3 Adware

显示全部楼层 · 发表于 2008-6-13 20:05:29

RS20.48.42未杀！

显示全部楼层 · 发表于 2008-6-13 23:09:31

[Scanning : C:\Documents and Settings\All Users\Documents\Test]

C:\Documents and Settings\All Users\Documents\Test\3.zip<ZIP>:3147.exe3<PECompact2>:3147.exe3<DLLRES>:R_21.exe <- Variant:Adware.Ejik.bh : No action

Scanned objects : 12

Infected objects : 1

显示全部楼层 · 发表于 2008-6-13 23:10:03

[Found possible Trojan] <W32/Heuristic-VFM!Eldorado (not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\3.zip->windxp32.dll->(PecBundle)->(PECompact)

---------------------------------------------------------------------
Scan ended: 2008-6-13, 23:09:55
Duration: 0:00:16

Scan result:

Scanned files:    6
Infected objects:    1
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

显示全部楼层 · 发表于 2008-6-13 23:10:35

原帖由 Precious 于 2008-6-13 13:51 发表
诺顿又无视。。
汗。用诺顿跑样本区真不好玩，以后就只来看看好了

相信外国的样本区会好一点.

显示全部楼层 · 发表于 2008-6-14 23:25:26

D:\tools\新建文件夹\3.zip <3147.exe3> - Win32/Dlqqhelp!generic 特洛伊木马。已隔离

显示全部楼层 · 发表于 2008-6-14 23:58:38

已刪除: 廣告軟體 not-a-virus:AdWare.Win32.AdMoke.asr 檔案: C:\Documents and Settings\kato9096\桌面\3.zip/windxp32.dll//PE_Patch.PECompact//PecBundle//PECompact
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.Ejik.gu 檔案: C:\Documents and Settings\kato9096\桌面\3.zip/4074GOOGLE??讛蔓隞?exe3//NSPack
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.AdMoke.atg 檔案: C:\Documents and Settings\kato9096\桌面\3.zip/3147.exe3//PE_Patch.PECompact//PecBundle//PECompact

显示全部楼层 · 发表于 2008-6-15 00:02:49

广告软件名称:AdWare.Win32.AdMoke.wr

程序:
C:\SANDBOX\SPATRA\DEFAULTBOX\USER\CURRENT\LOCAL SETTINGS\TEMP\3.ZIP 的临时目录 1\3147.EXE3
是广告软件!
已成功阻止其运行,是否要删除此文件?

[病毒样本] 3 Adware

15/0

ArcaVir2008

F-Prot 4.4.4

ca