MD5: E06B39

自由

Hello,

dodolook367.exe_ - not-a-virus:AdWare.Win32.Cinmus.ah

This file is an Advertizing Tool, It's detection will be included in the next
update

moonsilver

送上去

微点卫士

微点：
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\DODOLOOK367.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\NSL13.TMP\SYSTEM.DLL
2) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\1415.EXE
是否删除木马程序及其衍生物?

The EQs

tracydk

东京时空

NIS2007飘过。。。。。。。。。。

tracydk

诺顿在样本区都是习惯性的飘过的

promised

C:\ABC\样本\dodolook367\[NSIS].nsi
C:\ABC\样本\dodolook367\$PLUGINSDIR\System.dll
C:\ABC\样本\dodolook367\$TEMP\$TEMP\1415.exe - 特征码 'not-a-virus:AdWare.Win32.Cinmus.f' 被发现

        4 文件被扫描
          (0 压缩档 0 文件)
        1 特征码被侦测
        0 可疑代码段被发现
        耗时: 0:00.047

lsyer

杀软的实际意义不是"病毒区表现"
当有病毒靠杀软repair不了的时候
会想念诺顿的...
相对来说
诺顿属于稳重型的~

jlennon

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-8-5
Start time: 2007-8-13 18:35
Engine(s): KAV engine (AVK 17.6645), BD-Engine (BD 17.4586)
Heuristic: On
Archives: On
System areas: Off

Check selected directories and files...
Object: stream/data0002 data0003
        In archive: C:\Documents and Settings\Administrator\桌面\样本\dodolook367.exe
        Status: Virus detected
        Virus: not-a-virus:AdWare.Win32.Cinmus.ah (KAV engine)
Object: stream/data0002 data0004
        In archive: C:\Documents and Settings\Administrator\桌面\样本\dodolook367.exe
        Status: Virus detected
        Virus: not-a-virus:AdWare.Win32.Cinmus.ah (KAV engine)
Object: (NSIS o)=>lzma_solid_nsis0002=>(NSIS o) lzma_nsis0000
        In archive: C:\Documents and Settings\Administrator\桌面\样本\dodolook367.exe
        Status: Virus detected
        Virus: Trojan.Cinmeng.A (BD-Engine)
Object: (NSIS o)=>lzma_solid_nsis0002=>(NSIS o) lzma_nsis0002
        In archive: C:\Documents and Settings\Administrator\桌面\样本\dodolook367.exe
        Status: Virus detected
        Virus: Generic.Adw.Cinmus.2.7ABCE8A3 (BD-Engine)
Object: dodolook367.exe
        Path: C:\Documents and Settings\Administrator\桌面\样本
        Status: Move file into quarantine
        Virus: not-a-virus:AdWare.Win32.Cinmus.ah (2x) (KAV engine), Trojan.Cinmeng.A, Generic.Adw.Cinmus.2.7ABCE8A3 (BD-Engine)
Analysis complete: 2007-8-13 18:35
    1 files checked
    1 infected files detected
    0 suspected files detected