Adware更新了

wolffshen

详见这帖：http://bbs.kafan.cn/viewthread.php?tid=205847&;extra=page%3D1
4001.exe是释放文件，其他2个文件是生成物

Antivirus	Version	Last Update	Result
AhnLab-V3	2008.2.20.0	2008.02.20	-
AntiVir	7.6.0.67	2008.02.20	-
Authentium	4.93.8	2008.02.21	-
Avast	4.7.1098.0	2008.02.20	Win32:Baidubar-B
AVG	7.5.0.516	2008.02.21	Adware Generic2.AAJE
BitDefender	7.2	2008.02.21	-
CAT-QuickHeal	9.50	2008.02.20	-
ClamAV	0.92.1	2008.02.21	-
DrWeb	4.44.0.09170	2008.02.20	-
eSafe	7.0.15.0	2008.02.20	-
eTrust-Vet	31.3.5551	2008.02.21	-
Ewido	4.0	2008.02.20	Downloader.Adload
FileAdvisor	1	2008.02.21	-
Fortinet	3.14.0.0	2008.02.19	-
F-Prot	4.4.2.54	2008.02.20	-
F-Secure	6.70.13260.0	2008.02.21	-
Ikarus	T3.1.1.20	2008.02.21	Virus.Win32.Baidubar.B
Kaspersky	7.0.0.125	2008.02.21	-
McAfee	5234	2008.02.20	-
Microsoft	1.3204	2008.02.20	-
NOD32v2	2891	2008.02.21	Win32/TrojanDownloader.Adload.NEW
Norman	5.80.02	2008.02.20	-
Panda	9.0.0.4	2008.02.20	Suspicious file
Rising	20.32.22.00	2008.02.20	-
Sophos	4.26.0	2008.02.21	-
Sunbelt	3.0.884.0	2008.02.19	-
Symantec	10	2008.02.21	-
TheHacker	6.2.9.225	2008.02.21	-
VBA32	3.12.6.1	2008.02.17	-
VirusBuster	4.3.26:9	2008.02.20	Adware.Baidubar.Gen.2
Webwasher-Gateway	6.6.2	2008.02.20	-

[ 本帖最后由 wolffshen 于 2008-2-21 12:57 编辑 ]

spaceplane

BD飘

mofunzone

v7没杀出来4001？

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\SkypeClient.exe'
C:\Documents and Settings\Administrator\My Documents\
  SkypeClient.exe
Begin scan in 'C:\Documents and Settings\Administrator\My Documents\4001.exe'
C:\Documents and Settings\Administrator\My Documents\
  4001.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The fund was classified as suspicious.
      [WARNING]   The file was ignored!
Begin scan in 'C:\Documents and Settings\Administrator\My Documents\olesoeawcgxha.dll'
C:\Documents and Settings\Administrator\My Documents\
  olesoeawcgxha.dll


End of the scan: 2008年2月20日  21:01
Used time: 00:05 min

The scan has been done completely.

      0 Scanning directories
      3 Files were scanned
      0 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      0 Archives were scanned
      1 Warnings
      0 Notes

mofunzone

SkypeClient.exe  57.13 KB  CLEAN

sam.to

上报卡巴

Graybird

Starting the file scan:

Begin scan in 'E:\Antivir\4001.exe'
E:\Antivir\4001.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!
Begin scan in 'E:\Antivir\olesoeawcgxha.dll'
Begin scan in 'E:\Antivir\SkypeClient.exe'

挪威的冬天

信息        2008-02-21  13:21:01        您此次查毒共查出1个病毒以及危险代码                       
信息        2008-02-21  13:21:01        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件2个                       
信息        2008-02-21  13:21:01        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
风险程序        2008-02-21  13:21:01        C:\Users\挪威的冬天\Desktop\Ad\4001.exe        Win32.Adware.EjokT.ty.1214976        跳过，未处理

啊弥陀佛

木马名称:未知后门程序
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\AD[1]\OLESOEAWCGXHA.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

sam.to

Hello,

4001.exed - Trojan-Downloader.Win32.Ieser.cb,
olesoeawcgxha.dll - Trojan-Downloader.Win32.Ieser.cc

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

SkypeClient.exed

No malicious code was found in this file.

Please quote all when answering.

--
Best regards, Denis Maslennikov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

Graybird

The file '4001.exe' has been determined to be 'MALWARE'. Our analysts discovered that the file is a Trojan. In general this kind of programs contains harmful functionality called payload. Detection will be added to our virus definition file (VDF) with one of the next updates. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Malware.

The file 'olesoeawcgxha.dll' has been determined to be 'MALWARE'. Our analysts discovered that the file is a Trojan. In general this kind of programs contains harmful functionality called payload. Detection will be added to our virus definition file (VDF) with one of the next updates.

The file 'SkypeClient.exe' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.