popularos.exe [md5:41f043]

mofunzone

是不是应该回归大自然，裸奔一下了。。

File:	popularos.exe
Status:	INFECTED/MALWARE
MD5:	41f043f8b9bbcd87917e602e98942164
Packers detected:	-
Scanner results
Scan taken on 25 May 2008 00:36:45 (GMT)
A-Squared	Found  nothing
AntiVir	Found ADSPY/Virtumonde.trh
ArcaVir	Found Heur.W32
Avast	Found  nothing
AVG Antivirus	Found  nothing
BitDefender	Found  nothing
ClamAV	Found  nothing
CPsecure	Found  nothing
Dr.Web	Found  nothing
F-Prot Antivirus	Found  nothing
F-Secure Anti-Virus	Found  nothing
Fortinet	Found  nothing
Ikarus	Found Trojan.Win32.Vundo.H
Kaspersky Anti-Virus	Found not-a-virus:AdWare.Win32.Virtumonde.trh
NOD32	Found  nothing
Norman Virus Control	Found  nothing
Panda Antivirus	Found  nothing
Sophos Antivirus	Found  nothing
VirusBuster	Found  nothing
VBA32	Found  nothing

Joker

危险进程(PID:4084): C:\Documents and Settings\Administrator\桌面\popularos.exe

产品名称: 无
文件版本: 无
公司名称: 无
文件描述: 无
数字签名: 没有发现签名

危险级别: 低
级别评分: 27.8008880
状态: 进程已被结束，但还没有清除，等待进一步处理。

建议: 如果能确认这个文件是安全的可以信任它，如果能确认是不安全的可以删除它，如果是正常的程序被意外的终止，可以暂时信任然后再重新运行一次。

如果无法确认它是否安全，建议使用在线扫描得到进一步的建议。


产物把红伞过了

AhnLab-V3	2008.5.22.1	2008.05.23	-
AntiVir	7.8.0.19	2008.05.24	-
Authentium	5.1.0.4	2008.05.23	-
Avast	4.8.1195.0	2008.05.24	-
AVG	7.5.0.516	2008.05.24	-
BitDefender	7.2	2008.05.25	-
CAT-QuickHeal	9.50	2008.05.24	-
ClamAV	0.92.1	2008.05.24	-
DrWeb	4.44.0.09170	2008.05.25	-
eSafe	7.0.15.0	2008.05.22	-
eTrust-Vet	31.4.5817	2008.05.23	-
Ewido	4.0	2008.05.24	-
F-Prot	4.4.4.56	2008.05.23	-
F-Secure	6.70.13260.0	2008.05.23	Vundo.gen179
Fortinet	3.14.0.0	2008.05.24	-
GData	2.0.7306.1023	2008.05.23	-
Ikarus	T3.1.1.26.0	2008.05.25	-
Kaspersky	7.0.0.125	2008.05.25	-
McAfee	5302	2008.05.23	-
Microsoft	1.3520	2008.05.25	Trojan:Win32/Vundo.gen!H
NOD32v2	3128	2008.05.23	-
Norman	5.80.02	2008.05.23	-
Panda	9.0.0.4	2008.05.24	-
Prevx1	V2	2008.05.25	-
Rising	20.45.42.00	2008.05.23	-
Sophos	4.29.0	2008.05.24	-
Sunbelt	3.0.1123.1	2008.05.17	-
Symantec	10	2008.05.25	-
TheHacker	6.2.92.318	2008.05.23	-
VBA32	3.12.6.6	2008.05.24	-
VirusBuster	4.3.26:9	2008.05.24	-
Webwasher-Gateway	6.6.2	2008.05.25	Win32.Malware.gen (suspicious)

[ 本帖最后由 Joker 于 2008-5-25 08:47 编辑 ]

电影结束了

生成的DLL过卡巴...饿...上报...
Hello,

efcATKBQ.dll - Trojan.Win32.Obfuscated.aul

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Evgeny Aseev
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

> Attachment: virus.rar

>  password:virus

[ 本帖最后由 电影结束了 于 2008-5-25 12:04 编辑 ]

挪威的冬天

金山毒霸 0

Palkia

rs 0

tracydk

qigang

RS20.45.62未杀！

allinwonderi

确实是启发了。
[Scanning : C:\Documents and Settings\All Users\Documents\Test]


C:\Documents and Settings\All Users\Documents\Test\popularos.rar<RAR>:popularos.exe <- Heur.W32 : No action



Scanned objects : 2

Infected objects : 1

allinwonderi

MISS.

尤金卡巴斯基

已删除：广告程序 not-a-virus:AdWare.Win32.Virtumonde.trh        文件　: G:\Temp\popularos.rar/popularos.exe