样本连接

绅博周幸

http://www.ittool.cn/down/d1a.exe

mofunzone

水一下

欠妳緈諨

也水一个

Redevil

我来传吧

绅博周幸

Starting the file scan:

Begin scan in 'D:\d1a.rar'
D:\d1a.rar
  [0] Archive type: RAR
    --> d1a.exe
      [1] Archive type: RAR SFX (self extracting)
      --> 1005_1017_0501_1-231.exe
          [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Cdnup.G
      --> ad_2314.exe
          [DETECTION] Contains detection pattern of the dropper DR/Boran.AS.3
      --> d008.exe
          [DETECTION] Contains detection pattern of the dropper DR/Dldr.QQHelper.adk.1
      --> my_70059.exe
          [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!


End of the scan: 2007年9月13日  21:47
Used time: 00:09 min

The scan has been done completely.

      0 Scanning directories
      9 Files were scanned
      3 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      6 Files not concerned
      2 Archives were scanned
      1 Warnings
      0 Notes

微点卫士

微点：
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RARSFX0\DODOLOOK006.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
广告软件名称:AdWare.Win32.BHO.pj

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RARSFX0\AD4326.EXE
是广告软件!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\D1A.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RARSFX0\1005_1017_0501_1-231.EXE
2) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\22\CNDSV.DLL
3) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\22\CNPROV.SYS
4) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\22\CNPROVH.DLL
5) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\22\CONFIG.EXE
6) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\22\CONVS.DLL
7) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\22\IDNREG.DLL
8) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\22\IDNSVR.DLL
9) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\22\IDNSVR.EXE
10) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\22\IEAUX.DLL11) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\22\LOADER.EXE
12) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\22\SETUP.DLL
13) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\22\SETUP.EXE
14) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RARSFX0\AD_2314.EXE15) C:\PROGRAM FILES\OLNW\YVXG.DLL
16) C:\PROGRAM FILES\OLNW\BYAJ.DLL
17) C:\PROGRAM FILES\OLNW\DACL.DLL
18) C:\PROGRAM FILES\OLNW\GDFO.DLL
19) C:\PROGRAM FILES\OLNW\URTC.DLL
20) C:\~DE21.TMP
21) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RARSFX0\SETUP1164.EXE
22) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RARSFX0\D008.EXE23) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RARSFX0\MY_70059.EXE
是否删除木马程序及其衍生物?
木马名称:Trojan-Downloader.Win32.QQHelper.ftp

程序:
C:\WINDOWS.0\SYSTEM32\INF\UNISTALL64.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
广告软件名称:AdWare.Win32.BHO.pk

程序:
C:\PROGRAM FILES\COMMON FILES\CPUSH\CPUSH.DLL
是广告软件!
已成功阻止其运行,是否要删除此文件?
广告软件名称:AdWare.Win32.BHO.pk

程序:
C:\PROGRAM FILES\COMMON FILES\CPUSH\CPUSH.TMP
是广告软件!
已成功阻止其运行,是否要删除此文件?

东西好多啊
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\D1A.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RARSFX0\DODOLOOK006.EXE
2) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RARSFX0\1005_1017_0501_1-231.EXE
3) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RARSFX0\AD_2314.EXE
4) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RARSFX0\SETUP1164.EXE
5) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RARSFX0\D008.EXE
6) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RARSFX0\MY_70059.EXE
7) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RARSFX0\AD4326.EXE
是否删除木马程序及其衍生物?

kp2006

瑞星2008报6个

红心王子

2007-9-14        13:43:19        1189748599        Administrator        1936        Sign of "Win32:Cinmus-G [Adw]" has been found in "C:\Documents and Settings\Administrator\桌面\d1a.rar\d1a.exe\dodolook006.exe\$TEMP\$TEMP\1630.exe\$TEMP\DoSSSetup.dll" file.  
2007-9-14        13:43:23        1189748603        Administrator        1936        Sign of "Win32:Cinmus-J [Rtk]" has been found in "C:\Documents and Settings\Administrator\桌面\d1a.rar\d1a.exe\dodolook006.exe\$TEMP\$TEMP\1630.exe\$TEMP\acpidisk.sys" file.  
2007-9-14        13:43:27        1189748607        Administrator        1936        Sign of "Win32:Adware-gen. [Adw]" has been found in "C:\Documents and Settings\Administrator\桌面\d1a.rar\d1a.exe\dodolook006.exe\$TEMP\$TEMP\1630.exe" file.  
2007-9-14        13:43:30        1189748610        Administrator        1936        Sign of "Win32:Adware-gen. [Adw]" has been found in "C:\Documents and Settings\Administrator\桌面\d1a.rar\d1a.exe\1005_1017_0501_1-231.exe\[ASPack]\[Embedded#007040]" file.  
2007-9-14        13:43:33        1189748613        Administrator        1936        Sign of "Win32:Boran-N [Adw]" has been found in "C:\Documents and Settings\Administrator\桌面\d1a.rar\d1a.exe\ad_2314.exe\$TEMP\Insshell.exe\[Embedded#3d3d8]" file.  
2007-9-14        13:43:36        1189748616        Administrator        1936        Sign of "Win32:Boran-N [Adw]" has been found in "C:\Documents and Settings\Administrator\桌面\d1a.rar\d1a.exe\ad_2314.exe\$TEMP\Insshell.exe\[Embedded#b23d8]" file.  
2007-9-14        13:43:38        1189748618        Administrator        1936        Sign of "Win32:Boran-N [Adw]" has been found in "C:\Documents and Settings\Administrator\桌面\d1a.rar\d1a.exe\ad_2314.exe\$TEMP\Insshell.exe" file.  
2007-9-14        13:43:41        1189748621        Administrator        1936        Sign of "Win32:Agent-BPB [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\d1a.rar\d1a.exe\d008.exe\$SYSDIR\inf\Unistall64.exe" file.  
2007-9-14        13:43:43        1189748623        Administrator        1936        Sign of "Win32:BHO-GG [Adw]" has been found in "C:\Documents and Settings\Administrator\桌面\d1a.rar\d1a.exe\d008.exe\$SYSDIR\inf\d03.exe\$COMMONFILES\CPUSH\cpush.dll" file.  
2007-9-14        13:43:44        1189748624        Administrator        1936        Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\Documents and Settings\Administrator\桌面\d1a.rar\d1a.exe\d008.exe" file.  
2007-9-14        13:43:46        1189748626        Administrator        1936        Sign of "Win32:BHO-GG [Adw]" has been found in "C:\Documents and Settings\Administrator\桌面\d1a.rar\d1a.exe\ad4326.exe\$COMMONFILES\CPUSH\cpush.dll" file.

moonsilver

下载过了，呵呵

qieyige

我再传一下！