Win32:Agent-RUJ [Trj]

显示全部楼层 · 发表于 2008-2-16 16:53:01

>>Http://Www.Qoogler.Com
>>>http://www.qoogler.com/Cercaqui.exe
>>>http://www.qoogler.com/Qoogler2008.exe

0D95404C-C067-4ecf-BB6D-AB6008717183这个CLSID是啥，qoogler.com利用的..

显示全部楼层 · 发表于 2008-2-16 16:53:46

F:\virus\Qoogler2008.rar » RAR » Qoogler2008.exe - a variant of Win32/TrojanClicker.Agent.NBI trojan
F:\virus\Qoogler2008.rar » RAR » Cercaqui.exe - a variant of Win32/TrojanClicker.Agent.NBI trojan

显示全部楼层 · 发表于 2008-2-16 16:54:15

F-PROT Antivirus for Windows

Antivirus Scanning Engine version number: 4.4.2
Virus signature file from: 2008-2-16, 4:21

Scan name: [Custom Scan]
Path to scan: F:\virus\Qoogler2008.rar

Normal scan
Also scan: Inside subfolders, Compressed files, Streams

Scan started: 2008-2-16, 16:53:45
---------------------------------------------------------------------

[Found possible virus] <W32/Dialer.TCS-behavior!Maximus (not disinfectable)> F:\virus\Qoogler2008.rar->Qoogler2008.exe->(UPX)
[Found possible virus] <W32/Dialer.TCS-behavior!Maximus (not disinfectable)> F:\virus\Qoogler2008.rar->Cercaqui.exe->(UPX)
[Contains infected objects] F:\virus\Qoogler2008.rar
[Quarantined] F:\virus\Qoogler2008.rar->Cercaqui.exe->(UPX)

---------------------------------------------------------------------
Scan ended: 2008-2-16, 16:53:47
Duration: 0:00:02

Scan result:

Scanned files:    1
Infected objects:    2
Disinfected objects:    0
Quarantined files:    1

显示全部楼层 · 发表于 2008-2-16 16:54:42

NOD 2个全灭
Win32/TrojanClicker.Agent.NBI

这网名

显示全部楼层 · 发表于 2008-2-16 16:57:03

detected: Trojan program Trojan-Clicker.Win32.Agent.qc File: C:\Documents and Settings\Owner\×ÀÃæ\Qoogler2008.rar/Qoogler2008.exe//PE_Patch.UPX//UPX
detected: Trojan program Trojan-Clicker.Win32.Agent.qc File: C:\Documents and Settings\Owner\×ÀÃæ\Qoogler2008.rar/Cercaqui.exe//PE_Patch.UPX//UPX

显示全部楼层 · 发表于 2008-2-16 17:02:02

FS结果: 找到 2 恶意软件
Trojan-Clicker.Win32.Agent.qc (病毒)
D:\Virus\Test\Cercaqui.exe 操作: 删除
D:\Virus\Test\Qoogler2008.exe 操作: 删除

显示全部楼层 · 发表于 2008-2-16 17:02:07

两个红伞都干掉啦。

显示全部楼层 · 发表于 2008-2-16 17:07:57

金山 MISS

显示全部楼层 · 发表于 2008-2-16 17:16:23

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\Qoogler2008.rar'
C:\Documents and Settings\Administrator\My Documents\
  Qoogler2008.rar
  Qoogler2008.rar:Zone.Identifier
[0] Archive type: RAR
--> Qoogler2008.exe
      [DETECTION] Is the Trojan horse TR/Click.Agent.QC.4
      [WARNING] Infected files in archives cannot be repaired!
--> Cercaqui.exe
      [DETECTION] Is the Trojan horse TR/Click.Agent.QC
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    The file was deleted!

显示全部楼层 · 发表于 2008-2-16 17:43:58

地址收藏了. 程序就不运行了, 运行也拦的住!

[病毒样本] Win32:Agent-RUJ [Trj]

本帖子中包含更多资源