乱七八糟

promised

lx1234

2007-12-2,18:47:23 [WARNING] Contains detection pattern of the rootkit RKIT/Cinmus.M!
  F:\样本\样本\acpidik.sys
      [INFO] The file will be deleted.
2007-12-2,18:47:30 [WARNING] Contains detection pattern of the rootkit RKIT/Cinmus.M!
  F:\样本\样本\acpidisk.sys
      [INFO] The file will be deleted.
2007-12-2,18:47:36 [WARNING] Contains detection pattern of the dropper DR/BHO.CX.36!
  F:\样本\样本\ad1386.exe
      [INFO] The file will be deleted.
2007-12-2,18:47:38 [WARNING] Contains detection pattern of the rootkit RKIT/Agent.192000!
  F:\样本\样本\cnprov.sys
      [INFO] The file will be deleted.
2007-12-2,18:47:40 [WARNING] Contains detection pattern of the Ad- or Spyware ADSPY/Boran.Z.192!
  F:\样本\样本\idnaux.sys
      [INFO] The file will be deleted.
2007-12-2,18:47:46 [WARNING]  Suspicious file: Contains suspicious code HEUR/Malware!
  F:\样本\样本\MS_10258.exe
      [INFO] The file will be moved to quarantine.
2007-12-2,18:47:52 [WARNING]  Suspicious file: Contains suspicious code HEUR/Malware!
  F:\样本\样本\my_70133.exe
      [INFO] The file will be moved to quarantine.
2007-12-2,18:47:54 [WARNING] Is the Trojan horse TR/Rootkit.Gen!
  F:\样本\样本\p48pxt4.sys
      [INFO] The file will be deleted.
2007-12-2,18:47:57 [WARNING]  Suspicious file: Contains suspicious code HEUR/Malware!
  F:\样本\样本\pumqgzcpjcjvc.dll
2007-12-2,18:47:23 [WARNING] Is the Trojan horse TR/Spy.Gen!
  F:\样本\样本\2ahn9pzj.dll
      [INFO] The file will be deleted.
2007-12-2,18:48:00 [WARNING] Is the Trojan horse TR/Rootkit.Gen!
  F:\样本\样本\vnr6np2g.sys
      [INFO] The file will be deleted.

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： AdWare.Win32.cpush.g     
病毒： AdWare.Win32.Dodolook.fn
病毒： AdWare.Win32.EJok.o      
病毒： AdWare.Win32.EJok.k      

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.20.62

天灰

大蜘蛛报了10个

2ahn9pzj.dll;C:\Documents and Settings\77\My Documents\样本;可能 DLOADER.Trojan;;
ad1386.exe\data002;C:\Documents and Settings\77\My Documents\样本\ad1386.exe;Adware.Sogou;;
ad1386.exe;C:\Documents and Settings\77\My Documents\样本;发现档案文件中有受感染的对象;;
data002\data003;C:\Documents and Settings\77\My Documents\样本\ad_2386.exe\data002;Adware.Borlander;;
data002\data004;C:\Documents and Settings\77\My Documents\样本\ad_2386.exe\data002;Adware.Borlander.origin;;
data002;C:\Documents and Settings\77\My Documents\样本\ad_2386.exe;发现档案文件中有受感染的对象;;
ad_2386.exe;C:\Documents and Settings\77\My Documents\样本;发现档案文件中有受感染的对象;;
cnprov.sys;C:\Documents and Settings\77\My Documents\样本;Adware.Cdn;;
cpush.dll;C:\Documents and Settings\77\My Documents\样本;Adware.Sogou;;
idnaux.sys;C:\Documents and Settings\77\My Documents\样本;Adware.Cdn;;
idnreg.dll;C:\Documents and Settings\77\My Documents\样本;Adware.Cdn;;
MS_10258.exe;C:\Documents and Settings\77\My Documents\样本;Trojan.Click.origin;;
SlientInstall.exe\data005;C:\Documents and Settings\77\My Documents\样本\SlientInstall.exe;可能 DLOADER.Trojan;;
SlientInstall.exe;C:\Documents and Settings\77\My Documents\样本;发现档案文件中有受感染的对象;;

