[97BA9A]qqhelper

显示全部楼层 · 发表于 2007-9-8 10:06:41

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\sob.zip'
C:\Documents and Settings\Administrator\桌面\sob.zip
  [0] Archive type: ZIP
  --> sob.exe
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    The file was moved to '4744041b.qua'!

End of the scan: 2007年9月8日  10:06
Used time: 00:09 min

The scan has been done completely.

   0 Scanning directories
   2 Files were scanned
   0 viruses and/or unwanted programs were found
   1 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   1 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-9-8 10:08:33

费尔

显示全部楼层 · 发表于 2007-9-8 10:31:38

fsis pass

显示全部楼层 · 发表于 2007-9-8 11:02:39

微点：
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SOB.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:2245
远端地址:58.211.7.36(江苏·苏州)
远端端口:80
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TEMPAQ
协议类型:TCP
本地地址:0.0.0.0
本地端口:2287
远端地址:58.211.7.35(江苏·苏州)
远端端口:80
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SOB.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TEMPAQ
2) C:\WINDOWS.0\SYSTEM32\DRIVERS\1DML4U7.SYS
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-9-8 11:15:23

nod32 pass

显示全部楼层 · 发表于 2007-9-8 12:03:23

avast!不认识

显示全部楼层 · 发表于 2007-9-8 12:51:29

Virus infection found

File which you are trying download contains virus. Loading has been interrupted.
Technical data:
Error name: Virus Alert
Virus description Downloader.Generic6.BVU
Error code: -1602
Requested URL: /attachment.php?aid=125119
Requested HTTP method: GET
Requested ContentType: application/x-zip-compressed

显示全部楼层 · 发表于 2007-9-8 16:08:44

已删除：木马程序 Trojan-Downloader.Win32.QQHelper.adj 文件　: G:\Temp\9.8\sob.zip/sob.exe

[病毒样本] [97BA9A]qqhelper

本帖子中包含更多资源

浏览过的版块