来几个(1号)

显示全部楼层 · 发表于 2008-4-1 11:09:52

http://www.942yx.com/down/20080307soft.rar
QQ工具
http://www.uu325.cn/html/QQ-heike/
http://lan1989.wmye.cn/qxsp.exe
http://al.99.vc/1.js
http://biyima.12mf.cn/data/1.exe

[ 本帖最后由流清泉于 2008-4-1 18:08 编辑 ]

显示全部楼层 · 发表于 2008-4-1 11:14:32

Starting the file scan:

Begin scan in 'E:\20080307soft.rar'
E:\20080307soft.rar
  [0] Archive type: RAR
  --> YFSysKeys.ocx
   [DETECTION] Contains suspicious code HEUR/Malware
   [WARNING] The file was ignored!

The file '######.exe' has been determined to be 'MALWARE'. Our analysts named the threat JOKE/VB.BU. The term "JOKE/" denotes a Joke program that usually does not contain malicious code.Detection is added to our virus definition file (VDF) starting with version 7.00.03.100.

The file 'YFSysKeys.ocx' has been determined to be 'MALWARE'. Our analysts named the threat JOKE/VB.BU.1. The term "JOKE/" denotes a Joke program that usually does not contain malicious code.Detection is added to our virus definition file (VDF) starting with version 7.00.03.100. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Malware.

=================================================

Starting the file scan:

Begin scan in 'D:\qxsp.exe'
D:\qxsp.exe
   [DETECTION] Is the Trojan horse TR/Downloader.Gen
   [INFO]    The file was deleted!

The file '1.exe' has been determined to be 'MALWARE'. Our analysts discovered that the file is a Trojan. In general this kind of programs contains harmful functionality called payload. Detection will be added to our virus definition file (VDF) with one of the next updates.

The file '1.js' has been determined to be 'MALWARE'. Our analysts discovered that the file is a Trojan containing download functionality. Detection will be added to our virus definition file (VDF) with one of the next updates.

[ 本帖最后由 Exia 于 2008-4-1 22:52 编辑 ]

显示全部楼层 · 发表于 2008-4-1 11:16:00

呵呵，运行了一下，费尔提示C:\WINDOWS\system32\YFSysKey.dll，劫持任务管理器，用费尔修复一下后，重新运行explorer.exe才看到桌面。。。

HIPS的同学快来下。。。

显示全部楼层 · 发表于 2008-4-1 11:22:44

nod不认识

显示全部楼层 · 发表于 2008-4-1 11:24:02

Virus: not-virus:BadJoke.Win32.VB.bu (2x)

显示全部楼层 · 发表于 2008-4-1 11:25:13

果然。。。

显示全部楼层 · 发表于 2008-4-1 11:47:46

江民飘

显示全部楼层 · 发表于 2008-4-1 12:26:02

nod missed again

显示全部楼层 · 发表于 2008-4-1 15:17:55

玩笑而已。。。。

显示全部楼层 · 发表于 2008-4-1 15:46:08

nod加油啊

[已鉴定] 来几个(1号)

回复 5楼 gaojun7206 的帖子