sam.to

已刪除: 廣告軟體 not-a-virus:AdWare.Win32.Cinmus.asd    檔案: C:\Documents and Settings\kato9096\桌面\样本\样本\0.exe//data0003
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.Cinmus.asd    檔案: C:\Documents and Settings\kato9096\桌面\样本\样本\0.exe//data0004
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.Cinmus.asd    檔案: C:\Documents and Settings\kato9096\桌面\样本\样本\acpidik.sys
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.BHO.cx    檔案: C:\Documents and Settings\kato9096\桌面\样本\样本\ad1386.exe//stream//data0001
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.Boran.bo    檔案: C:\Documents and Settings\kato9096\桌面\样本\样本\ad_2386.exe//stream//data0001
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.BHO.cx    檔案: C:\Documents and Settings\kato9096\桌面\样本\样本\cpush.dll
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.Cinmus.asd    檔案: C:\Documents and Settings\kato9096\桌面\样本\样本\dodolook005.exe//stream//data0002
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.Cinmus.asd    檔案: C:\Documents and Settings\kato9096\桌面\样本\样本\DoSSetup.dll
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Ieser.w    檔案: C:\Documents and Settings\kato9096\桌面\样本\样本\MS_10258.exe//PE_Patch.PECompact//PecBundle//PECompact//#
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Ieser.w    檔案: C:\Documents and Settings\kato9096\桌面\样本\样本\pumqgzcpjcjvc.dll

１０个，１８个沒报，已上报

v2006

windows  defender

nosferatu

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本'
C:\Documents and Settings\Administrator\桌面\样本\样本\2ahn9pzj.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\样本\样本\acpidik.sys
      [DETECTION] Contains detection pattern of the rootkit RKIT/Cinmus.M
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\样本\样本\acpidisk.sys
      [DETECTION] Contains detection pattern of the rootkit RKIT/Cinmus.M
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\样本\样本\ad1386.exe
      [DETECTION] Contains detection pattern of the dropper DR/BHO.CX.36
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\样本\样本\cnprov.sys
      [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.192000
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\样本\样本\cpush.dll
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY//BHO.CPush.A
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\样本\样本\idnaux.sys
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Boran.Z.192
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\样本\样本\MS_10258.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '47b1aca9.qua'!
C:\Documents and Settings\Administrator\桌面\样本\样本\my_70133.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '47b1accf.qua'!
C:\Documents and Settings\Administrator\桌面\样本\样本\p48pxt4.sys
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\样本\样本\pumqgzcpjcjvc.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '47bfaccb.qua'!
C:\Documents and Settings\Administrator\桌面\样本\样本\tempaq
      [DETECTION] Is the Trojan horse TR/Drop.RKit.AJ
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\样本\样本\vnr6np2g.sys
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [INFO]      The file was deleted!


End of the scan: 星期日 2007年12月2日  21:00
Used time: 00:08 min

The scan has been done completely.

      2 Scanning directories
     27 Files were scanned
     10 viruses and/or unwanted programs were found
      3 Files were classified as suspicious:
     10 files were deleted
      0 files were repaired
      3 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     17 Files not concerned
      0 Archives were scanned
      0 Warnings
      0 Notes

