聚搜样本

hddu

EQ拦截：
2009-02-27 15:45:13    创建文件      操作:阻止
进程路径:E:\新建文件夹 (2)[1]\setup_69172.exe
文件路径:C:\WINDOWS\system32\JuSou
触发规则:所有程序规则->WINDOWS_2->%windir%\s*\*
2009-02-27 15:45:13    创建文件      操作:阻止
进程路径:E:\新建文件夹 (2)[1]\setup_69172.exe
文件路径:C:\WINDOWS\system32\JuSou
触发规则:所有程序规则->WINDOWS_2->%windir%\s*\*
2009-02-27 15:45:13    创建文件      操作:阻止
进程路径:E:\新建文件夹 (2)[1]\setup_69172.exe
文件路径:C:\WINDOWS\system32\JuSou\History.FSC
触发规则:所有程序规则->WINDOWS_2->%windir%\s*\*
2009-02-27 15:45:13    运行应用程序      操作:阻止
进程路径:E:\新建文件夹 (2)[1]\setup_69172.exe
文件路径:C:\WINDOWS\system32\drwtsn32.exe
命令行:-p 1308 -e 480 -g
触发规则:所有程序规则->系统程序_黑名单->%windir%\system32\drwtsn32.exe
2009-02-27 15:45:48    创建文件      操作:阻止并结束进程
进程路径:E:\新建文件夹 (2)[1]\nextyahooie.exe
文件路径:C:\WINDOWS\system32\50cde1a7bd.dll
触发规则:所有程序规则->WINDOWS_2->%windir%\system*\*.dll

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\Administrator\Desktop\新建文件夹 (2)'
C:\Users\Administrator\Desktop\新建文件夹 (2)\abyglsvc.DLL
    [DETECTION] Contains HEUR/Malware suspicious code
    [NOTE]      The detection was classified as suspicious.
    [NOTE]      The file was moved to '4a20af50.qua'!
C:\Users\Administrator\Desktop\新建文件夹 (2)\gxmknin.dll
    [DETECTION] Is the TR/Dldr.Delphi.Gen Trojan
    [NOTE]      The file was moved to '4a14af66.qua'!
C:\Users\Administrator\Desktop\新建文件夹 (2)\nextyahooie.exe
    [DETECTION] Contains HEUR/Malware suspicious code
    [NOTE]      The detection was classified as suspicious.
    [NOTE]      The file was moved to '4a1faf53.qua'!
C:\Users\Administrator\Desktop\新建文件夹 (2)\setup_69172.exe
    [NOTE]      The file was moved to '4a1baf53.qua'!
    --> Object
      [1] Archive type: RSRC
      --> Object
        [DETECTION] Is the TR/Agent.IE.155 Trojan
      --> Object
        [DETECTION] Contains recognition pattern of the ADSPY/IESearchBa.68 adware or spyware
C:\Users\Administrator\Desktop\新建文件夹 (2)\THEEASVC.DLL
    [DETECTION] Is the TR/Agent.IE.155 Trojan
    [NOTE]      The file was moved to '49ecaf36.qua'!
C:\Users\Administrator\Desktop\新建文件夹 (2)\wcnmlgieb.DLL
    [DETECTION] Contains HEUR/Malware suspicious code
    [NOTE]      The detection was classified as suspicious.
    [NOTE]      The file was moved to '4a15af51.qua'!
C:\Users\Administrator\Desktop\新建文件夹 (2)\wdzkuzho.exe
    [DETECTION] Is the TR/ATRAPS.Gen Trojan
    [NOTE]      The file was moved to '4a21af53.qua'!
C:\Users\Administrator\Desktop\新建文件夹 (2)\XXIUYDIEB.DLL
    [DETECTION] Contains recognition pattern of the ADSPY/IESearchBa.68 adware or spyware
    [NOTE]      The file was moved to '49f0af47.qua'!
C:\Users\Administrator\Desktop\新建文件夹 (2)\yfqghin.dll
    [DETECTION] Is the TR/Dldr.Delphi.Gen Trojan
    [NOTE]      The file was moved to '4a18af55.qua'!


End of the scan: 2009年2月27日  01:14
Used time: 00:04 Minute(s)

The scan has been done completely.

      1 Scanned directories
     16 Files were scanned
      7 Viruses and/or unwanted programs were found
      3 Files were classified as suspicious
      0 files were deleted
      0 Viruses and unwanted programs were repaired
      9 Files were moved to quarantine
      0 Files were renamed
      0 Files cannot be scanned
      6 Files not concerned
      0 Archives were scanned
      0 Warnings
      9 Notes

PlayWill

过AVAST KV扫描····上报

wajika

呵呵   前几天我也提取到了