HaoFang070112.exe//data0002
detected: adware not-a-virus:AdWare.Win32.Yayadu.b        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾(2).rar/Yayad4HaoFang070112.exe//data0003
detected: adware not-a-virus:AdWare.Win32.Yayadu.b        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾(2).rar/Yayad4HaoFang070112.exe//data0005
detected: virus Downloader (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾(2).rar/windows.exe//PE_Patch//UPack

liaoying112

微点全拦截,AVG查得2个,漏1个

自由

感染: 病毒 Packed.Win32.NSAnti.n        C:\Documents and Settings\wing\桌面\样本(4).rar        483.4 KB
感染: 广告程序 not-a-virus:AdWare.Win32.Yayadu.b        C:\Documents and Settings\wing\桌面\样本(2).rar        370.5 KB
已检测到: 广告程序 not-a-virus:AdWare.Win32.Yayadu.b        URL: http://bbs.kafan.cn/attachment.p ... 070112.exe/data0002
已删除: 广告程序 not-a-virus:AdWare.Win32.Yayadu.b        文件: C:\Documents and Settings\wing\桌面\样本(2).rar\Yayad4HaoFang070112.exe/data0002
已删除: 广告程序 not-a-virus:AdWare.Win32.Yayadu.b        文件: C:\Documents and Settings\wing\桌面\样本(2).rar\Yayad4HaoFang070112.exe/data0003
已删除: 广告程序 not-a-virus:AdWare.Win32.Yayadu.b        文件: C:\Documents and Settings\wing\桌面\样本(2).rar\Yayad4HaoFang070112.exe/data0005
已检测到: 病毒 Packed.Win32.NSAnti.n        URL: http://bbs.kafan.cn/attachment.php?aid=98660/gzs.exe
已删除: 病毒 Packed.Win32.NSAnti.n        文件: C:\Documents and Settings\wing\桌面\样本(4).rar\gzs.exe
已删除: 木马程序 Trojan-Clicker.Win32.BHO.n        文件: C:\Documents and Settings\wing\桌面\样本(4).rar\0013.exe/PE_Patch.PECompact/PecBundle/PECompact

promised

晕死
发觉NOD32也解不了这个包
Scan performed at: 2007-7-9 16:00:14
Scanning Log
NOD32 version 2384 (20070708) NT
Command line: C:\ABC\Yayad4HaoFang070112\Yayad4HaoFang070112
Operating memory - is OK

Date: 9.7.2007  Time: 16:00:21
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\ABC\Yayad4HaoFang070112\Yayad4HaoFang070112\
C:\ABC\Yayad4HaoFang070112\Yayad4HaoFang070112\$INSTDIR\YayadRunOnce.dll\YayadRunOnce.dll - Win32/Adware.Yayad application
Number of scanned files: 6
Number of threats found: 1
Number of active threats: 1
Time of completion: 16:00:22 Total scanning time: 1 sec (00:00:01)

红心王子

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本(2).rar'
C:\Documents and Settings\Administrator\桌面\样本(2).rar
  [0] Archive type: RAR
  --> windows.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was deleted!
Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本(4).rar'
C:\Documents and Settings\Administrator\桌面\样本(4).rar
  [0] Archive type: RAR
  --> gzs.exe
      [DETECTION] Is the Trojan horse TR/PCK.NSAnti.N.60
  --> 0013.exe
      [DETECTION] Is the Trojan horse TR/Click.BHO.N.37
  --> doit.exe
      [DETECTION] Is the Trojan horse TR/Agent.19544
      [INFO]      The file was deleted!

风雪

费尔4个，一个启发。