升级utorrent到3.1.2.28086居然安装时被COMODO扫出病毒还清除不了

显示全部楼层 · 发表于 2012-11-6 19:31:11

本帖最后由 klhp 于 2012-11-7 15:42 编辑

如题，奇怪的是红伞实时监控居然也没报毒，，然后上网搜索“BunndleOfferManager.dll”，居然发现http://www.hkepc.com/forum/viewthread.php?tid=1787373这个帖子，上http://r.virscan.org/563be776ce9ca3588260cb9c1dd77625看坚持结果几个杀软都有报毒，现在的BT国外软件怎么也这么流氓？另外红伞扫描整个C盘居然也没发现危险，怪事。。

问下，这个检测出的BunndleOfferManagerment.dll有哪些具体危害？用utorrent的朋友是否有遇到？谁有utorrent官网原版3.2build27825或更旧稳定版的下载？还有别的较好的BT软件没，各位推荐下~

显示全部楼层 · 发表于 2013-1-2 22:17:07

为什么没人看

显示全部楼层 · 发表于 2013-1-2 22:24:45

目前版本3.2.3安装后没有这个文件的

显示全部楼层 · 发表于 2013-1-2 22:26:23

危险行为监控
行为描述：运行后删除自身，警惕恶意软件
附加信息：无
其他行为监控
行为描述：检测是否存在指定注册表键
附加信息：HKEY_CURRENT_USER\Software\Classes\http\shell\open\commandHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script\FeaturesHKEY_LOCAL_MACHINE\Software\Bunndle
行为描述：创建进程
附加信息：%system%\cmd.exe
行为描述：添加开机自启动项
附加信息：[NULL] - %ProgramFiles%\BunndleOfferManager.dll
行为描述：查找文件
附加信息："%temp%""%temp%\Bunndle"
文件操作监控
操作文件MD5 文件大小文件路径
新增 cb20bccab8cc0691af6b93476aaf3922 1364 %temp%\Bunndle\Bunndle.log
进程操作监控
创建进程："%system%\cmd.exe"
启动参数：""%system%\cmd.exe" /c set /p x= & del /f /s "%ProgramFiles%\BunndleOfferManager.dll""
新增删除修改注册表监控
HKEY_CLASSES_ROOT\Bunndle.BunndleOfferManager
[(NULL)] = [BunndleOfferManager Class]
HKEY_CLASSES_ROOT\Bunndle.BunndleOfferManager.1
[(NULL)] = [BunndleOfferManager Class]
HKEY_CLASSES_ROOT\Bunndle.BunndleOfferManager.1\CLSID
[(NULL)] = [{FA6DC595-39EE-45E6-BC91-1E4D385ABB11}]
HKEY_CLASSES_ROOT\Bunndle.BunndleOfferManager\CLSID
[(NULL)] = [{FA6DC595-39EE-45E6-BC91-1E4D385ABB11}]
HKEY_CLASSES_ROOT\Bunndle.BunndleOfferManager\CurVer
[(NULL)] = [Bunndle.BunndleOfferManager.1]
HKEY_CLASSES_ROOT\CLSID\{FA6DC595-39EE-45E6-BC91-1E4D385ABB11}
[AppID] = [{2C9E6EB4-45BD-4855-A0C2-4614D4C49DBA}]
[(NULL)] = [BunndleOfferManager Class]
HKEY_CLASSES_ROOT\CLSID\{FA6DC595-39EE-45E6-BC91-1E4D385ABB11}\Control
无
HKEY_CLASSES_ROOT\CLSID\{FA6DC595-39EE-45E6-BC91-1E4D385ABB11}\InprocServer32
[ThreadingModel] = [Apartment]
[(NULL)] = [%ProgramFiles%\BunndleOfferManager.dll]
HKEY_CLASSES_ROOT\CLSID\{FA6DC595-39EE-45E6-BC91-1E4D385ABB11}\MiscStatus
[(NULL)] = [0]
HKEY_CLASSES_ROOT\CLSID\{FA6DC595-39EE-45E6-BC91-1E4D385ABB11}\MiscStatus\1
[(NULL)] = [131473]
HKEY_CLASSES_ROOT\CLSID\{FA6DC595-39EE-45E6-BC91-1E4D385ABB11}\ProgID
[(NULL)] = [Bunndle.BunndleOfferManager.1]
HKEY_CLASSES_ROOT\CLSID\{FA6DC595-39EE-45E6-BC91-1E4D385ABB11}\Programmable
无
HKEY_CLASSES_ROOT\CLSID\{FA6DC595-39EE-45E6-BC91-1E4D385ABB11}\TypeLib
[(NULL)] = [{BE75CD6E-0AC6-4D57-ACDD-48FD1ADB7711}]
HKEY_CLASSES_ROOT\CLSID\{FA6DC595-39EE-45E6-BC91-1E4D385ABB11}\VersionIndependentProgID
[(NULL)] = [Bunndle.BunndleOfferManager]
HKEY_CLASSES_ROOT\Interface\{253B2114-DE9E-42A9-9C73-533E24FC788E}
[(NULL)] = [IBunndleOfferManager]
HKEY_CLASSES_ROOT\Interface\{253B2114-DE9E-42A9-9C73-533E24FC788E}\ProxyStubClsid
[(NULL)] = [{00020424-0000-0000-C000-000000000046}]
HKEY_CLASSES_ROOT\Interface\{253B2114-DE9E-42A9-9C73-533E24FC788E}\ProxyStubClsid32
[(NULL)] = [{00020424-0000-0000-C000-000000000046}]
HKEY_CLASSES_ROOT\Interface\{253B2114-DE9E-42A9-9C73-533E24FC788E}\TypeLib
[(NULL)] = [{BE75CD6E-0AC6-4D57-ACDD-48FD1ADB7711}]
[Version] = [1.0]
HKEY_CLASSES_ROOT\Interface\{4C47163B-0755-4FBD-B805-F446558A34BB}
[(NULL)] = [IBunndleOfferManager2]