IllusionWing

uguard16个

UGuard Log (Digital Fox - gankeyu@126.com)
UGuarduu.exe = 4.5.6
HC0.rlb = 3.9.4
HC2.rlb = 2.4.0
FN0.rlb = 2.3.1
扫描选项：扫描档案, 扩展, 忽略非活动, 忽略大文件, nFile, BAT模拟, 捆绑检测, 变形壳, 启发,
[扫描] [iGene] 在 F:\Users\Administrator\Desktop\KAV\样本\样本\0.exe//DoSSSetup.dll 检测到 iGene.Possible.Cinmus
[扫描] [Level 2] 在 F:\Users\Administrator\Desktop\KAV\样本\样本\2ahn9pzj.dll 检测到 Downloader.Agent.hy
[扫描] [iGene] 在 F:\Users\Administrator\Desktop\KAV\样本\样本\57.exe//DoSSSetup.dll 检测到 iGene.Possible.Cinmus
[扫描] [Level 2] 在 F:\Users\Administrator\Desktop\KAV\样本\样本\ad1386.exe//cpush.tmp 检测到 Adware.NewPush
[扫描] [捆绑检测] 在 F:\Users\Administrator\Desktop\KAV\样本\样本\ad_2386.exe//InsShell.exe 检测到 Generic.Binder
[扫描] [捆绑检测] 在 F:\Users\Administrator\Desktop\KAV\样本\样本\cnprov.sys 检测到 Generic.Binder
[扫描] [Level 2] 在 F:\Users\Administrator\Desktop\KAV\样本\样本\cpush.dll 检测到 Adware.NewPush
[扫描] [iGene] 在 F:\Users\Administrator\Desktop\KAV\样本\样本\dodolook005.exe//0.exe//DoSSSetup.dll 检测到 iGene.Possible.Cinmus
[扫描] [iGene] 在 F:\Users\Administrator\Desktop\KAV\样本\样本\dodolook025.exe//57.exe//DoSSSetup.dll 检测到 iGene.Possible.Cinmus
[扫描] [iGene] 在 F:\Users\Administrator\Desktop\KAV\样本\样本\DoSSetup.dll 检测到 iGene.Possible.Cinmus
[扫描] [iGene] 在 F:\Users\Administrator\Desktop\KAV\样本\样本\DoSSSetup.dll 检测到 iGene.Possible.Cinmus
[扫描] [Level 2] 在 F:\Users\Administrator\Desktop\KAV\样本\样本\idnaux.sys 检测到 Risk.Cnnic
[扫描] [Level 2] 在 F:\Users\Administrator\Desktop\KAV\样本\样本\idnreg.dll 检测到 Adware.3721.b
[扫描] [Level 2] 在 F:\Users\Administrator\Desktop\KAV\样本\样本\MS_10258.exe 检测到 Trojan.Agent.azn
[扫描] [Level 2] 在 F:\Users\Administrator\Desktop\KAV\样本\样本\pumqgzcpjcjvc.dll 检测到 Trojan.Agent.azm
[扫描] [变形壳检测] 在 F:\Users\Administrator\Desktop\KAV\样本\样本\tempaq 检测到 Packed.Generic.UPX.Modified.1
检测到了 9 个未知的恶意程序，请上报。
任务 扫描 完成。共耗费的时间：0-00-00 00:00:11:0716，共扫描的文件数量：59，共扫描到的威胁数量：16，威胁率：27.12%，扫描速率： 5.04 文件/秒，扫描速度： 522.8 千字节/秒，共扫描了 6125.12 千字节。


kis8就3ge..
Detected        F:\Users\Administrator\Desktop\KAV\样本\样本\ad1386.exe//stream//data0001        Adware not-a-virus:AdWare.Win32.BHO.cx       
Detected        F:\Users\Administrator\Desktop\KAV\样本\样本\ad1386.exe//stream//data0001        Adware not-a-virus:AdWare.Win32.BHO.cx       
Detected        F:\Users\Administrator\Desktop\KAV\样本\样本\cpush.dll        Adware not-a-virus:AdWare.Win32.BHO.cx       
Detected        F:\Users\Administrator\Desktop\KAV\样本\样本\ad_2386.exe//stream//data0001        Adware not-a-virus:AdWare.Win32.Boran.bo

sam.to

Hello,

2ahn9pzj.dll, p48pxt4.sys, tempaq, vnr6np2g.sys - Trojan-Downloader.Win32.Hmir.km,
my_70011.exe_, suba.exe_ - Trojan-Downloader.Win32.Agent.fot

These files are already detected. Please update your antivirus bases.

57.exe_, acpidisk.sys, dodolook025.exe_, DoSSSetup.dll - not-a-virus:AdWare.Win32.Cinmus.aso

These files are Advertizing Tools, they are detected by
extended databases set. See more info about
extended databases here: http://www.kaspersky.com/extraavupdates

cnprov.sys, detoured.dll, idnaux.sys, idnreg.dll, SlientInstall.exe_

No malicious code were found in these files.

my_70133.exe_ - Trojan-Downloader.Win32.VB.bvu,
UADHelper.dll - Trojan-Dropper.Win32.Agent.cwc

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Namestnikov Yury
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.