[94aa09]bind

qianwenxiang

ms捆绑了四个以上的病毒

The EQs

Scan performed at: 2007-7-26 12:07:19
Scanning Log
NOD32 version 2421 (20070725) NT
Command line: C:\Documents and Settings\EQ2\桌面\qsxs.rar
Operating memory - is OK

Date: 26.7.2007  Time: 12:07:26
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\qsxs.rar
C:\Documents and Settings\EQ2\桌面\qsxs.rar ?RAR ?qsxs.exe ?NSIS ?my_70012.exe - probably a variant of Win32/TrojanDownloader.QQHelper.NDD trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\qsxs.rar ?RAR ?qsxs.exe ?NSIS ?dodolook080.exe ?NSIS ?1310.exe ?NSIS ?acpidisk.sys - a variant of Win32/Adware.Cinmus application - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\qsxs.rar ?RAR ?qsxs.exe ?NSIS ?ad2509.exe ?NSIS ?cpush.dll - Win32/Adware.BHO.AV application - was a part of the deleted object
Number of scanned files: 7
Number of threats found: 3
Number of files cleaned: 1
Time of completion: 12:07:27 Total scanning time: 1 sec (00:00:01)

tracydk

avast不报

rasis

my_70012.exe
      [DETECTION] Contains suspicious code HEUR/Malware


上报

xxwpk007

已检测到: 广告软件 not-a-virus:AdWare.Win32.BHO.av URL: http://bbs.kafan.cn/attachment.php?aid=105230//qsxs.exe//stream//data0003//stream//data0001

微点卫士

金山,费尔都挂!!!
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\MY_70012.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:4603
远端地址:58.211.7.36(江苏·苏州)
远端端口:80
程序:
C:\WINDOWS.0\SYSTEM32\DRIVERS\ACPIDISK.SYS
是否删除RootKit程序?
广告软件名称:AdWare.Win32.BHO.mz

程序:
C:\PROGRAM FILES\COMMON FILES\CPUSH\CPUSH.DLL
是广告软件!
已成功阻止其运行,是否要删除此文件?
要删除此类病毒需要重启系统,您是否需要重启机器?
广告软件名称:AdWare.Win32.BHO.mz

程序:
C:\PROGRAM FILES\COMMON FILES\CPUSH\CPUSH.TMP
是广告软件!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.078\QSXS.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\MY_70012.EXE
2) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\DODOLOOK080.EXE
3) C:\WINDOWS.0\SYSTEM32
\DRIVERS\ACPIDISK.SYS
4) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\AD2509.EXE
是否删除木马程序及其衍生物?'
好厉害的毒,不过微点,耶

scottxzt

DR 报告捆绑广告

欠妳緈諨

woai_jolin

[ 本帖最后由 woai_jolin 于 2007-7-26 12:30 编辑 ]

promised

这个江苏下载者变种不错