HKEY_CLASSES_ROOT\Interface\{4C47163B-0755-4FBD-B805-F446558A34BB}\ProxyStubClsid
[(NULL)] = [{00020424-0000-0000-C000-000000000046}]
HKEY_CLASSES_ROOT\Interface\{4C47163B-0755-4FBD-B805-F446558A34BB}\ProxyStubClsid32
[(NULL)] = [{00020424-0000-0000-C000-000000000046}]
HKEY_CLASSES_ROOT\Interface\{4C47163B-0755-4FBD-B805-F446558A34BB}\TypeLib
[(NULL)] = [{BE75CD6E-0AC6-4D57-ACDD-48FD1ADB7711}]
[Version] = [1.0]
HKEY_CLASSES_ROOT\Interface\{68A77467-3411-4C5A-BDCA-7B0233097FFB}
[(NULL)] = [IInstallScriptHelper]
HKEY_CLASSES_ROOT\Interface\{68A77467-3411-4C5A-BDCA-7B0233097FFB}\ProxyStubClsid
[(NULL)] = [{00020424-0000-0000-C000-000000000046}]
HKEY_CLASSES_ROOT\Interface\{68A77467-3411-4C5A-BDCA-7B0233097FFB}\ProxyStubClsid32
[(NULL)] = [{00020424-0000-0000-C000-000000000046}]
HKEY_CLASSES_ROOT\Interface\{68A77467-3411-4C5A-BDCA-7B0233097FFB}\TypeLib
[(NULL)] = [{BE75CD6E-0AC6-4D57-ACDD-48FD1ADB7711}]
[Version] = [1.0]
HKEY_CLASSES_ROOT\TypeLib\{BE75CD6E-0AC6-4D57-ACDD-48FD1ADB7711}
无
HKEY_CLASSES_ROOT\TypeLib\{BE75CD6E-0AC6-4D57-ACDD-48FD1ADB7711}\1.0
[(NULL)] = [BunndleOfferManager 1.0 Type Library]
HKEY_CLASSES_ROOT\TypeLib\{BE75CD6E-0AC6-4D57-ACDD-48FD1ADB7711}\1.0\0
无
HKEY_CLASSES_ROOT\TypeLib\{BE75CD6E-0AC6-4D57-ACDD-48FD1ADB7711}\1.0\0\win32
[(NULL)] = [%ProgramFiles%\BunndleOfferManager.dll]
HKEY_CLASSES_ROOT\TypeLib\{BE75CD6E-0AC6-4D57-ACDD-48FD1ADB7711}\1.0\FLAGS
[(NULL)] = [0]
HKEY_CLASSES_ROOT\TypeLib\{BE75CD6E-0AC6-4D57-ACDD-48FD1ADB7711}\1.0\HELPDIR
[(NULL)] = [%ProgramFiles%]
HKEY_CURRENT_USER\Software\Microsoft\Windows Script
无
HKEY_CURRENT_USER\Software\Microsoft\Windows Script\Settings
[JITDebug] = [0x00000000]
HKEY_LOCAL_MACHINE\SOFTWARE\Bunndle
[SystemGuid] = [{1CA85352-936C-4315-80BE-7038636583C0}]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Bunndle.BunndleOfferManager
[(NULL)] = [BunndleOfferManager Class]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Bunndle.BunndleOfferManager.1
[(NULL)] = [BunndleOfferManager Class]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Bunndle.BunndleOfferManager.1\CLSID
[(NULL)] = [{FA6DC595-39EE-45E6-BC91-1E4D385ABB11}]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Bunndle.BunndleOfferManager\CLSID
[(NULL)] = [{FA6DC595-39EE-45E6-BC91-1E4D385ABB11}]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Bunndle.BunndleOfferManager\CurVer
[(NULL)] = [Bunndle.BunndleOfferManager.1]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA6DC595-39EE-45E6-BC91-1E4D385ABB11}
[AppID] = [{2C9E6EB4-45BD-4855-A0C2-4614D4C49DBA}]
[(NULL)] = [BunndleOfferManager Class]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA6DC595-39EE-45E6-BC91-1E4D385ABB11}\Control
无
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA6DC595-39EE-45E6-BC91-1E4D385ABB11}\InprocServer32
[ThreadingModel] = [Apartment]
[(NULL)] = [%ProgramFiles%\BunndleOfferManager.dll]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA6DC595-39EE-45E6-BC91-1E4D385ABB11}\MiscStatus
[(NULL)] = [0]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA6DC595-39EE-45E6-BC91-1E4D385ABB11}\MiscStatus\1
[(NULL)] = [131473]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA6DC595-39EE-45E6-BC91-1E4D385ABB11}\ProgID
