找QQ游戏外挂时发现的！

hookon_miriam

小A Win32:Agent-JCL [Trj]

SONGBOWEN

Begin scan in 'C:\Documents and Settings\Administrator\桌面\multi_mydown1026.rar'
C:\Documents and Settings\Administrator\桌面\multi_mydown1026.rar
  [0] Archive type: RAR
  --> multi_mydown1026.exe
      [DETECTION] Contains detection pattern of the dropper DR/Dldr.Small.dca.3
      [WARNING]   The file was ignored!



检测到：木马程序 Trojan-Downloader.Win32.Small.dca        文件: C:\Documents and Settings\Administrator\桌面\multi_mydown1026.rar/multi_mydown1026.exe//stream//data0006
检测到：木马程序 Trojan-Downloader.Win32.QQHelper.dv        文件: C:\Documents and Settings\Administrator\桌面\multi_mydown1026.rar/multi_mydown1026.exe//stream//data0009

stream什么意思啊？NTFS流？不是吧？！

SONGBOWEN

从里边拆出来的几个文件……

SONGBOWEN

从里边拆出来的几个文件……

cy6266812

AVAST扫描时报8次

qigang

Trojan.DL.Agent.zni

Trojan.DL.Agent.blq

Graybird

原帖由 SONGBOWEN 于 2007-11-22 18:29 发表
从里边拆出来的几个文件……

Filename	Result
nsExec.dll	KNOWN CLEAN

The file 'nsExec.dll' has been determined to be 'KNOWN CLEAN'. In particular this means that we could not find any malicious content. Please note that the file is part of 'NSIS 2.19'.

Filename	Result
bind.bat	CLEAN

The file 'bind.bat' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.

Filename	Result
song.bat	CLEAN

The file 'song.bat' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.

[ 本帖最后由 Graybird 于 2007-11-22 20:05 编辑 ]

BING126

McAfee miss

ballakay

Scanning Report22 November 2007 21:39:04 - 21:39:08Computer name: PUMA-PC
Scanning type: Scan target
Target: C:\Users\Administrator\Desktop\multi_mydown1026.rar Result: 1 malware foundTrojan-Downloader.Win32.QQHelper.dv (virus)

• C:\Users\Administrator\Desktop\multi_mydown1026.rar\multi_mydown1026.exe

StatisticsScanned:

• Files: 2
• Not scanned: 0

Result:

• Viruses: 1
• Spyware: 0
• Suspicious items: 0
• Riskware: 0

Actions:

• Disinfected: 0
• Renamed: 0
• Deleted: 0
• Quarantined: 0
• Failed: 0

Boot Sectors:

• Scanned: 0
• Infected: 0
• Suspicious items: 0
• Disinfected: 0

OptionsDefinitions version:

• Viruses: 2007-11-17_02
• Spyware: 2007-11-16_06

Scanning Engines:

• F-Secure AVP: 7.00.171, 2007-11-16
• F-Secure Libra: 2.04.01, 2007-11-17
• F-Secure Orion: 1.02.37, 2007-11-17
• F-Secure Draco: 1.00.35, 2007-10-30

Scanning options:

• Scan all files
• Scan inside archives

Actions:

• Viruses: Delete infected files
• Spyware: Delete infected files