3pcs

显示全部楼层 · 发表于 2008-3-28 11:02:15

广告后更精彩！

显示全部楼层 · 发表于 2008-3-28 11:04:47

Scanned file: ad.rar - Infected
ad.rar/ad/ad7549.exe/data0001 - OK
ad.rar/ad/ad7549.exe/data0002 - infected by not-a-virus:AdWare.Win32.BHO.afu
ad.rar/ad/ad7549.exe/data0003 - OK
ad.rar/ad/ad7549.exe/data0004 - OK
ad.rar/ad/ad_2508.exe/stream/Script - OK
ad.rar/ad/ad_2508.exe/stream/data0001 - infected by not-a-virus:AdWare.Win32.Boran.du
ad.rar/ad/dodolook040.exe/stream/Script - OK
ad.rar/ad/dodolook040.exe/stream/data0001 - OK
ad.rar/ad/dodolook040.exe/stream/data0002/data0001 - OK
ad.rar/ad/dodolook040.exe/stream/data0002/data0002 - OK
ad.rar/ad/dodolook040.exe/stream/data0002/data0003 - OK
ad.rar/ad/dodolook040.exe/stream/data0002/data0004 - OK
ad.rar/ad/dodolook040.exe/stream/data0002 - OK
ad.rar/ad/dodolook040.exe/stream - OK
ad.rar/ad/dodolook040.exe - OK

上报

显示全部楼层 · 发表于 2008-3-28 11:09:24

detected: adware not-a-virus:AdWare.Win32.BHO.afu URL: http://bbs.kafan.cn/attachment.p ... d7549.exe//data0002
广告更精彩。

显示全部楼层 · 发表于 2008-3-28 11:28:36

Virus: not-a-virus:AdWare.Win32.BHO.afu, not-a-virus:AdWare.Win32.Boran.du

显示全部楼层 · 发表于 2008-3-28 11:34:49

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\ad.rar'
C:\Documents and Settings\Administrator\My Documents\
  ad.rar
[0] Archive type: RAR
--> ad\ad7549.exe
      [DETECTION] Contains detection pattern of the dropper DR/BHO.afu.12
--> ad\ad_2508.exe
      [DETECTION] Contains detection pattern of the dropper DR/Boran.DU.1
--> ad\dodolook040.exe
   [WARNING] The file was ignored!
  ad.rar:Zone.Identifier

End of the scan: 2008年3月27日  20:34
Used time: 00:03 min

The scan has been done completely.

   0 Scanning directories
   5 Files were scanned
   2 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   3 Files not concerned
   1 Archives were scanned
   1 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-3-28 11:35:22

Begin scan in 'F:\Virus\ad.rar'
F:\Virus\ad.rar
  [0] Archive type: RAR
  --> ad\ad7549.exe
   [DETECTION] Contains detection pattern of the dropper DR/BHO.afu.12
  --> ad\ad_2508.exe
   [DETECTION] Contains detection pattern of the dropper DR/Boran.DU.1
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2008-3-28 11:35:51

nsis啊。。。

显示全部楼层 · 发表于 2008-3-28 11:39:14

D:\Documents and Settings\EKINCHENG\桌面\ad.rar » RAR » ad\ad7549.exe » NSIS » cpush.dll - a variant of Win32/Adware.Cinmus application - was a part of the deleted object
D:\Documents and Settings\EKINCHENG\桌面\ad.rar » RAR » ad\dodolook040.exe » NSIS » 2.exe » NSIS » DoSSSetup.dll - a variant of Win32/Adware.Cinmus application - was a part of the deleted object
D:\Documents and Settings\EKINCHENG\桌面\ad.rar » RAR » ad\dodolook040.exe » NSIS » 2.exe » NSIS » acpidisk.sys - a variant of Win32/Adware.Cinmus application - was a part of the deleted object
D:\Documents and Settings\EKINCHENG\桌面\ad.rar » RAR » ad\ad7549.exe - a variant of Win32/Adware.Cinmus application - was a part of the deleted object
D:\Documents and Settings\EKINCHENG\桌面\ad.rar » RAR » ad\dodolook040.exe - a variant of Win32/Adware.Cinmus application - was a part of the deleted object
D:\Documents and Settings\EKINCHENG\桌面\ad.rar » RAR » ad\dodolook040.exe » NSIS » 2.exe - a variant of Win32/Adware.Cinmus application - was a part of the deleted object
D:\Documents and Settings\EKINCHENG\桌面\ad.rar - a variant of Win32/Adware.Cinmus application - deleted - quarantined

显示全部楼层 · 发表于 2008-3-28 11:40:17

金山华丽全面 MISS

其中一个东西的生成物可杀

显示全部楼层 · 发表于 2008-3-28 12:59:25

Hello.
New malicious software was found in the attached file.
not-a-virus:AdWare.Win32.Cinmus.dym
Its detection will be included in the next update. Thank you for your help.
-----------------
Regards, Vladimir Lebedev
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com http://www.viruslist.com

[病毒样本] 3pcs

本帖子中包含更多资源