[(NULL)] = [Bunndle.BunndleOfferManager.1]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA6DC595-39EE-45E6-BC91-1E4D385ABB11}\Programmable
无
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA6DC595-39EE-45E6-BC91-1E4D385ABB11}\TypeLib
[(NULL)] = [{BE75CD6E-0AC6-4D57-ACDD-48FD1ADB7711}]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA6DC595-39EE-45E6-BC91-1E4D385ABB11}\VersionIndependentProgID
[(NULL)] = [Bunndle.BunndleOfferManager]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{253B2114-DE9E-42A9-9C73-533E24FC788E}
[(NULL)] = [IBunndleOfferManager]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{253B2114-DE9E-42A9-9C73-533E24FC788E}\ProxyStubClsid
[(NULL)] = [{00020424-0000-0000-C000-000000000046}]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{253B2114-DE9E-42A9-9C73-533E24FC788E}\ProxyStubClsid32
[(NULL)] = [{00020424-0000-0000-C000-000000000046}]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{253B2114-DE9E-42A9-9C73-533E24FC788E}\TypeLib
[Version] = [1.0]
[(NULL)] = [{BE75CD6E-0AC6-4D57-ACDD-48FD1ADB7711}]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4C47163B-0755-4FBD-B805-F446558A34BB}
[(NULL)] = [IBunndleOfferManager2]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4C47163B-0755-4FBD-B805-F446558A34BB}\ProxyStubClsid
[(NULL)] = [{00020424-0000-0000-C000-000000000046}]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4C47163B-0755-4FBD-B805-F446558A34BB}\ProxyStubClsid32
[(NULL)] = [{00020424-0000-0000-C000-000000000046}]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4C47163B-0755-4FBD-B805-F446558A34BB}\TypeLib
[Version] = [1.0]
[(NULL)] = [{BE75CD6E-0AC6-4D57-ACDD-48FD1ADB7711}]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{68A77467-3411-4C5A-BDCA-7B0233097FFB}
[(NULL)] = [IInstallScriptHelper]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{68A77467-3411-4C5A-BDCA-7B0233097FFB}\ProxyStubClsid
[(NULL)] = [{00020424-0000-0000-C000-000000000046}]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{68A77467-3411-4C5A-BDCA-7B0233097FFB}\ProxyStubClsid32
[(NULL)] = [{00020424-0000-0000-C000-000000000046}]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{68A77467-3411-4C5A-BDCA-7B0233097FFB}\TypeLib
[(NULL)] = [{BE75CD6E-0AC6-4D57-ACDD-48FD1ADB7711}]
[Version] = [1.0]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BE75CD6E-0AC6-4D57-ACDD-48FD1ADB7711}
无
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BE75CD6E-0AC6-4D57-ACDD-48FD1ADB7711}\1.0
[(NULL)] = [BunndleOfferManager 1.0 Type Library]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BE75CD6E-0AC6-4D57-ACDD-48FD1ADB7711}\1.0\0
无
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BE75CD6E-0AC6-4D57-ACDD-48FD1ADB7711}\1.0\0\win32
[(NULL)] = [%ProgramFiles%\BunndleOfferManager.dll]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BE75CD6E-0AC6-4D57-ACDD-48FD1ADB7711}\1.0\FLAGS
[(NULL)] = [0]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BE75CD6E-0AC6-4D57-ACDD-48FD1ADB7711}\1.0\HELPDIR
[(NULL)] = [%ProgramFiles%

显示全部楼层 · 发表于 2013-1-2 23:23:06

只是个捆绑的广告吧，记得这个东东安装的时候，可以让用户选择装不装的吧。现在用迅雷了，几年没用过了

显示全部楼层 · 发表于 2013-1-3 19:11:46

darkwolf_99 发表于 2013-1-2 23:23
只是个捆绑的广告吧，记得这个东东安装的时候，可以让用户选择装不装的吧。现在用迅雷了，几年没用过了

安装时我没有勾选的，但是依然被毛豆报了，应该是强制捆绑，utorrent论坛有人抗议过，不过官方言之凿凿全是英文看不太懂

[求助] 升级utorrent到3.1.2.28086居然安装时被COMODO扫出病毒还清除不了

本帖子中包含更多资源