kv2008系统诊断功能发现的隐藏病毒文件

显示全部楼层 · 发表于 2007-10-12 15:12:03

快杀

网络信息

电影看不成了

悬赏分：0 - 解决时间：2007-7-26 08:14
瑞星提示dao2530.tlb程序企图利用ie自动执行。
文件路径C:\program files\common files\microsoft shared\dao
选择同意也看不成，不同意也看不成，每次都会弹出。奇怪的是影片前的广告却可以看,若点击了,第二次就看不成了,不执行,第二次也看不成了

这个dao2530.tlb绝对不是系统进程，更恰当的讲就是木马。其实就是个自动弹出的广告罢了。也可以称为插件问题。首先把你的播放器删除，谨慎起见，在注册表里也把它的遗留注册信息也删除掉，如果有的话。然后把该文件彻底删掉，重启，再用反木马工具查杀一次系统盘，安装可靠来源的播放软件

微点论坛

创智数码VOD播放控件当木马???(解决)

创智数码VOD播放控件 real2asf 当未知木马,以前是安装没事,播放时候出现这提示:C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
2007-06-05 12:36:10       用户取消,并永远有效       未知木马       C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\DAO\DAO2530.TLB       C:\WINDOWS\SYSTEM32\PFAUDIODMO.DLL

最近安装的时候都提示未知木马了,火的,有毒的话,全湖州都中毒了整整1年了,浙江湖州电信的公众影院,请管理员确认下.

这电影控件全名:Real2Asf_Client_AllInOne.exe 大小:3.50 MB (3,672,883 字节)
应该和网上搜索到的一样大小的.我通过邮件发一份给管理员你.

www.huvod.net 浙江湖州南太湖影院(电信)

25.037 - 进程 IEXPLORE.EXE 依赖的非微软模块 - dao2530.tlb，Unknow Owner，
相关文件：(隐藏)(系统)C:\program files\common files\microsoft shared\DAO\dao2530.tlb

VirSCAN.org Scanned Report :
Scanner results: 6%的杀软(2/34)报告发现病毒
File Name    : dao2530.rar
File Size    : 50174 byte
File Type    : RAR archive data, v1d, os
MD5          : 0f79eba175c10cef70d93a321e725b35
SHA1          : 642d2ff8166abd3f9ef294ab37b8f25c077fdb12
Online report  : http://virscan.org/report.php?id=0f79eba175c10cef70d93a321e725b35
Scanner       Engine Ver    Sig Ver          Sig Date Time Scan result
a-squared    3.0.0.123    2007.10.11       2007-10-11  6.01 -
AntiVir       7.6.0.20       7.0.0.80       2007-10-12  2.67 -
Arcavir       1.0.4          200710111656    2007-10-11  1.84 -
AVAST       1.0.8          000780-2       2007-10-11  3.08 -
AVG          7.5.49.442    269.14.7/1062    2007-10-10  1.90 -
BitDefender 7.60825.899703  7.15256          2007-10-12  3.45 -
CA (VET)    8.4.0.24       31.2.5204       2007-10-12  0.94 -
ClamAV       0.91.2       4530             2007-10-12  1.81 -
Comodo       2.11          2.0.0.311       2007-10-12  1.12 -
Dr.WEB       4.33          2007.10.11       2007-10-11  6.47 -
ewido       4.0.0.2       2007.10.11       2007-10-11  2.12 -
F-PROT       4.4.0.50       20071011       2007-10-11  1.26 -
F-SECURE    5.51.6100    2007.10.11.05    2007-10-11  0.05 -
飞塔          2.81-3.11    8.220          2007-10-11  0.40 Suspicious
ViRobot       20071011       2007.10.11       2007-10-11  1.09 -
IKARUS       T3.1.1.12    2007.10.11.69652  2007-10-11  1.50 -
江民杀毒    10.00.650    2007.10.08       2007-10-08  1.04 -
卡巴斯基    5.5.10       2007.10.12       2007-10-12  0.04 -
金山毒霸    2007.6.20.249 2007.10.12       2007-10-12  0.96 -
迈克菲       5.2.00       5139             2007-10-11  0.88 -
MKS_VIR       2.01          2007.10.11       2007-10-11  3.42 -
NOD32       2.70.10       2587             2007-10-11  0.01 -
NORMAN       5.91.08       5.90             2007-10-11  5.57 -
熊猫卫士    9.04.03.0001 2007.10.11       2007-10-11  6.88 Suspicious file
趋势          8.500-1001    4.771.00       2007-10-11  0.04 -
Prevx       V2             20071012       2007-10-12  8.84 -
QuickHeal    9.00          2007.10.11       2007-10-11  4.12 -
瑞星          19.0          19.44.40.00    2007-10-11  2.66 -
SOPHOS       2.49.1       4.21             2007-10-12  3.52 -
赛门铁克    1.3.0.24       20071011.021    2007-10-11  1.15 -
nProtect    2007-10-11.01 970912          2007-10-11  21.42  -
The Hacker    6.2.8          v00086          2007-10-11  2.11 -
VBA32       3.12.2.4       20071011.0939    2007-10-11  0.80 -
VirusBuster 4.3.19:9       9.109.2/11.0    2007-10-11  1.12 -

[ 本帖最后由 kp2006 于 2007-10-12 15:34 编辑 ]

显示全部楼层 · 发表于 2007-10-12 15:13:53

miss上报

显示全部楼层 · 发表于 2007-10-12 15:15:41

File:	dao2530.tlb
Status:	OK
MD5:	c4e9e98d1f73fd6bdc5452af78cb9cc2
Packers detected:	-
Bit9 reports:	File not found

Scanner results
Scan taken on 12 Oct 2007 07:14:25 (GMT)
A-Squared	Found nothing
AntiVir	Found nothing
ArcaVir	Found nothing
Avast	Found nothing
AVG Antivirus	Found nothing
BitDefender	Found nothing
ClamAV	Found nothing
CPsecure	Found nothing
Dr.Web	Found nothing
F-Prot Antivirus	Found nothing
F-Secure Anti-Virus	Found nothing
Fortinet	Found nothing
Kaspersky Anti-Virus	Found nothing
NOD32	Found nothing
Norman Virus Control	Found nothing
Panda Antivirus	Found nothing
Rising Antivirus	Found nothing
Sophos Antivirus	Found nothing
VirusBuster	Found nothing
VBA32	Found nothing

显示全部楼层 · 发表于 2007-10-12 15:30:12

可能是误报？

显示全部楼层 · 发表于 2007-10-12 19:56:38

RX19.44.42未查杀。

显示全部楼层 · 发表于 2007-10-12 20:00:16

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\WINCHECK071008.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\WINCHECK071008.EXE
2) C:\WINDOWS.0\SYSTEM32\WCHECK.DLL
3) C:\WINDOWS.0\SYSTEM32\WINCHECK071008.DLL
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-10-12 20:45:07

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 503
Paranoia Database - 10368
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\dao2530.tlb

C:\Documents and Settings\uhthn\Desktop\dao2530.tlb - Suspected Trojan-Downloader.Agent.1

1 Files scanned
0 Infected files found
1 Suspected files found
0 Files cured
0 Files deleted

显示全部楼层 · 发表于 2007-10-12 21:43:15

dao2530.tlb

No malicious code was found in this file.

Please quote all when answering.

--
Best regards, Vyacheslav Zakorzhevsky
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

[病毒样本] kv2008系统诊断功能发现的隐藏病毒文件

本帖子中包含更多资源