质量很高的广告软件，已经有EXE（很多都过主流）

leonfg

C:\Documents and Settings\GUNDAM\桌面\BO1018.rar » RAR » BO1018.exe » NSIS » pryfile.sys - Win32/Adware.WSearch application

wusuobuzai

大哥,NOD32都报了~!

雨宫优子

NOD32不代表全部....

allinwonderi

质量不错。 to lab

onesagain

样本运行后微点动作：


但似乎也没完全防住，Windows出现如下错误：

小邪邪

BO1018.exe           Generic BackDoor (特洛伊)

xi889

2008/10/5 21:21:17        Detected: Rootkit.Win32.Agent.efg        F:\BO1018\BO1018.exe/stream/data0003         
2008/10/5 21:21:17        Detected: Trojan.Win32.Vapsup.mam        F:\BO1018\BO1018.exe/stream/data0004         

328397663

2008-10-5 21:32:46        检测到威胁: Rootkit.Win32.Agent.efg        C:\Documents and Settings\Administrator\桌面\My Documents.rar/pryrege.sys               
2008-10-5 21:32:46        已删除: Rootkit.Win32.Agent.efg        C:\Documents and Settings\Administrator\桌面\My Documents.rar/pryrege.sys               
2008-10-5 21:32:47        检测到威胁: Trojan.Win32.Vapsup.mam        C:\Documents and Settings\Administrator\桌面\WINSL35.rar/WINSL35.DLL               
2008-10-5 21:32:47        已删除: Trojan.Win32.Vapsup.mam        C:\Documents and Settings\Administrator\桌面\WINSL35.rar/WINSL35.DLL               
2008-10-5 21:32:47        检测到威胁: Rootkit.Win32.Agent.efg        C:\Documents and Settings\Administrator\桌面\BO1018.rar/BO1018.exe/stream/data0003               
2008-10-5 21:32:47        检测到威胁: Trojan.Win32.Vapsup.mam        C:\Documents and Settings\Administrator\桌面\BO1018.rar/BO1018.exe/stream/data0004               
2008-10-5 21:32:47        已删除: Trojan.Win32.Vapsup.mam        C:\Documents and Settings\Administrator\桌面\BO1018.rar/BO1018.exe               
Hello,

pryfile.sys - not-a-virus:AdWare.Win32.WSearch.df

This file is an Advertizing Tool, it is detected by
extended databases set. See more info about
extended databases here: http://www.kaspersky.com/extraavupdates

update.ini

No malicious code was found in this file.

Please quote all when answering.

[ 本帖最后由 328397663 于 2008-10-5 21:44 编辑 ]

scottxzt

毛豆启发直接砍掉.

雨宫优子

那个错误是因为微点并没有回滚完

在计划任务中有残留...我也是找了好半天才找到的...