90880E附送广告

显示全部楼层 · 发表于 2007-9-10 21:16:27

2007-09-10 21:14:12 创建文件    操作:阻止
进程路径:D:\病毒库\CheckUpdate903\CheckUpdate903.exe
文件路径:C:\WINDOWS\system32\1ueskDL77.dll
触发规则:所有程序规则->文件规则->%systemdrive%\*.dll

2007-09-10 21:14:12 创建文件    操作:阻止
进程路径:D:\病毒库\CheckUpdate903\CheckUpdate903.exe
文件路径:C:\WINDOWS\system32\1ueskDL77.dll
触发规则:所有程序规则->文件规则->%systemdrive%\*.dll

2007-09-10 21:14:15 创建文件    操作:阻止
进程路径:D:\病毒库\CheckUpdate903\CheckUpdate903.exe
文件路径:C:\Windows\system32\wbem\RegServDll007.dll
触发规则:所有程序规则->文件规则->%systemdrive%\*.dll

2007-09-10 21:14:15 创建文件    操作:阻止
进程路径:D:\病毒库\CheckUpdate903\CheckUpdate903.exe
文件路径:C:\WINDOWS\DelSelf.bat
触发规则:所有程序规则->文件规则->%systemdrive%\*.bat

检测到：广告程序 not-a-virus:AdWare.Win32.AdMoke.gv URL: http://bbs.kafan.cn/attachment.php?aid=126237//CheckUpdate903.exe//ASPack

[ 本帖最后由 1688388728 于 2007-9-11 05:15 编辑 ]

显示全部楼层 · 发表于 2007-9-10 21:20:04

微点：
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\CHECKUPDATE903.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:4996
远端地址:61.153.35.117(浙江·金华)
远端端口:80
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\CHECKUPDATE903.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\WBEM\SXCHOTYDIO.DLL
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-9-10 21:48:01

Starting the file scan:

Begin scan in 'C:\Documents and Settings\ssy\桌面\CheckUpdate903.rar'
C:\Documents and Settings\ssy\桌面\CheckUpdate903.rar
  [0] Archive type: RAR
  --> CheckUpdate903.exe
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/MokeAd.CB.1
   [INFO]    A backup was created as '474a4b6d.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-9-10 21:51:23

Scan performed at: 2007-9-10 21:50:59
Scanning Log
NOD32 version 2519 (20070910) NT
Command line: C:\Documents and Settings\Don johnson\桌面\CheckUpdate903.rar
Operating memory - is OK

Date: 10.9.2007 Time: 21:51:03
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\CheckUpdate903.rar
C:\Documents and Settings\Don johnson\桌面\CheckUpdate903.rar ?RAR ?CheckUpdate903.exe - a variant of Win32/Adware.MoKeAD application
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 21:51:07 Total scanning time: 4 sec (00:00:04)

[病毒样本] 90880E附送广告

本帖子中包含更多资源

本帖子中包含更多资源