流氓一个

solcroft

冷冷

沙發

終于有沙發啦
-----------------------------
CAV、IK【PASS】
----------------------------


[ 本帖最后由 冷_冷 于 2008-1-28 23:05 编辑 ]

wangjay1980

detected: adware not-a-virus:AdWare.Win32.Vapsup.akm        URL: http://bbs.kafan.cn/attachment.p ... exe//stream//Script

傻猪猪米走鸡

E:\virus\install_cb.zip » ZIP » install_cb.exe » NSIS » Entries.bin - is OK
E:\virus\install_cb.zip » ZIP » install_cb.exe » NSIS » Strings.txt - is OK
E:\virus\install_cb.zip » ZIP » install_cb.exe » NSIS » System.dll - is OK
E:\virus\install_cb.zip » ZIP » install_cb.exe » NSIS » install.bat - is OK
E:\virus\install_cb.zip » ZIP » install_cb.exe » NSIS » elrp.exe - is OK
E:\virus\install_cb.zip » ZIP » install_cb.exe » NSIS » ffvrdgt.exe - is OK
E:\virus\install_cb.zip » ZIP » install_cb.exe » NSIS » adsoowf.dll - is OK
E:\virus\install_cb.zip » ZIP » install_cb.exe » NSIS » bgrlsmn.dll - is OK
E:\virus\install_cb.zip » ZIP » install_cb.exe » NSIS » ekxdvft.dll - is OK
E:\virus\install_cb.zip » ZIP » install_cb.exe » NSIS » dntpkwodpx.dll - is OK

sam.to

已刪除: 廣告軟體 not-a-virus:AdWare.Win32.Vapsup.akm        檔案: C:\Documents and Settings\kato9096\桌面\install_cb.zip/install_cb.exe//stream//Script

ballakay

FS 飘了!赶紧上报!

鱼是一只我

江民杀了～～

taiw_1144

发现未知木马
程序:
C:\DOCUMENTS AND SETTINGS\WO\LOCAL SETTINGS\TEMP\RAR$EX00.359\INSTALL_CB.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\WO\LOCAL SETTINGS\TEMP\AC8ZT2\ELRP.EXE
2) C:\DOCUMENTS AND SETTINGS\WO\LOCAL SETTINGS\TEMP\AC8ZT2\FFVRDGT.EXE
3) C:\DOCUMENTS AND SETTINGS\WO\LOCAL SETTINGS\TEMP\AC8ZT2\ADSOOWF.DLL
4) C:\DOCUMENTS AND SETTINGS\WO\LOCAL SETTINGS\TEMP\AC8ZT2\BGRLSMN.DLL

发现未知后门程序
程序:
C:\WINDOWS\DNTPKWODPX.DLL
是否删除木马程序及其衍生物?

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\SAMPLE-18.rar'
C:\Documents and Settings\Administrator\My Documents\
  SAMPLE-18.rar
  SAMPLE-18.rar:Zone.Identifier
    [0] Archive type: RAR
    --> adsoowf.dll
    --> bgrlsmn.dll
        [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Agent.PB
        [WARNING]   Infected files in archives cannot be repaired!
    --> dntpkwodpx.dll
    --> ekxdvft.dll
    --> ffvrdgt.exe
        [DETECTION] Is the Trojan horse TR/Dldr.Zlob.Gen
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!


End of the scan: 2008年1月28日  07:20
Used time: 00:04 min

The scan has been done completely.

      0 Scanning directories
      7 Files were scanned
      2 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      5 Files not concerned
      1 Archives were scanned
      3 Warnings
      0 Notes

挪威的冬天

Windows Defender 报
金山 miss

又是个国外流行样本吧