ONE

挪威的冬天

html 晚年不杀 唉。。。

信息        2008-02-04  15:28:59        您此次查毒共查出1个病毒以及危险代码                       
信息        2008-02-04  15:28:59        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件4个                       
信息        2008-02-04  15:28:59        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
病毒        2008-02-04  15:28:59        C:\Users\挪威的冬天\Desktop\2.rar\2\mm.exe        Win32.TrojDownloader.Agent.57344        跳过，未处理

Graybird

The file 'mm.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/Dldr.Agent.ibm.1. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.00.02.85. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Crypted.

冷冷

IK
I:\virus\2.rar:\2\14[1]2.htm - Signature 'Exploit.JS.ADODB.Stream' found
I:\virus\2.rar:\2\mm.exe - Signature 'Packed.Win32.Klone.af' found
I:\virus\2.rar
3 Files scanned
   (1 Archiv with 2 files)
2 Signatures found
0 Suspect code-parts found
Used time: 0:00.015

Graybird

Starting the file scan:

Begin scan in 'E:\2.rar'
E:\2.rar
  [0] Archive type: RAR
  --> 2\14[1]2.htm
      [DETECTION] Contains detection pattern of the HTML script virus HTML/ADODB.Exploit.Gen
  --> 2\mm.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.ibm.1
      [WARNING]   The file was ignored!

入库~

hj5abc

JS:ADODB-L [Expl]  

EXE送ALWIL了.

woai_jolin

2008-2-4 17:40:15        Kernel        File  'G:\v\2\mm.exe' was sent to ESET for analysis.