360safe

显示全部楼层 · 发表于 2008-3-14 18:08:15

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\360safe.rar'
C:\Documents and Settings\Administrator\桌面\360safe.rar
  [0] Archive type: RAR
  --> real.exe
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Drop.Boran.I
  --> atloader.dll
   [DETECTION] Contains detection pattern of the application APPL/Yok.L
  --> urlcatch.dll
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Agent.36864.1
  --> autolive.dll
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Yok.A.1
  --> bhomgr.dll
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Agent.122880
  --> 360tray.exe
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Boran.I.19.A
  --> adx.dll
   [DETECTION] Is the Trojan horse TR/Killav.bikion.1
   [WARNING] The file was ignored!

End of the scan: 星期五 2008年3月14日  18:09
Used time: 00:09 min

The scan has been done completely.

   0 Scanning directories
   8 Files were scanned
   7 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   1 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-3-14 18:08:38

E:\VIRUS\360safe1.rar » RAR » real.exe - probably a variant of Win32/TrojanDropper.Agent trojan
E:\VIRUS\360safe1.rar » RAR » atloader.dll - probably a variant of Win32/TrojanClicker.Agent trojan
E:\VIRUS\360safe1.rar » RAR » 360tray.exe - probably a variant of Win32/TrojanClicker.Agent trojan

显示全部楼层 · 发表于 2008-3-14 18:08:58

前几天貌似已经测过这个样本

显示全部楼层 · 发表于 2008-3-14 18:10:19

C:\Documents and Settings\Administrator\桌面\360safe.rar>>360tray.exe Adware.BargainBuddy.qwp 广告程序还未处理
C:\Documents and Settings\Administrator\桌面\360safe.rar>>adx.dll Trojan.Adclicker.bayj.dll 木马还未处理
C:\Documents and Settings\Administrator\桌面\360safe.rar>>atloader.dll Trojan.Adclicker.rpla.dll 木马还未处理
C:\Documents and Settings\Administrator\桌面\360safe.rar>>autolive.dll Trojan.Adclicker.lmdu.dll 木马还未处理
C:\Documents and Settings\Administrator\桌面\360safe.rar>>bhomgr.dll Trojan.Adclicker.jyti.dll 木马还未处理
C:\Documents and Settings\Administrator\桌面\360safe.rar>>real.exe Trojan.Small.jgf.jgam.arc 木马还未处理
C:\Documents and Settings\Administrator\桌面\360safe.rar>>urlcatch.dll Adware.BargainBuddy.qwp.uc.dll 广告程序还未处理

显示全部楼层 · 发表于 2008-3-14 19:18:30

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Clicker.Adload.ey
病毒： AdWare.Win32.Agent.yyq
病毒： Trojan.Clicker.Adload.fe
病毒： Trojan.Small.jgf
病毒： Trojan.Mnless.kgy

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.35.41

显示全部楼层 · 发表于 2008-3-14 19:36:03

发过N次的样本了，不过卡巴死活不入库

显示全部楼层 · 发表于 2008-3-14 21:17:33

[Found backdoor] <W32/Backdoor2.OIZ (exact, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\360safe.rar->360tray.exe

显示全部楼层 · 发表于 2008-3-14 21:23:12

Virus: Trojan.Adclicker.AZ (2x), Trojan.Killav.BI (2x), Adware.YOK (2x), Adware.Yok.B (2x), Adware.Yok.C (2x), Adware.ADX (2x)
File: 360safe[1].rar
Directory: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\K04SZ800
Process: IEXPLORE.EXE

显示全部楼层 · 发表于 2008-3-14 21:30:17

"21:16" "文件监控" "文件" "EXPL_EXECOD.A" "C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\RF8CWCRA\count2[1].htm" "隔离未完成，单击威胁名称，以确定应该如何手动处理此安全威胁" ""
"21:28" "文件监控" "文件" "TROJ_SMALL.FQE" "real.exe (C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\RF8CWCRA\360safe[1].rar)" "隔离成功" ""
"21:28" "文件监控" "文件" "TROJ_GENERIC.APC" "atloader.dll (C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\RF8CWCRA\360safe[1].rar)" "隔离成功" ""
"21:28" "文件监控" "文件" "TROJ_GENERIC.APC" "urlcatch.dll (C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\RF8CWCRA\360safe[1].rar)" "隔离成功" ""
"21:28" "文件监控" "文件" "TROJ_GENERIC.APC" "autolive.dll (C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\RF8CWCRA\360safe[1].rar)" "隔离成功" ""
"21:28" "文件监控" "文件" "TROJ_GENERIC.APC" "bhomgr.dll (C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\RF8CWCRA\360safe[1].rar)" "隔离成功" ""
"21:28" "文件监控" "文件" "TROJ_GENERIC.APC" "360tray.exe (C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\RF8CWCRA\360safe[1].rar)" "隔离成功" ""
"21:28" "文件监控" "文件" "TROJ_GENERIC.APC" "adx.dll (C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\RF8CWCRA\360safe[1].rar)" "隔离成功" ""
"21:28" "文件监控" "文件" "---" "C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\RF8CWCRA\360safe[1].rar (C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\RF8CWCRA\360safe[1].rar)" "隔离未完成，单击威胁名称，以确定应该如何手动处理此安全威胁" ""
"21:28" "文件监控" "文件" "TROJ_SMALL.FQE" "real.exe (C:\Documents and Settings\Administrator\桌面\360safe.rar)" "隔离成功" ""
"21:28" "文件监控" "文件" "TROJ_GENERIC.APC" "atloader.dll (C:\Documents and Settings\Administrator\桌面\360safe.rar)" "隔离成功" ""
"21:28" "文件监控" "文件" "TROJ_GENERIC.APC" "urlcatch.dll (C:\Documents and Settings\Administrator\桌面\360safe.rar)" "隔离成功" ""
"21:28" "文件监控" "文件" "TROJ_GENERIC.APC" "autolive.dll (C:\Documents and Settings\Administrator\桌面\360safe.rar)" "隔离成功" ""
"21:28" "文件监控" "文件" "TROJ_GENERIC.APC" "bhomgr.dll (C:\Documents and Settings\Administrator\桌面\360safe.rar)" "隔离成功" ""
"21:28" "文件监控" "文件" "TROJ_GENERIC.APC" "360tray.exe (C:\Documents and Settings\Administrator\桌面\360safe.rar)" "隔离成功" ""
"21:28" "文件监控" "文件" "TROJ_GENERIC.APC" "adx.dll (C:\Documents and Settings\Administrator\桌面\360safe.rar)" "隔离成功" ""
"21:28" "文件监控" "文件" "---" "C:\Documents and Settings\Administrator\桌面\360safe.rar (C:\Documents and Settings\Administrator\桌面\360safe.rar)" "隔离成功" ""
趋势2008，下载完成后被隔离

[病毒样本] 360safe

本帖子中包含更多资源

回复 1楼 promised 的帖子

16/10