2个（MD5：13991c a99642）

显示全部楼层 · 发表于 2007-9-14 13:13:29

扫扫看

显示全部楼层 · 发表于 2007-9-14 13:15:47

nsis

欺负红伞么。。。。。

显示全部楼层 · 发表于 2007-9-14 13:23:19

Suspicious Files and Miscellaneous Uploads

Thank you for your submission. Below you can see the current status of the uploaded files.

--------------------------------------------------------------------------------

We received the following archive files:

File ID Filename Size (Byte) Result
1310942 ____.rar 246.6 KB KO

--------------------------------------------------------------------------------
Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.

显示全部楼层 · 发表于 2007-9-14 13:26:24

AVAST解包后报了一大堆

显示全部楼层 · 发表于 2007-9-14 13:27:56

应该都发过了

显示全部楼层 · 发表于 2007-9-14 13:28:46

原帖由 mofunzone 于 2007-9-14 13:27 发表
应该都发过了

你把别的报告也一并贴上来了
那个d1a是周版发的。。。。。。。。

显示全部楼层 · 发表于 2007-9-14 13:31:29

我把所有手动解出来的东西都发到这里，antivir漏了一个，已经上报

显示全部楼层 · 发表于 2007-9-14 13:33:31

原帖由 mofunzone 于 2007-9-14 13:31 发表
我把所有手动解出来的东西都发到这里，antivir漏了一个，已经上报

貌似还没有解完。。。。。。
1630.exe还有一层nsis

[ 本帖最后由风野胤于 2007-9-14 13:34 编辑 ]

显示全部楼层 · 发表于 2007-9-14 13:33:33

Starting the file scan:

Begin scan in 'D:\My Documents.rar'
D:\My Documents.rar
  [0] Archive type: RAR
  --> acpidisk.sys
   [DETECTION] Contains detection pattern of the rootkit RKIT/Cinmus.M
  --> Uninst.exe
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Boran.BD
  --> cpush.dll
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/BHO.EF
  --> DoSSSetup.dll
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Cinmus.JH
   [INFO]    The file was deleted!

End of the scan: 2007年9月13日  22:16
Used time: 00:07 min

The scan has been done completely.

   0 Scanning directories
   6 Files were scanned
   4 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   1 Archives were scanned

显示全部楼层 · 发表于 2007-9-14 13:33:47

微点：
广告软件名称:AdWare.Win32.Cinmus.azu

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ACPIDISK.SYS
是广告软件!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\木马病毒.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\NSY1C.TMP\SYSTEM.DLL
2) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\1630.EXE
3) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\DOSSSETUP.DLL
4) C:\WINDOWS.0\SYSTEM32\DRIVERS\ACPIDISK.SYS
是否删除木马程序及其衍生物?
广告软件名称:AdWare.Win32.Cinmus.azu

程序:
C:\WINDOWS.0\SYSTEM32\DRIVERS\ACPIDISK.SYS
是广告软件!
已成功阻止其运行,是否要删除此文件?
广告软件名称:AdWare.Win32.BHO.pj

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\流氓软件.EXE
是广告软件!
已成功阻止其运行,是否要删除此文件?

[病毒样本] 2个（MD5：13991c a99642）

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源