安装包里捉到的样本

显示全部楼层 · 发表于 2008-2-5 11:51:49

安装包里捉到的样本

對樣本不感興趣

對那個安裝包超感興趣

但如果是綑綁型的就算了

[ 本帖最后由 kuririn 于 2008-2-5 11:57 编辑 ]

显示全部楼层 · 发表于 2008-2-5 11:53:16

Hello,

QBHXGOQQGY.DLL - not-a-virus:AdWare.Win32.Ejik.be

This file is an Advertizing Tool, It's detection will be included in the next
update of extended databases set. See more info about
extended databases here: http://www.kaspersky.com/extraavupdates

SKYPE3076.exek - Trojan-Downloader.Win32.Ieser.bl

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vladimir Krylov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

显示全部楼层 · 发表于 2008-2-5 11:59:11

信息 2008-02-05  11:58:15 您此次查毒共查出1个病毒以及危险代码
信息 2008-02-05  11:58:15 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件5个
信息 2008-02-05  11:58:15 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
风险程序 2008-02-05  11:58:15 C:\Users\挪威的冬天\Desktop\新建文件夹1\SKYPE3076.EXE Win32.Adware.AdmokeT.n.512 跳过，未处理

显示全部楼层 · 发表于 2008-2-5 13:14:48

Sign of "Win32:Baidubar-B [Trj]" has been found in "F:\新建文件夹.rar\SKYPE3076.EXE\[PECompact]\[Embedded#1]" file.

显示全部楼层 · 发表于 2008-2-5 13:27:35

rising20.30未认得！

显示全部楼层 · 发表于 2008-2-5 13:36:23

IK
I:\virus\新建文件夹.rar:\QBHXGOQQGY.DLL - Suspect code-parts found (Level: 155)
I:\virus\新建文件夹.rar:\SKYPE3076.EXE - Signature 'Virus.Win32.Baidubar.B' found
I:\virus\新建文件夹.rar
3 Files scanned
(1 Archiv with 2 files)
1 Signature found
1 Suspect code-part found
Used time: 0:00.172

-----------------------------------------------
安装到一半就没动了

显示全部楼层 · 发表于 2008-2-5 13:49:17

江民杀毒软件报告文件

北京江民新科技术有限公司

扫描引擎 11.00.703
病毒库日期 2008-02-05
更新日期 2008-02-05

扫描目标 C:\Documents and Settings\Administrator\桌面\新建文件夹.rar

开始时间 2008-02-05 13:47:19

在 C:\Documents and Settings\Administrator\桌面\新建文件夹.rar->QBHXGOQQGY.DLL 中发现 TrojanDownloader.Agent.yip 病毒, 已删除
正常结束。

扫描结果:
               文件数 :603                               病毒体 :1
               删除 :1                                  解毒 :0
扫描速度(千字节/秒) :20290                            扫描时间 :00:00:08
扫描文件速度(个/秒) :75

显示全部楼层 · 发表于 2008-2-5 16:16:32

The file 'QBHXGOQQGY.DLL' has been determined to be 'MALWARE'. Our analysts named the threat TR/BHO.Delf.K. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

The file 'SKYPE3076.EXE' has been determined to be 'MALWARE'. Our analysts named the threat DR/BHO.PS. The term "DR/" denotes a program that is able to place a virus or a malware discretely on a system.Detection will be added to our virus definition file (VDF) with one of the next updates. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Malware.

显示全部楼层 · 发表于 2008-2-5 16:51:31

风险程序 2008-02-05 16:51:00 C:\Documents and Settings\Administrator\桌面\新建文件夹.rar\SKYPE3076.EXE Win32.Adware.AdmokeT.n.512 跳过，未处理

显示全部楼层 · 发表于 2008-2-5 18:42:10

已检测到: 广告程序 not-a-virus:AdWare.Win32.Ejik.be URL: http://bbs.kafan.cn/attachment.php?aid=196537//QBHXGOQQGY.DLL

[病毒样本] 安装包里捉到的样本

本帖子中包含更多资源

回复 2楼 Graybird 的帖子