捆了10个左右

显示全部楼层 · 发表于 2008-2-12 12:32:02

来自华军软件园..
avast
Win32:Trojan-gen {VC}
Win32:Trojan-gen {Other}
Win32:Trojan-gen {VC}
Win32:Hengbang [Adw] <--拼音拼错了

Win32:Adware-gen [Adw]
Win32:Adware-gen [Adw]
Win32:Adware-gen [Adw]
Win32:Agent-GII [Trj]
Win32:Trojan-gen {Other}
Win32:Trojan-gen {Other}

[ 本帖最后由 qianwenxiang 于 2008-2-12 12:33 编辑 ]

显示全部楼层 · 发表于 2008-2-12 12:36:57

江民0
执行0

显示全部楼层 · 发表于 2008-2-12 12:38:26

The file 'hardinfo.exe' has been determined to be 'UNDER ANALYSIS'.

上报~

显示全部楼层 · 发表于 2008-2-12 12:39:01

FS扫描过
蜘蛛报1个

显示全部楼层 · 发表于 2008-2-12 12:48:03

结果: 找到 1 恶意软件
Trojan-Downloader.Win32.Agent.ayn (病毒)
D:\Virus\Test\d\hardinfo.exe 操作: 删除

显示全部楼层 · 发表于 2008-2-12 12:54:17

file C:\Program Files\???????\is-S55S8.tmp Win32/Adware.AllSum application deleted - quarantined
file C:\Program Files\???????\is-UST45.tmp Win32/Adware.Hengbang application deleted - quarantined
file C:\Program Files\???????\is-IDALP.tmp Win32/Small.IO trojan cleaned by deleting - quarantined
file C:\Program Files\???????\is-T7HDD.tmp probably a variant of Win32/TrojanDownloader.Agent trojan cleaned by deleting - quarantined
file C:\Program Files\???????\is-5G8K6.tmp Win32/TrojanDownloader.Agent.AYN trojan cleaned by deleting - quarantined

显示全部楼层 · 发表于 2008-2-12 13:59:27

2008-2-12 13:59:29 Real-time file system protection file C:\Sandbox\Administrator\DefaultBox\drive\C\Program Files\硬件信息查询器\is-3VB5V.tmp Win32/Adware.AllSum application deleted - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temp\is-VT7FL.tmp\is-1O1QD.tmp.
2008-2-12 13:59:26 Real-time file system protection file C:\Sandbox\Administrator\DefaultBox\drive\C\Program Files\硬件信息查询器\is-B0A72.tmp Win32/Adware.Hengbang application deleted - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temp\is-VT7FL.tmp\is-1O1QD.tmp.
2008-2-12 13:59:24 Real-time file system protection file C:\Sandbox\Administrator\DefaultBox\drive\C\Program Files\硬件信息查询器\is-CD5UL.tmp Win32/Small.IO trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temp\is-VT7FL.tmp\is-1O1QD.tmp.
2008-2-12 13:59:22 Real-time file system protection file C:\Sandbox\Administrator\DefaultBox\drive\C\Program Files\硬件信息查询器\is-73QPH.tmp probably a variant of Win32/TrojanDownloader.Agent trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temp\is-VT7FL.tmp\is-1O1QD.tmp.
2008-2-12 13:59:18 Real-time file system protection file C:\Sandbox\Administrator\DefaultBox\drive\C\Program Files\硬件信息查询器\is-36OD5.tmp Win32/TrojanDownloader.Agent.AYN trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temp\is-VT7FL.tmp\is-1O1QD.tmp.

显示全部楼层 · 发表于 2008-2-12 14:04:53

已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Agent.ayn 檔案: C:\Documents and Settings\kato9096\桌面\201535\hardinfo.exe//file15
已刪除: 特洛伊木馬程式 Trojan-Downloader.NSIS.QQHelper.r 檔案: C:\Documents and Settings\kato9096\桌面\201535\hardinfo.exe//file16//data0001
已刪除: 特洛伊木馬程式 Trojan.Win32.Small.io 檔案: C:\Documents and Settings\kato9096\桌面\201535\hardinfo.exe//file17
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.Hengbang.t 檔案: C:\Documents and Settings\kato9096\桌面\201535\hardinfo.exe//file19/hbcast.dll
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.AllSum.c 檔案: C:\Documents and Settings\kato9096\桌面\201535\hardinfo.exe//file20//data0004
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.AllSum.a 檔案: C:\Documents and Settings\kato9096\桌面\201535\hardinfo.exe//file20//data0006
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.AllSum.c 檔案: C:\Documents and Settings\kato9096\桌面\201535\hardinfo.exe//file20//data0007

7,沒有不报

显示全部楼层 · 发表于 2008-2-12 15:05:53

金山解不了包不报

显示全部楼层 · 发表于 2008-2-12 16:16:43

The file 'hardinfo.exe' has been determined to be 'MALWARE'. Our analysts named the threat DR/Dldr.Agent.ayn. The term "DR/" denotes a program that is able to place a virus or a malware discretely on a system.Detection is added to our virus definition file (VDF) starting with version 7.00.02.121.

[病毒样本] 捆了10个左右

本帖子中包含更多资源

回复 3楼 Graybird 的帖子