8个[MD5: 66D15D F6CAA0 D2F88A 137D89 F3BA8F C67294 73678E BA7827]

显示全部楼层 · 发表于 2007-7-10 19:28:07

8个

显示全部楼层 · 发表于 2007-7-10 19:32:51

Scan performed at: 2007-7-10 19:29:53
Scanning Log
NOD32 version 2389 (20070710) NT
Command line: F:\8
Operating memory - is OK

Date: 10.7.2007 Time: 19:29:56
Anti-Stealth technology is enabled.
Scanned disks, folders and files: F:\8\
F:\8\bh0update.dll - Win32/Adware.Toolbar.IEBar application - quarantined - unable to clean - deleted
F:\8\dialupass.exe - Win32/PSWTool.Dialupass.243 application - quarantined - unable to clean - deleted
F:\8\downloader.exe - probably a variant of Win32/Agent.NEO trojan
F:\8\juexiao.exe - a variant of Win32/TrojanDownloader.QQHelper.NDD trojan
Number of scanned files: 8
Number of threats found: 4
Number of files cleaned: 4
Time of completion: 19:29:57 Total scanning time: 1 sec (00:00:01)

显示全部楼层 · 发表于 2007-7-10 19:34:53

detected: Trojan program Trojan.BAT.KillAV.es File: C:\Documents and Settings\Owner\×ÀÃæ\8.rar/downloader.exe//#
detected: riskware not-a-virus:PSWTool.Win32.Dialupass.f File: C:\Documents and Settings\Owner\×ÀÃæ\8.rar/dialupass.exe//UPX
detected: adware not-a-virus:AdWare.Win32.Iebar.h File: C:\Documents and Settings\Owner\×ÀÃæ\8.rar/mybho.dll
detected: adware not-a-virus:AdWare.Win32.Iebar.m File: C:\Documents and Settings\Owner\×ÀÃæ\8.rar/bh0update.dll

显示全部楼层 · 发表于 2007-7-10 19:35:12

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\8.rar'
C:\Documents and Settings\Administrator\桌面\8.rar
  [0] Archive type: RAR
  --> juexiao.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> downloader.exe
   [DETECTION] Contains suspicious code HEUR/Crypted
  --> skyepe.exe
   [DETECTION] Contains signature of the dropper DR/Delphi.Gen
  --> SkypeClient.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> mybho.dll
   [DETECTION] Contains signature of the Ad- or Spyware ADSPY/IEBar.N
  --> bh0update.dll
   [DETECTION] Contains signature of the Ad- or Spyware ADSPY/Iebar.M.1
   [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-7-10 19:35:34

咖啡只报3个

显示全部楼层 · 发表于 2007-7-10 19:39:22

居然连Skype也报

显示全部楼层 · 发表于 2007-7-10 19:40:04

时间模块对象名称病毒操作用户名称信息
2007/7/10 19:39:51 AMON 文件 D:\病毒上报\bh0update.dll Win32/Adware.Toolbar.IEBar 应用程序已隔离 - 已删除 Jason-PC\Jason 程序新建文件时发生事件： C:\Program Files\WinRAR\WinRAR.exe. 文件已被移入隔离区。您可以关闭本窗口。
2007/7/10 19:39:50 AMON 文件 D:\病毒上报\dialupass.exe Win32/PSWTool.Dialupass.243 应用程序已隔离 - 已删除 Jason-PC\Jason 程序新建文件时发生事件： C:\Program Files\WinRAR\WinRAR.exe. 文件已被移入隔离区。您可以关闭本窗口。
2007/7/10 19:39:49 AMON 文件 D:\病毒上报\downloader.exe 可能是 Win32/Agent.NEO 木马的一个变种已隔离 - 已删除 Jason-PC\Jason 程序新建文件时发生事件： C:\Program Files\WinRAR\WinRAR.exe. 文件已被移入隔离区。您可以关闭本窗口。
2007/7/10 19:39:47 AMON 文件 D:\病毒上报\juexiao.exe Win32/TrojanDownloader.QQHelper.NDD 木马的变种已隔离 - 已删除 Jason-PC\Jason 程序新建文件时发生事件： C:\Program Files\WinRAR\WinRAR.exe. 文件已被移入隔离区。您可以关闭本窗口。

显示全部楼层 · 发表于 2007-7-10 19:43:34

skypeclient不是病毒..发现这个每段时间都会在样本区出现.

skyepe.exe运行报了.
C:\Program Files\Common Files\Microsoft Shared\MSINFO\C6DE4CD2.dll a variant of Win32/Delf.CC worm
剩下两个DLL.

显示全部楼层 · 发表于 2007-7-10 19:46:21

[病毒样本] 8个[MD5: 66D15D F6CAA0 D2F88A 137D89 F3BA8F C67294 73678E BA7827]

本帖子中包含更多资源