偶来几个样本

显示全部楼层 · 发表于 2007-9-29 17:00:28

扫扫看

显示全部楼层 · 发表于 2007-9-29 17:01:13

LOGO1.EXE 空文件
DODOLOOK258.EXE Dudu下载加速器
MSCPX32R.DET Office配置文件

微塔过

[ 本帖最后由 FBAV 于 2007-9-29 17:02 编辑 ]

显示全部楼层 · 发表于 2007-9-29 17:11:50

空文件都来

显示全部楼层 · 发表于 2007-9-29 17:45:10

Begin scan in 'C:\Documents and Settings\dell\桌面\SYSTEM32.rar'
C:\Documents and Settings\dell\桌面\SYSTEM32.rar
  [0] Archive type: RAR
  --> DODOLOOK258.EXE
   [DETECTION] Contains detection pattern of the dropper DR/Agent.170156
   [INFO]    The file was successfully wiped!
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-9-29 18:24:15

2007-9-29 18:23:53 1191061433 Administrator 1724 Sign of "Win32:Cinmus-G [Adw]" has been found in "C:\Documents and Settings\Administrator\桌面\SYSTEM32.rar\DODOLOOK258.EXE\$TEMP\$TEMP\1564.exe\$TEMP\DoSSSetup.dll" file.
2007-9-29 18:23:56 1191061436 Administrator 1724 Sign of "Win32:Cinmus-J [Rtk]" has been found in "C:\Documents and Settings\Administrator\桌面\SYSTEM32.rar\DODOLOOK258.EXE\$TEMP\$TEMP\1564.exe\$TEMP\acpidisk.sys" file.
2007-9-29 18:23:56 1191061436 Administrator 1724 Sign of "Win32:Adware-gen. [Adw]" has been found in "C:\Documents and Settings\Administrator\桌面\SYSTEM32.rar\DODOLOOK258.EXE\$TEMP\$TEMP\1564.exe" file.

显示全部楼层 · 发表于 2007-9-29 19:10:39

detected: adware not-a-virus:AdWare.Win32.Cinmus.po URL: http://bbs.kafan.cn/attachment.p ... /data0002//data0001
detected: adware not-a-virus:AdWare.Win32.Cinmus.pd URL: http://bbs.kafan.cn/attachment.p ... /data0002//data0003
detected: adware not-a-virus:AdWare.Win32.Cinmus.pc URL: http://bbs.kafan.cn/attachment.p ... /data0002//data0004

显示全部楼层 · 发表于 2007-9-29 19:38:40

UGuard Log (Digital Fox - gankeyu@126.com)
UGuarduu.exe = 4.0.7
HC0.rlb = 2.8.9
HC2.rlb = 2.4.0
FN0.rlb = 2.3.1
扫描选项：扫描档案, 扩展, 忽略非活动, 忽略大文件, nFile, BAT模拟, 捆绑检测, 变形壳, 启发,
[扫描] [Level 2] 在 E:\Documents and Settings\Administrator\桌面\新建文件夹 (4)\SYSTEM32\DODOLOOK258.EXE 检测到 Adware.Dodo
任务扫描完成。共耗费的时间：0-00-00 00:00:00:0234，共扫描的文件数量：3，共扫描到的威胁数量：1，威胁率：0.33333333

显示全部楼层 · 发表于 2007-9-29 20:14:15

被kis 6.0.0.621殺掉!

显示全部楼层 · 发表于 2007-9-29 20:46:02

AdWare.Win32.Cinmus.po (adware)
C:\Users\Administrator\Desktop\SYSTEM32.rar\DODOLOOK258.EXE
fs发现1间谍

显示全部楼层 · 发表于 2007-9-29 20:47:38

广告？

[病毒样本] 偶来几个样本

本帖子中包含更多资源

本帖子中包含更多资源