[MD5: DDC0FF EECDE0 5EF4CC F2C5C9]

显示全部楼层 · 发表于 2007-8-29 20:48:17

显示全部楼层 · 发表于 2007-8-29 20:52:54

这个网页由BitDefender 主要的监督阻拦了。

改变主要的监督设置，打开BitDefender 控制台，点击主控制 > 网页控制并且选择编辑，删除或例外。
BD报的是Behavelike

显示全部楼层 · 发表于 2007-8-29 20:53:46

已检测到: 木马程序 Trojan-PSW.Win32.Nilage.blr URL: http://bbs.kafan.cn/attachment.php?aid=120661//bjvllo.dll

显示全部楼层 · 发表于 2007-8-29 20:55:12

Begin scan in
082904.rar
  [0] Archive type: RAR
  --> bjvllo.dll
   [DETECTION] Is the Trojan horse TR/PSW.Nilage.blr.1
  --> d38.exe
   [DETECTION] Contains signature of the Ad- or Spyware ADSPY/BHO.AV.60
  --> 1C1B0207.exe
   [DETECTION] Contains signature of the dropper DR/BHO.CX.1
  --> netdde32.exe
   [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-8-29 20:56:38

Starting the file scan:

Begin scan in 'F:\病毒样本\082904.rar'
F:\病毒样本\082904.rar
  [0] Archive type: RAR
  --> bjvllo.dll
   [DETECTION] Is the Trojan horse TR/PSW.Nilage.blr.1
  --> d38.exe
   [DETECTION] Contains signature of the Ad- or Spyware ADSPY/BHO.AV.60
  --> 1C1B0207.exe
   [DETECTION] Contains signature of the dropper DR/BHO.CX.1
  --> netdde32.exe
   [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-8-29 21:10:12

已删除: 木马程序 Trojan-PSW.Win32.Nilage.blr 文件: E:\test\082904.rar/bjvllo.dll
已删除: 广告程序 not-a-virus:AdWare.Win32.BHO.dg 文件: E:\test\082904.rar/d38.exe//stream//data0001
已删除: 广告程序 not-a-virus:AdWare.Win32.BHO.cx 文件: E:\test\082904.rar/1C1B0207.exe//stream//data0001
已删除: 病毒 Heur.Trojan.Generic (变种) 文件: E:\test\082904.rar/netdde32.exe//PE_Patch.Upolyx//PE_Patch.UPX

显示全部楼层 · 发表于 2007-8-29 21:18:53

扫描进行于：2007-8-29 21:18:41
扫描日志
NOD32版本 2490 (20070829) NT
命令行： F:\Documents and Settings\beyond\桌面\082904.rar

日期： 29.8.2007 时间：21:18:44
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：F:\Documents and Settings\beyond\桌面\082904.rar
F:\Documents and Settings\beyond\桌面\082904.rar >>RAR >>d38.exe >>NSIS >>cpush.dll - 可能是 Win32/Adware.BHO.AV 应用程序的一个变种
F:\Documents and Settings\beyond\桌面\082904.rar >>RAR >>1C1B0207.exe >>NSIS >>cpush.dll - 可能是 Win32/Adware.BHO.AV 应用程序的一个变种
F:\Documents and Settings\beyond\桌面\082904.rar >>RAR >>netdde32.exe - 未查明的 NewHeur_PE 病毒 [7]
已扫描的文件数目：4
已发现的病毒数目：3
完成时间： 21:18:45 总扫描时间：1 秒 (00:00:01)

注意：
[7] 该文件可能感染上未知病毒。

显示全部楼层 · 发表于 2007-8-29 21:20:24

Ikarus:
29:08:2007 21:18:02 SEARCHTASK "USER_DEFINED" started...
scan item: C:\Documents and Settings\zhenjia\桌面\082904.rar
File scanned: C:\Documents and Settings\zhenjia\桌面\082904.rar:Zone.Identifier
File scanned: C:\Documents and Settings\zhenjia\桌面\082904.rar - SIGNATURE FOUND "Trojan-PWS.Win32.OnLineGames.es"
29:08:2007 21:18:02 SEARCHTASK "USER_DEFINED" FINISHED...
----------------------------------------------------
Directories scanned: 0
Files scanned: 1
Virus found: 1
----------------------------------------------------

显示全部楼层 · 发表于 2007-8-29 22:04:23

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Heuristics - OPEN
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder

C:\Documents and Settings\uhthn\Desktop\New Folder\bjvllo.dll - Suspicious of Trojan-PSW.OnLineGames.1
C:\Documents and Settings\uhthn\Desktop\New Folder\d38.exe - OK
C:\Documents and Settings\uhthn\Desktop\New Folder\1C1B0207.exe - OK
C:\Documents and Settings\uhthn\Desktop\New Folder\netdde32.exe - Suspicious of Win32.Trojan-PSW.OnLineGames.3

4 Files scanned
0 Infected files found
2 Suspicious files found
0 Files cured
0 Files deleted

显示全部楼层 · 发表于 2007-8-29 22:31:45

Result: 3 malware found
Trojan-PSW.Win32.Nilage.blr (virus)
C:\Documents and Settings\ssy\×ÀÃæ\082904.rar\bjvllo.dll
AdWare.Win32.BHO.dg (adware)
C:\Documents and Settings\ssy\×ÀÃæ\082904.rar\d38.exe
AdWare.Win32.BHO.cx (adware)
C:\Documents and Settings\ssy\×ÀÃæ\082904.rar\1C1B0207.exe

[病毒样本] [MD5: DDC0FF EECDE0 5EF4CC F2C5C9]

本帖子中包含更多资源