转自绅博，若干驱逐舰不杀的

fladsysn

原帖转自绅博：http://61.185.81.124/read.php?tid-122344.html

这是我用驱逐舰杀了之后的残余再次打包，跟大家交流下。

fladsysn

re

fladsysn

rere

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\vt'
C:\Documents and Settings\Administrator\My Documents\vt\ss\
  1232143.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Small.eat.8
      [INFO]      The file was deleted!
  2CD0511AT.exe
  50114.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Adload.JJ
      [INFO]      The file was deleted!
  ad1830.exe
      [DETECTION] Contains signature of the dropper DR/BHO.BW.10
      [INFO]      The file was deleted!
  ch100.exe
  g3.exe
      [DETECTION] Is the Trojan horse TR/StartPage.PF.1
      [INFO]      The file was deleted!
  internet.exe
      [DETECTION] Contains signature of the Ad- or Spyware ADSPY/Agent.BC.2
      [INFO]      The file was deleted!
  jfhkd.exe
      [DETECTION] Is the Trojan horse TR/Qhost.N.1
      [INFO]      The file was deleted!
  lwdb.exe
      [DETECTION] Is the Trojan horse TR/Qhost.N.1
      [INFO]      The file was deleted!
  mms_955.exe
  qyjplk.exe
      [DETECTION] Is the Trojan horse TR/Qhost.N.1
      [INFO]      The file was deleted!
  UniBar.exe
      [DETECTION] Is the Trojan horse TR/Nimosw.A.7
      [INFO]      The file was deleted!
  windows.exe
  yenyesg.exe
      [DETECTION] Is the Trojan horse TR/Qhost.N.1
      [INFO]      The file was deleted!

turkey2k6

Starting the file scan:

Begin scan in 'D:\SysConfig\桌面\ss'
D:\SysConfig\桌面\ss\1232143.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Small.eat.8
      [INFO]      The file was moved to '4605aaf7.qua'!
D:\SysConfig\桌面\ss\50114.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Adload.JJ
      [INFO]      The file was moved to '4603aaf5.qua'!
D:\SysConfig\桌面\ss\ad1830.exe
      [DETECTION] Contains signature of the dropper DR/BHO.BW.10
      [INFO]      The file was moved to '4603ab2a.qua'!
D:\SysConfig\桌面\ss\g3.exe
      [DETECTION] Is the Trojan horse TR/StartPage.PF.1
      [INFO]      The file was moved to '4600aaf9.qua'!
D:\SysConfig\桌面\ss\jfhkd.exe
      [DETECTION] Is the Trojan horse TR/Qhost.N.1
      [INFO]      The file was moved to '463aab2c.qua'!
D:\SysConfig\桌面\ss\lwdb.exe
      [DETECTION] Is the Trojan horse TR/Qhost.N.1
      [INFO]      The file was moved to '4636ab3d.qua'!
D:\SysConfig\桌面\ss\qyjplk.exe
      [DETECTION] Is the Trojan horse TR/Qhost.N.1
      [INFO]      The file was moved to '463cab40.qua'!
D:\SysConfig\桌面\ss\UniBar.exe
      [DETECTION] Is the Trojan horse TR/Nimosw.A.7
      [INFO]      The file was moved to '463bab35.qua'!
D:\SysConfig\桌面\ss\yenyesg.exe
      [DETECTION] Is the Trojan horse TR/Qhost.N.1
      [INFO]      The file was moved to '4640ab2c.qua'!

turkey2k6

为啥我的红伞对internet.exe没凡应?

mms_955.exe静态扫不报,运行报

[ 本帖最后由 turkey2k6 于 2007-2-14 14:26 编辑 ]

5hong

瑞星一个都扫不出来……

kp2006

这个样本发了几百遍了 到处传

金山杀9

[ 本帖最后由 kp2006 于 2007-2-14 15:03 编辑 ]

沸沸

垃圾瑞星报了8个！

yitp

NOD32不足