adware

显示全部楼层 · 发表于 2008-2-17 19:27:03

木马(Trojan.Adclicker.gpqe.arc): C:\Documents and Settings\Administrator\桌面\install.exe

显示全部楼层 · 发表于 2008-2-17 19:30:00

NOD
install.rar >>RAR >>install.exe >>NSIS >>cnsmin.dll - 可能是 Win32/Genetik 木马的一个变种

显示全部楼层 · 发表于 2008-2-17 19:31:56

这个已经发过了，http://bbs.kafan.cn/viewthread.php?tid=204738&extra=page%3D1

显示全部楼层 · 发表于 2008-2-17 19:32:02

卡巴不报，打包

显示全部楼层 · 发表于 2008-2-17 19:33:29

Begin scan in 'C:\Documents and Settings\Administrator\桌面\install.rar'
C:\Documents and Settings\Administrator\桌面\install.rar
  [0] Archive type: RAR
  --> install.exe
   [DETECTION] Is the Trojan horse TR/Drop.cns.B
   [INFO]    The file was deleted!

End of the scan: 2008年2月17日  19:33
Used time: 00:05 min

The scan has been done completely.

   0 Scanning directories
   2 Files were scanned
   1 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-2-17 19:35:58

IK pass

应用程序行为设置系统挂钩 2008/2/17 下午 07:33:00 D:\WINDOWS\system32\rundll32.exe D:\WINDOWS\DOWNLO~1\cnsmin.dll
应用程序行为设置系统挂钩 2008/2/17 下午 07:32:58 D:\WINDOWS\system32\rundll32.exe D:\WINDOWS\DOWNLO~1\cnsmin.dll
应用程序行为设置系统挂钩 2008/2/17 下午 07:32:57 I:\VS\VIRUS2\drive\D\Program Files\Yahoo!\Assistant\ylive.exe D:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll
应用程序行为设置系统挂钩 2008/2/17 下午 07:32:55 D:\WINDOWS\system32\rundll32.exe D:\WINDOWS\DOWNLO~1\cnsmin.dll
应用程序行为设置系统挂钩 2008/2/17 下午 07:32:53 I:\VS\VIRUS2\drive\D\Program Files\Yahoo!\Assistant\ylive.exe D:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll
应用程序行为设置系统挂钩 2008/2/17 下午 07:32:51 D:\WINDOWS\system32\rundll32.exe D:\WINDOWS\DOWNLO~1\cnsmin.dll
应用程序行为设置系统挂钩 2008/2/17 下午 07:32:50 I:\VS\VIRUS2\drive\D\Program Files\Yahoo!\Assistant\ylive.exe D:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll
应用程序行为设置系统挂钩 2008/2/17 下午 07:32:48 D:\WINDOWS\system32\rundll32.exe D:\WINDOWS\DOWNLO~1\cnsmin.dll
应用程序行为设置系统挂钩 2008/2/17 下午 07:32:47 I:\VS\VIRUS2\drive\D\Program Files\Yahoo!\Assistant\ylive.exe D:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll
应用程序行为设置系统挂钩 2008/2/17 下午 07:32:44 I:\VS\VIRUS2\drive\D\Program Files\Yahoo!\Assistant\ylive.exe D:\Program Files\Yahoo!\Assistant\assist\ypatch.dll
应用程序行为设置系统挂钩 2008/2/17 下午 07:32:44 D:\WINDOWS\system32\rundll32.exe D:\WINDOWS\DOWNLO~1\cnsmin.dll
应用程序行为设置系统挂钩 2008/2/17 下午 07:32:40 D:\WINDOWS\system32\rundll32.exe D:\WINDOWS\DOWNLO~1\cnsmin.dll
应用程序行为设置系统挂钩 2008/2/17 下午 07:32:39 I:\VS\VIRUS2\drive\D\Program Files\Yahoo!\Assistant\ylive.exe D:\Program Files\Yahoo!\Assistant\assist\ypatch.dll
应用程序行为网络存取 2008/2/17 下午 07:32:38 I:\virus\February\17\install\install.exe 203.209.234.73
应用程序行为底层磁盘存取 2008/2/17 下午 07:32:34 I:\virus\February\17\install\install.exe \??\PhysicalDrive0
应用程序行为设置系统挂钩 2008/2/17 下午 07:32:33 D:\WINDOWS\system32\rundll32.exe D:\WINDOWS\DOWNLO~1\cnsmin.dll
应用程序行为设置系统挂钩 2008/2/17 下午 07:32:32 I:\VS\VIRUS2\drive\D\Program Files\Yahoo!\Assistant\ylive.exe D:\Program Files\Yahoo!\Assistant\assist\ypatch.dll
应用程序行为底层磁盘存取 2008/2/17 下午 07:32:27 I:\virus\February\17\install\install.exe \??\PhysicalDrive0
应用程序行为网络存取 2008/2/17 下午 07:32:25 I:\virus\February\17\install\install.exe 127.0.0.1
应用程序行为网络存取 2008/2/17 下午 07:32:22 I:\virus\February\17\install\install.exe 127.0.0.1
应用程序行为网络存取 2008/2/17 下午 07:31:53 I:\virus\February\17\install\install.exe 127.0.0.1
应用程序行为网络存取 2008/2/17 下午 07:31:42 I:\virus\February\17\install\install.exe 127.0.0.1
应用程序行为网络存取 2008/2/17 下午 07:31:40 I:\virus\February\17\install\install.exe 127.0.0.1

显示全部楼层 · 发表于 2008-2-17 19:55:29

rising20.31.50未知！

楼主重复转啦？？

显示全部楼层 · 发表于 2008-2-17 20:02:36

Hello.
No malicious software was found in the attached file.
-----------------
Regards, Vladimir Krylov
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com http://www.viruslist.com

显示全部楼层 · 发表于 2008-2-17 20:04:46

Windows Defender 报金山估计由于某种原因 MISS

Category:
Spyware

Description:
This program has potentially unwanted behavior.

Advice:
Remove this software immediately.

Resources:
file:
C:\Users\挪威的冬天\Desktop\install.rar->install.exe->(nsis-6-cnsmin.dll)

webfile:
C:\Users\挪威的冬天\Desktop\install.rar|http://bbs.kafan.cn/attachment.php?aid=202520

containerfile:
C:\Users\挪威的冬天\Desktop\install.rar

View more information about this item online

显示全部楼层 · 发表于 2008-2-17 20:09:54

原帖由 kato9096 于 2008-2-17 20:02 发表
Hello.
No malicious software was found in the attached file.
-----------------
Regards, Vladimir Krylov
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
ht ...

这些不用上报卡巴

[病毒样本] adware

本帖子中包含更多资源

15/0